The 2026 buyer’s guide to AI healthcare vendors.
2026-04-21
Sarthi Editorial
The inbox of a medical practice owner now carries a category of pitch that didn’t exist five years ago. AI vendors promise to handle the visit cycle. Most overpromise. A few are real. Ten questions to triage them.
If you run a medical practice in 2026, your inbox carries a category of pitch that did not exist five years ago. AI healthcare vendors promise to handle the visit cycle — intake, scribing, coding, prior authorization, follow-up — and the volume of those pitches has gone from one a quarter to eight a month. Most will not survive their next funding round. A few will become foundational to how your practice runs.
Picking the right one matters more than any other software decision you will make this decade, because this category is not replacing one tool — it is becoming the layer your practice runs on. The cost of choosing wrong is not a deinstall and a refund; it is the operational debt of having handed off a year of practice rhythm to a vendor that turned out not to know what it was doing.
This is the buyer’s guide we wish someone had given us when we started building Sarthi. Ten questions designed to compress 60 minutes of due diligence into a triage your team can run on every vendor that lands in your inbox. None is meant to disqualify any specific vendor. All are meant to make sure you know what you’re signing.
The ten questions
Ask each vendor the same questions, in the same words, in the same order. Take notes. Their answers look very different by the time you compare them side-by-side.
Show me a workflow you handle that my staff doesn't even know they need help with.
Most demos show the obvious workflows: ambient scribing, inbound voice, fax intake. Useful, but not differentiating — every vendor in this category has those.
A vendor that has actually sat in a medical practice can name a workflow you’d recognize as a pain — but one your team has stopped seeing because they work around it. Annual-wellness-visit risk-adjustment capture at a primary care group. Device-clinic cadence at a cardiology group. CPAP compliance windows at a pulmonology practice. The post-discharge medication-reconciliation tail at a hospitalist group. The MIPS measure that drifted out of compliance between quarterly reviews.
If they can only show you the demos every other vendor shows you, they’re operating at the surface of your practice.
What does your system not do?
A vendor with a clear answer to “what we don’t do” has an actual product. A vendor without one is selling a deck.
Examples of good answers: “We don’t make clinical decisions; the clinician approves every order.” “We don’t bridge to Epic via a custom integration; we use the published API surface.” “We don’t do behavioral-health ambient documentation, because the consent model isn’t worked out yet.” Each of those is a real boundary, defended for a real reason.
Vague answers — “we customize to your needs,” “we can do anything you need” — are a tell. Either the vendor doesn’t know their own product yet, or they’re willing to oversell it. Neither is a partner you want for the next three years.
Will it work with my EHR — and what does ‘work with’ actually mean?
“Works with Epic” can mean anything from a published API integration to a screen-scraping bot pretending to be a user. Both can be defensible — but you should know which one you’re getting and price it accordingly.
Specifically ask: native API connector, HL7 / FHIR, or RPA bridge? What gets read, what gets written, and what gets logged? How often is the connector updated when the EHR updates? What happens during a payer-portal change — does the vendor patch within hours or within weeks?
The honest answer for most vendors will be a mix — FHIR where it exists, HL7 where it doesn’t, RPA where neither does. That’s fine. The dishonest answer is a single yes/no.
Apply the same question to your RCM stack. Where does the vendor sit relative to your clearinghouse, your existing RCM platform, your patient-billing tool? “We replace everything” and “we plug into what you have” are different products, priced differently. Make the vendor say which one they are.
Who owns the data, and what happens on day 91 if I leave?
The covered entity owns the PHI under the BAA. That is settled law. The harder question is what happens to the derivative data — the structured outputs, the audit logs, the model weights your data may have shaped.
Get specific. Export formats: standards-compliant or proprietary? Deletion schedule: documented or discretionary? Indemnification on residual model state? Does the vendor retain de-identified copies of anything for product improvement, and under what consent? What does the runbook look like in week one of an exit?
A vendor whose answer to this is “let our legal team handle that” is a vendor planning lock-in. A vendor with a one-page exit document already written has thought about it because their previous customers made them.
Show me your evaluation harness.
Any vendor making clinical-adjacent decisions should be running offline test sets graded by clinicians, online quality telemetry, and structured regression tracking. Ask to see the actual artifact: the test bank, the rubric, the dashboard.
“We do extensive testing” is not an evaluation harness. “Here’s our weekly clinician review of 200 graded cases against last week’s 200 to track regressions, and here’s the rubric we use, and here’s last quarter’s top three regressions and what we shipped to fix them” is.
For agentic systems specifically, ask how the vendor evaluates multi-step workflows — not just single-prompt accuracy. The hardest failure modes in production live at the seams between steps, and most evaluation harnesses don’t test seams.
When the system is wrong, how do I find out?
Silent failures are the single highest-cost failure mode in clinical AI. A wrong prior authorization that the practice never sees until the denial arrives six weeks later costs more than ten loud failures the system flagged for human review on the same day.
Ask: what is escalated to a human, on what threshold, with what context? What does the audit log look like for an action the system took unilaterally? What did the last three failures look like, and what changed in the system afterward?
A vendor who can’t answer the last question hasn’t watched their own product in production. That doesn’t make them malicious; it makes them young. Decide whether you want to be the practice that teaches them.
What does your price actually cover — and what shows up as a line item six months in?
Per-claim fees, per-seat fees, per-call fees, per-API-token fees, per-payer-portal fees, per-faxed-page fees, overage-bucket fees. Each one is defensible in isolation. In aggregate, they make the published price irrelevant.Per-claim fees in particular tend to scale linearly with the practice’s billed revenue — check what that becomes at month thirteen.
Get specific: at the volume your practice runs, what is the all-in monthly cost — the published number plus every line item that’s metered? What’s the cost of a single high-volume month above the contract baseline? What’s the price next year, in writing?
A flat-fee vendor isn’t necessarily cheaper. But a vendor with five metering dimensions has a different incentive than a vendor with one — and the incentive shows up in month seven, not month one.
Who answers when something breaks at 2am on a Saturday?
Specialty practices don’t run 9-to-5 — the inbox doesn’t pause for the weekend, and the after-hours voicemail keeps filling. When the system fails, the failure tends to happen overnight or on a holiday more often than during business hours, because that’s when the exception cases land.
Ask: what is the on-call rotation? Who actually pages — a tier-1 outsourced support desk, or an engineer with commit access to the system? What’s the response SLA? What does a recent post-incident artifact look like?
A vendor whose support page reads “Mon–Fri, 9–5 ET” is selling a tool, not running a layer. That distinction will matter on the first Saturday a fax triage goes wrong.
Tell me about a practice that churned. What did they say on the way out?
Every vendor has churned accounts. Pretending otherwise is a tell. The question is whether the vendor knows why they churned and is willing to tell you.
Ask the question directly. A vendor with a credible answer — “we onboarded a multi-site group too quickly and the configuration didn’t fit; we now require X before signing” — is a vendor that learns from churn. A vendor who deflects, or who blames the customer, is a vendor whose churn pattern you will learn about by being it.
Reference calls with happy customers are useful. Reference calls with departed customers, when the vendor will arrange them, are more useful.
What is your roadmap response to CMS-0057-F, the 2025 HIPAA Security Rule update, and ONC information blocking?
The vendor doesn’t need to recite the regulations. But they should be able to articulate what each one means for their product roadmap, and what they’re shipping in response.
A vendor who has never heard of CMS-0057-F is not building for clinical practice in 2026. A vendor who has, but says “we’ll handle that when the deadline gets closer,” is operating at the wrong tempo. A vendor who can explain how the FHIR Prior Authorization API changes their backend, with a target ship date, is operating at yours.
Bonus question: ask what they think about the next regulation, the one that hasn’t been finalized yet. The honest “we don’t know yet” is fine. The empty smile is not.
How to use the list
You probably don’t have time to ask every question of every vendor. The first three questions — the workflow demo, “what we don’t do,” and EHR fit — are triage. A vendor that gives shallow answers to those is unlikely to give deep answers to the others. Cut early.
The next four questions — data ownership, evaluation harness, failure modes, pricing — are the diligence questions. Save them for the vendors that survive the first round. Take notes; ask each vendor the same questions, in the same words, in the same order. Their answers will look meaningfully different by the time you compare them side-by-side.
The last three questions — on-call, churn, regulatory roadmap — are governance questions. By the time you’re asking them, you’re already considering signing. They are meant to surface the things that will matter in year two of the engagement, not the things that close the deal.
This is also not a list designed to lead you to Sarthi. We have answered all ten of these questions to ourselves and to our launch partners; we can answer them again to you on a working session. But the questions stand on their own. Use them on us. Use them on everyone.
- 1. HHS Office for Civil Rights. (2025). HIPAA Security Rule Notice of Proposed Rulemaking — final rule and effective dates.
- 2. Centers for Medicare & Medicaid Services. (2024). Final Rule CMS-0057-F: Advancing Interoperability and Improving Prior Authorization.
- 3. Office of the National Coordinator for Health Information Technology. (2024). Information Blocking Final Rule (45 CFR Part 171) and ongoing enforcement guidance.
- 4. Peterson Health Technology Institute. (2024–2025). Health AI evaluation framework and ambient-documentation review.
- 5. KLAS Research. (2025). AI Adoption in Specialty Practices.
We answer all ten of these on a 30-minute call.
Bring the list. We’ll walk you through what Sarthi doesn’t do, the BAA, the evaluation harness, the on-call posture, and the regulatory roadmap — on a workflow and payer mix that looks like yours.