Codes Health vs LawPro.ai: how they compare in 2026

The models are the engine of the core capabilities and sit on a workflow system that would still function without them. Four AI functions are described in present tense on current pages: an agentic retrieval system, error-checking that reviews an authorization for misspellings, missing dates of service and absent signatures before submission, missing-record detection that flags gaps in the treatment history, and generated medical chronologies, encounter and bill summaries and extracted case insights. Underneath that sits a request-tracking platform with per-request status, visibility into every fax and call, and a provider network. The vendor's own framing is what keeps this off the top band and it is stated plainly rather than inferred: retrieval runs on a mixture of AI and human intervention, insights are verified by humans, and the headline operational measure is a turnaround time. Remove the models and a firm would still receive a tracked, chased retrieval service, which is what the band above forbids. Checked 4 September 2026.

Remove the models and nothing remains to sell. Every named module is an inference product over an uploaded medical file: TimeLineD builds the chronology, FileLens characterizes each document, Snapshot extracts injuries, treatments, medications and referrals, SpecialsAI identifies and totals medical costs, Case360 assembles the whole-case view, LegalDocs drafts the demand and the deposition preparation material, and Case Assistant answers questions from the records. There is no document management system, no case management system and no workflow layer underneath that would still be worth buying without them; the platform does not store a firm's matters or run its practice, it reads files and returns analysis. The plan's own inclusion list makes the point, running to an onboarding session, AI-generated summaries, medical timelines and billing, and an AI chat assistant. Checked 4 September 2026.

Grounding is claimed and accuracy is asserted, and nothing is measured. The product is described as grounded in the firm's specific case context and tailored to the practice, with chronologies drawn from the client's own retrieved records, so the output has a real source; but no retrieval method is described, no output is shown citing a record a reader can open, and there is no accuracy figure, test set, evaluation or failure-mode statement anywhere on the estate. The assurance offered in place of measurement is human review: insights are stated to be verified by humans, and every batch is stated to be verified for completeness before it reaches the firm. The published figures are operational rather than accuracy claims, running to 80 percent less manual review, 2.5x faster retrieval, 50 percent more case capacity and 1.7x larger settlements, none attributed or dated. The band below does not fit, because its words require that nothing be published on accuracy or grounding, and both are addressed here without being evidenced. That matters on a product whose extracted insights include breaches in care. Searched the home page, the Filevine page, the state guides, the FAQ, the Terms of Use, the Privacy Policy and the Disclosure Policy on 4 September 2026.

Accuracy is the vendor's headline claim and it is asserted rather than measured. A dedicated page describes Hallucination Prevention Technology as a patent-pending framework embedded in the platform that helps ensure outputs are grounded in verified source documentation before they are presented, and that helps reduce the risk of unsupported or misleading outputs. Every sentence describing it is in that register: helps ensure, helps reduce, supports, strengthens. No mechanism is described, no validation method is named, no accuracy figure appears, no test set is described, no evaluation is published and no error rate is given, so nothing on the page can be tested by a reader. Grounding is real in the product sense, since outputs are repeatedly described as citation-backed and Case Assistant answers straight from the record, but no retrieval method is described anywhere, which is what the band above requires. One detail belongs on the record because it bears on how much weight the page carries: the same HPT page is padded with unedited website-template content, including two sales-pipeline sections headed for lead stages and sales bottlenecks and carrying lorem ipsum placeholder text.

Real review surfaces are published and the threshold at which the system runs alone is not. Three concrete controls exist and each names when it happens: AI insights are verified by humans, every batch is verified for completeness before it reaches the firm's desk, and the firm has real-time request status with updates for every fax and call plus a full audit trail on every action. The limitation worth naming is whose oversight it is. The humans in the loop are the vendor's, not the buyer's: nothing describes what a lawyer at the firm should check on receipt, what the review point is for a chronology or an extracted insight, or what happens when one is wrong. Against the review claims sit daily automated follow-up workflows that plainly run unattended and a customer account stating the case manager did not lift a finger, and no published material reconciles the two by stating where the automated boundary sits. That unstated threshold is the limb this band names as commonly absent, and the two claims together are the evidence for it rather than an argument against it. No abstention behavior and no confidence signal is described.

A review surface is built into the output and the threshold is never stated. The strongest oversight feature is architectural rather than promised: outputs are citation-backed to the underlying record, so a lawyer can trace an assertion to the page it came from, and the vendor states that its reports and chronologies are auditable so attorneys can review, verify and explain every AI-generated insight to clients. That is a real control and it is what lifts this above an asserted human-in-the-loop. What is missing is the structure around it. Nothing states which outputs require review before use, what the system does when it cannot ground a finding, or what happens after an error. Two of the vendor's own claims sit against each other without being reconciled: documents are described as ready-to-send in minutes, while the same estate frames outputs as insights an attorney verifies. Following the treatment for a vendor's own statements conflicting, the conflict is not the deduction; what it reveals is that the point at which a drafted demand leaves the firm unreviewed is unstated, and that is the limb this band names as commonly absent.

Named customers and published figures both exist and are never joined to each other. Three testimonials carry full attribution with role and firm: Charles Brown, Managing Partner at Daly & Black P.C.; Kelman Harrel, Partner at Louis Law Firm; and Skinner Louis, Managing Attorney at Louis Law Firm, whose account is operationally specific, describing a matter needing records and bills from nine to ten providers with each request tracked independently so an issue on one did not block the others. Six further customer logos appear unattributed. Separately the site publishes 80 percent less manual review, 2.5x faster retrieval, 50 percent more case capacity and 1.7x larger case settlements, and a state guide adds an average turnaround of 3 to 5 days attributed to the company's own operational data. None of those figures is tied to any named firm, none carries a date, and the two named-firm accounts carry no numbers. A fourth quotation is attributed to Sarah Miller, Shareholder at a national mass tort and litigation firm, with the firm unnamed. The turnaround figures also disagree with each other: the home page states one to two weeks and the state guides state 3 to 5 days.

Named firms carrying figures, with no dates and no method, which is unusually strong on attribution and short on everything that would let a reader test it. Zipin, Amster and Greenberg LLC is named against two figures, twice the demands written per week and eight times faster medical record processing. A second named customer, BIPA, carries 20 percent more cases processed and a 33 percent increase in case value. Three testimonials are attributed by first name, role and firm: Michelle S. at Aaron Law Group, Liz G., a paralegal at Patterson Dahlberg Injury Lawyers, and Shelby P., a paralegal at Fleschner, Stark, Tanoos and Newlin, whose account is quantified, reporting a full day a week saved for each of three support staff. This exceeds what the band's own words describe, since the band contemplates a named customer without figures or figures without the named customer and this record has both joined. It falls short of the band above on two limbs rather than one: nothing is dated, and no method is published for any figure, so a reader cannot assess what was measured or over what period. A separate set of larger claims is unattributed entirely, running to a 60 percent boost in case value, 20 percent more cases with no additional resources, 90,000 dollars additional revenue per lawyer and 50 hours saved per case. The customers and testimonials pages were not opened in this pass and are the cheapest available upgrade on this record.

Substantive and specific commitments, published where a buyer can read them before signing, and none of them contractual. The security section states that data is never used to train the vendor's models, that all AI processing is scoped to the firm's own cases, that there is no data sharing between clients, that PHI is encrypted end to end with AES-256 at rest and TLS 1.2 or above in transit, that role-based permissions restrict who sees case data with a full audit trail on every action, and that Business Associate Agreements are executed with all relevant vendors. That answers training use and separation between customers, which is more than the band below describes. Two things hold it here. No privilege or work product treatment appears anywhere, and that limb is required rather than satisfied by a strong confidentiality regime. And the finding a buyer should see is that the two legal instruments the company publishes both scope themselves away from the product: the Terms of Use govern the marketing site, which it defines as a place for current and prospective customers to access information about the services, and the Privacy Policy states it applies to Personal Data collected from Users of that site. Neither reaches a claimant's medical records. No customer agreement or BAA is published, so every commitment above rests on a product page.

Confidentiality is asserted in general terms and no commitment can be read before signing. The product ingests complete medical files and case material for injury claimants, which is privileged and protected health information in the same documents. What is published about it is a HIPAA compliance badge in the footer and a statement in the vendor's own blog that all medical records and client data are protected with industry-leading encryption and strict privacy controls. That is the whole of it. The site publishes no terms of service, no customer agreement, no privacy policy, no data processing addendum and no business associate agreement; the navigation and footer were inventoried across four pages on 4 September 2026 and the only contract-adjacent document is a four-sentence Fulfillment Policy, published to satisfy a payment processor, which addresses cancellation and final billing and refers the reader to the cancellation terms in their signed contract. That contract is not published, which is exactly the position this band describes: the commitment exists in a sales conversation and cannot be read in advance. No privilege or work product treatment, no statement on training, no retention position and nothing on segregation between firms was located.

Nothing published addresses the advice line, on a product whose own headline describes it as a nurse, paralegal and assistant all in one. There is no statement that Codes Health is not a law firm, no disclaimer that it does not provide legal advice, no description of what the product is and is not, no jurisdiction limit, and nothing on how a firm should supervise the output or maintain competence over it. The Terms of Use disclaim warranties and describe permitted use of the website, and one clause reads oddly against a business product by restricting the site to personal and non-commercial use; none of it speaks to legal work. The absence bites harder than it would elsewhere because of what the product emits: medical chronologies and extracted case insights covering diagnoses, breaches in care and future expenses, which are inputs to a demand package rather than a filing cabinet. The band above does not fit, since it describes a boilerplate disclaimer sitting in the terms, and no such disclaimer exists here. Searched the home page, the Filevine page, the Use Cases page, the FAQ, the state guides, the Terms of Use, the Privacy Policy and the Disclosure Policy on 4 September 2026.

Nothing published addresses the advice line, on a product that drafts the documents a claim is presented through. LegalDocs produces demand letters, mediation statements, arbitration statements and deposition preparation material, and SpecialsAI is sold on the promise that a firm can instantly know what a case is worth, which is a valuation judgment. Against that there is no statement that the company is not a law firm, no disclaimer that output is not legal advice, no description of the professional judgment a lawyer must apply before sending a drafted demand, no jurisdiction limit and nothing on supervision or competence. There are no terms of service on the estate in which such a disclaimer could sit, so this is not a case of a disclaimer buried in an agreement. The audience is bounded only by marketing framing, the site describing the product as built by lawyers for lawyers. The band above does not fit, because it describes a boilerplate disclaimer sitting in the terms alongside advice-flavoured marketing, and no disclaimer exists at all. Searched the home page, the seven module pages reached through the navigation, the HPT page, the free trial page, the Fulfillment Policy and the footer inventory on 4 September 2026.

No governance position of any kind was located. There is no responsible AI page, no principles statement, no management system, no named person or function accountable for model behavior, no pre-release testing regime, and nothing at all on uneven output across matter types, injury types or populations. The navigation and footer were inventoried across the full estate on 4 September 2026 and the only policy documents published are the Terms of Use, the Privacy Policy and a Responsible Disclosure Policy, none of which addresses how the models are governed. The nearest statement is the AI data policy block, which commits that data is not used to train the models and that processing is scoped to the customer's own cases; that is a confidentiality commitment and it is credited on the privilege row rather than counted twice here. The gap is pointed on a product that extracts clinical findings from records belonging to injured claimants and flags which of them matter to a case.

No governance position of any kind was located. There is no responsible AI page, no principles statement, no accountable owner named, no pre-release testing regime, no management system and nothing on uneven output. Hallucination Prevention Technology is the nearest artifact and it is an accuracy and output-quality claim rather than a governance framework; it names no owner, no testing program and no results, and it is graded on the accuracy row rather than counted twice here. The gap is pointed on this product class specifically, because the system extracts clinical findings from injured claimants' records and produces a valuation of what a case is worth, and nothing published addresses whether that valuation performs evenly across injury types, treatment histories or claimant populations. The navigation and footer were inventoried on 4 September 2026 and carry no governance, ethics or responsible AI surface.

Access control is published in real detail, retention and deletion are absent entirely, and the usual route to a better grade is closed by the vendor's own drafting. What is published: AES-256 at rest, TLS 1.2 or above in transit, PHI encrypted end to end, single sign-on, role-based permissions restricting case data to authorized users, a full audit trail on every action, regular third-party penetration testing, 24/7 monitoring and alerting, an incident response plan, and multi-region redundancy with a 99.9 percent uptime SLA. The Responsible Disclosure Policy adds a real published process with committed timelines, acknowledging a vulnerability report within seven business days and triaging within ten, with a safe-harbour authorization and named exclusions, and its scope clause expressly reaches subdomains, services and applications rather than stopping at the website. What is absent is the rest of the set. No retention period is stated for retrieved records, chronologies or prompts; no deletion or return-of-data commitment for case material exists; no subprocessor is named anywhere, only an assertion that BAAs are executed with all relevant vendors; and no cloud provider is identified. The band's usual shape does not describe this record and the note says so rather than smoothing it: this is not a generic privacy policy stretched over the product, it is a privacy policy whose first line states it applies solely to information collected by the website, so nothing published governs client data in normal operation.

Nothing published addresses retention, deletion or access for a platform built to hold complete medical files. There is no privacy policy on the estate, no security page, no trust center and no data processing addendum; the footer inventory carries About, Contact, Pricing, the platform index, a Fulfillment Policy and Careers, and nothing else. No retention period is stated for uploaded records, generated chronologies, drafted documents or the questions a user puts to Case Assistant. No deletion or return-of-data commitment exists. No subprocessor is named, no cloud provider is identified, and no encryption specification, access control model, audit logging or incident practice is described anywhere. What is published is a HIPAA badge in the footer and a general assertion in a blog post that records and client data are protected with industry-leading encryption and strict privacy controls, which names no control. The band above does not fit, because its words describe a generic privacy policy covering the product without saying what happens after processing, and here there is no privacy policy at all.

Nothing published addresses who bears the loss when the product is wrong. The Terms of Use do contain a full allocation of loss, and it is recorded here so a reader who finds it sees it was weighed: the service is provided as is with all warranties disclaimed, liability for consequential damages is excluded and capped in any event at 100 dollars, indemnity runs one way from the user to the vendor, claims must be brought within two years, and Delaware law governs. Every one of those provisions is scoped to use of the website. The instrument defines the Site as the place customers access information about the services, so none of it reaches a missed record, an inaccurate chronology or a wrongly extracted case insight, and crediting it as a product liability position would misdescribe what a buyer is actually reading. No customer agreement, service level commitment on accuracy, indemnity, warranty on output or insurance position was located on any surface. The band above does not fit, because its words require a limitation clause that disclaims the exposure the product creates, and this clause does not reach the product at all. Searched the Terms of Use, the Privacy Policy, the Disclosure Policy, the home page, the Filevine page and the FAQ on 4 September 2026.

Nothing published addresses who bears the loss when the system is wrong. No terms of service, customer agreement or master subscription agreement appears anywhere on the estate, so there is no indemnity, no liability cap, no warranty position, no disclaimer of warranties, no insurance statement and no service level commitment to read. The single contract-adjacent document is the Fulfillment Policy, four sentences published to meet a payment processor's requirement, which states that customers may cancel by giving notice as set out in their contract and that outstanding balances for services rendered fall due on cancellation. It allocates nothing. Everything else is deferred to a signed contract that is not published, so a buyer cannot establish before a sales process what the vendor stands behind when a chronology omits a treatment, a cost itemization understates specials, or a drafted demand misstates the record. The band above does not fit, since it requires a standard limitation clause disclaiming the product's exposure and there is no clause. Searched the full navigation and footer inventory across four pages, and the Fulfillment Policy, on 4 September 2026.

One named integration described at workflow level, with no depth behind it. Codes Health publishes an exclusive partnership with Filevine and a dedicated page for it, stating that record retrieval is integrated directly into the case system so a firm can request, receive and review records inside Filevine, described as a custom Filevine partner workflow. That is a named connection with a stated function rather than a logo, which is what lifts it off the band below. Two further connection classes are named without being specified: direct connections to major claims clearinghouses and payors, and custodian integrations alongside electronic claims networks, none of which identifies a counterparty. A state guide adds that high-volume firms can integrate directly with CRM platforms and case management software, without naming one. What is missing is everything an implementer would need: no statement of what syncs, in which direction, on what trigger, or what a firm must configure; no integrations page, no developer documentation and no API. One limit belongs on the record. The FAQ carries the question of whether the product works with a firm's existing case management system, and the answers on that page did not render for retrieval, so the question was located and its answer was not.

Integration is claimed throughout and no documentation an implementer could use was located. The estate states that a firm can seamlessly integrate with existing software and securely upload files in seconds, and a first-party announcement records a strategic partnership with SmartAdvocate, a case management platform, directed at connecting medical record automation to case management. A second announcement states that case management integrations have improved without naming what changed. That is a named counterparty and a stated direction of travel, which is real, but nothing published states what syncs, in which direction, on what trigger, or what a firm must configure, and no API, developer documentation or field mapping appears anywhere. The vendor's own free-trial FAQ frames the product as requiring none of this, saying it is a web-based platform, that no integration work is required, and that a customer receives login credentials and is working within a couple of clicks, which describes ease of onboarding rather than depth of connection. A dedicated integrations page exists in the navigation and was not opened in this pass; it is named here as the limit, and the grade rests on the material that was read.

Cloud delivery is implied and neither limb is stated for the product. The security section says the platform is hosted with enterprise-grade infrastructure and carries multi-region redundancy with a 99.9 percent uptime SLA, which is a resilience statement rather than a residency one: it says copies exist across regions without naming a region or offering a buyer a choice. No cloud provider is identified anywhere. Tenancy is untouched, with nothing stating whether the platform is single or multi-tenant and no dedicated or isolated option described. The one residency sentence on the estate is in the Privacy Policy, stating that data collected through the site is stored on secure servers in the United States and that third parties may not transfer it outside the United States, and it is not credited here because that policy applies by its own terms to website Personal Data rather than to claimant records. Where the AI processing happens is a separate silence, since no model provider is named at all. The record is a customer application at a published subdomain with its own login, so delivery is not in doubt; the tenancy and the region are.

Cloud delivery is stated plainly and neither of the two limbs is addressed. The vendor describes the product as a web-based platform reached with personalized login credentials, with a separate application host for the live product, so there is no ambiguity about how it is delivered and no on-premises or self-hosted option is offered or mentioned. Beyond that nothing is published. No statement says whether the platform is single or multi-tenant, no dedicated or isolated tenancy option appears at any tier, no region is named for storage or for processing, no cloud provider is identified, and no data residency commitment exists, which is a live question for a platform holding protected health information for US claimants. The only geographic fact published anywhere is the company's own address in Los Angeles, which locates the company rather than the data. With no security page and no agreement on the estate, there is no surface on which either limb could have been answered.

A compliance claim displayed as a credential, with no scope, no date and no report. HIPAA compliance is presented in the home page hero as one of three headline stats, reading fully compliant, and repeated in the security section. HIPAA is a statutory obligation a covered entity or business associate self-attests to, not an independent attestation, and no assessor, assessment date or scope accompanies it. Regular third-party penetration testing is claimed and names no testing firm, no date, no scope and no summary. No SOC 2 of either type, no ISO certification, no HITRUST and no named auditor appears anywhere, and there is no trust center or portal on the estate. The only route offered is the line that full compliance documentation is available on request, with no self-service mechanism and no form, only a general contact address, so it earns no credit as an access flow. The band below does not fit, because it requires that no independent attestation be located at all and the site does present a compliance credential; what is missing is everything that would let a buyer test it. Nothing is machine-blocked here: the estate rendered in full and this is an absence rather than a retrieval limit.

Two badges in the footer, and nothing behind either of them. The footer carries a HIPAA compliance mark dated 2026 and an AICPA SOC for Service Organizations mark, presented as images on every page. Neither is accompanied by a scope statement, an examination period, a named auditing firm, a report, or a route to request one. No trust center or security page exists on the estate, and the navigation and footer inventory carry no compliance surface at all, so there is nothing gated to request and this is an absence rather than a retrieval limit. The distinction that matters to a buyer is not drawn anywhere on the site: HIPAA is a statutory obligation the company self-attests to, while a SOC examination produces a dated report with a defined scope, and displaying the AICPA mark without naming the type, the period or the auditor tells a firm nothing about which systems were examined. No business associate agreement is offered despite the HIPAA claim. This is the band its words describe: badges on the site with no scope, no date, and no report available.

The vendor refers to its models repeatedly and identifies nothing underneath them. The estate speaks of an agentic retrieval system, medical-grade AI, and the first legal grade AI for medical records, and the AI data policy refers to our models, which asserts models the company controls without saying whose they are or what they are. No model, no version, no provider, no hosting arrangement and no processing location is named on any page, and no commitment to notify customers if any of that changes was located. The nearest thing to supply chain disclosure is the statement that Business Associate Agreements are executed with all relevant vendors, which concedes that third parties touch protected health information while naming none of them. This is the middle band rather than the floor because the vendor does describe an architecture and does claim models of its own; a buyer simply cannot learn from any published source whose model reads a claimant's medical file.

The vendor names its own framework and identifies nothing underneath it. Hallucination Prevention Technology is presented as a patent-pending proprietary framework embedded in the platform, and the rest of the estate refers to our AI platform, artificial intelligence automation and AI technology. No model is named, no provider is named, no version is given, no processing location is stated, and no commitment to notify customers if any of that changes was located. This is a product that reads protected health information, so which provider's model sees a claimant's medical file is a question a firm would need answered for its own compliance position, and no published source answers it. Nothing identifies a hosting arrangement either, and with no subprocessor list and no privacy policy on the estate there is no secondary surface where the supply chain might have surfaced. This is the middle band rather than the floor because the vendor does describe a proprietary architecture and claims a framework of its own.

The charging model is published clearly and repeatedly, and no figure appears anywhere. There is no pricing page in the navigation. Across the state guides the vendor states flat-fee pricing charged per request rather than metered by volume, with no per-page markups, no charge for follow-ups or status checks, no charge for re-requests caused by provider issues, and AI-generated chronologies included in the service rather than priced separately, closing with an instruction to contact the company for current pricing. That is a unit of charge and a clear inclusion boundary, which is why the floor band does not fit: something real is published about how a buyer would be charged. What is absent is the number, and everything around it: no rate, no band, no minimum, no term, no volume tier and no implementation cost. The material is also inconsistent about its own strongest claim, with one state guide calling the pricing transparent while the same section directs the reader to a sales conversation to learn it. A buyer can describe the shape of the invoice before contacting the company and cannot estimate it.

No pricing information is published at any level, and the page that should carry it is broken. Pricing appears in the main navigation and again in the footer, and both links resolve to a 404 error, confirmed on 4 September 2026. Every other commercial route on the site is a form: start a free trial, request a demo, or speak with an expert. The nearest thing to published commercial information is a block headed with what is included in the plan, listing an onboarding session, AI-generated summaries, medical timelines and billing, an AI chat assistant and a dedicated customer success manager. That is an inclusion list with no figure, no unit of charge, no term and no tier structure, so a buyer cannot learn whether the product is charged per seat, per case, per page or per firm. The Fulfillment Policy confirms that commercial terms live in an individually signed contract. No pricing row is owed on this record, because nothing published lifts this off the floor of the band.

The buyer is stated without ambiguity and the boundary is left open. Every surface names plaintiff law firms, with personal injury and mass tort practice named throughout and the workflow described in that idiom: pre-litigation, demand packages, settlement negotiation, case intake and acceptance decisions. Jurisdictional coverage is documented in unusual depth for a vendor this size, with retrieval claimed in all fifty states and individual state and city guides setting out facility-level submission requirements, statutory response windows and fee schedules for named hospital systems, which is a substantive coverage statement rather than a claim of breadth. Firm size is addressed only loosely, through references to high-volume firms qualifying for custom integrations. What is not stated is where the product stops: defense firms, insurers, in-house departments and government are never addressed, no practice area is identified as unsuitable, and no matter type is excluded. A separate surface addresses healthcare providers about their own intake process, which is a second audience the coverage material does not reconcile with the plaintiff-firm framing.

The buyer is stated precisely and narrowly, and the edges are left open. The navigation divides the market into three named segments the product is built for: personal injury firms, healthcare networks, and revenue cycle operations, each with its own page, which is an unusually clear statement of who is being sold to and rare in that it names two non-legal buyers alongside the legal one. Within legal the scope is personal injury and injury claims throughout, with no attempt to claim coverage of other practice areas, and the workflow described is specific to that practice: intake through medical record review, chronology, specials itemization, demand, mediation and arbitration statements and deposition preparation. What is absent is any boundary. Nothing states a firm size the product suits or does not, nothing identifies a claim type or record type it should not be used on, and nothing addresses defence-side or insurer use, which is a live question given that the same platform is sold to healthcare networks and revenue cycle operations whose interests can sit opposite a claimant's.