InPractice vs Superinsight: how they compare in 2026

The models are the mechanism and the unit of charge at once. Every function is model output: chronology construction, narrative summarization, OCR-enabled search, duplicate detection and the Case Chat feature that answers questions against the record set. The product is billed per page processed, so a customer is paying for inference directly and nothing else, with no seat fee and no subscription. The vendor states its own scope in the same terms, describing itself as specializing exclusively in medical record review rather than offering a broad legal AI platform. Remove the models and there is a file store with a search box. Checked 4 September 2026.

The models are the product and the billing unit. Every output is model-generated, from chronologies and narrative summaries through residual functional capacity assessments to research queries, and charging is by credit consumed per report, stated as roughly two credits a report, so a customer pays for inference and nothing else. The company goes further than most in describing the pipeline as fully automated, stating that no human reviewers see the records and that only its AI processes them. Remove the models and there is an upload form. Checked 4 September 2026.

Grounding is real, documented and built into the interface rather than asserted. Chronology entries carry an outline view that jumps directly to the underlying source document, and a side-by-side review places each generated summary and chronology entry alongside the original medical record specifically to support verification and editing. Export can optionally include the original records, so the chain from output back to source survives outside the platform. The vendor also publishes its own limitations, stating that the product requires human oversight for final verification and that AI-generated content needs review, which is an unusually direct acknowledgment for a marketing surface. What is missing is measurement. No accuracy figure is published, no test set is described and no evaluation is linked. The one published number, three seconds per page, is throughput rather than accuracy and should not be read as one.

Accuracy is asserted through outcome claims and no grounding mechanism is described on any surface read. The claims are specific in form but unsupported in substance: 3x more evidence found than manual review, 70 percent time savings on the home page against up to 90 percent in the FAQ on the same page, and 80 percent cost reduction, none with a test set, a method, a sample or a date. The two time-saving figures contradict each other and are named here because a reader who finds that unaided trusts the rest less. Nothing describes how an output traces back to the page it came from: no citation, no source link and no verification view appears on the home, pricing or legal surfaces. The agreement points both ways, with clause 2.4 committing to promptly correct material defects that materially impact the accuracy of reports while clause 6 disclaims any warranty of accuracy at all. Documentation pages on building and managing reports were not opened in this pass.

A written commitment that the product works alongside a supervising professional, with a real review surface behind it. The side-by-side view is the mechanism: generated summaries and chronology entries sit next to the original records, and every entry is individually editable before export so the user controls what leaves the system. The vendor states in its published limitations that human oversight is required for final verification and strategic decision-making, which locates the review point rather than merely recommending care. Duplicate detection operates unattended and is described as hiding exact duplicates only. What is absent is the rest of the control structure: no threshold is published at which the system defers or flags low confidence, nothing describes what happens when an error survives review, and there is no terms of service in which a supervision obligation would ordinarily sit.

Full automation is published as a selling point and no oversight mechanism is described alongside it. The process is stated in three steps, upload, AI analyses, receive a report, and the FAQ says expressly that it requires no human review of sensitive medical data. That is framed as a privacy advantage rather than an autonomy claim, but it is the same fact: nothing between the record set and the report but the model. Against that, the terms place the whole burden on the user, with clause 3.1 stating the user assumes all risks associated with use of content including any reliance on its accuracy, and clause 6 disclaiming accuracy outright. What is absent is any described review surface: no verification view, no confidence signal, no threshold at which the system defers, and no statement that a lawyer must check the output before use. Documentation pages covering report building, report management and research insight were not opened and are named so the limit is visible.

Real deployment evidence with named sources, short of measurement. Five testimonials carry both an individual and an organization: Wayne Winders of Williams and Swee, Dylan Barket of Barket Lawyers, Simone Sacks of Orthopedic Expert Services, George Gluck MD of the Hand Center of Nevada, and Jaclyn Meeks of AmarilloMD, which spans the legal and medical examiner segments the product sells to. One carries a figure attached to the named firm, with Winders reporting that case preparation time was cut by half and that demand letters improved because detail buried in hundreds of pages was no longer missed. The vendor separately claims use by hundreds of firms and organizations nationwide. What holds this at B is that the single figure is a self-reported proportion with no matter volume, no period and no method, nothing is dated, and no case study is published anywhere on the site.

Real deployment evidence with unusually complete attribution, short of dated measurement. Five testimonials each carry a photograph, a full name, a role, an organization and a practice area: Katie Reed of McMahan Law Firm on personal injury, Scott Haider of Schneider Law Firm on disability and personal injury, Diane C. Haar of Hawaii Disability Legal Services on disability, and Paul Bunn of Veterans Outreach Ministries and Dawud D.K. Shillingford of Shillingford Consulting Group on VA disability. One carries a hard figure tied to the named organization: Bunn states the product saved about 300,000 dollars a year and allowed him to replace three registered nurses and two nurse practitioners while maintaining review quality, which is a specific and checkable operational claim rather than a satisfaction quote. The company separately claims more than 500 attorneys and hundreds of firms. What holds this at B is that nothing is dated, no case study is published, and the corporate percentages are not attached to any named customer.

The commitment covering the material this product actually holds cannot be read in advance, which is what decides this. The privacy policy states in its second paragraph that it does not apply to protected health information processed on behalf of customers, and that such processing is governed by the business associate agreements InPractice has in place with its customers. Those agreements are not published anywhere. Since the entire input to the product is medical records, the published policy governs account and marketing data while the instrument governing the case material is unavailable to a buyer before contracting. What is published is real but partial: the security page states that customer information is never used to train AI models or shared with third parties, and describes 256-bit AES at rest, AES encryption in transit and multi-factor authentication by SMS or TOTP. Nothing addresses privilege or work product, nothing describes segregation between customers or matters, no retention or deletion position exists on any surface, and no model provider is identified, so what any underlying provider may retain is unstated.

Substantive published commitments, with the strongest element being one most vendors leave silent. The HIPAA Notice of Privacy Practices, effective 12 January 2026 and published rather than held behind a contract, states that Superinsight does not share personal information including protected health information with vendors performing services for it, naming artificial intelligence and large language model companies and cloud and database integration services, except as required by law or with explicit authorization. That is a direct answer to what a third-party model provider may see, and it is a rarer disclosure than a subprocessor list. It sits alongside a marketing commitment that no human reviewers access the records. The content license is narrow: clause 3.2 authorizes use of content solely for the purpose of providing information back to the user, with all other rights retained. What holds this at B is the rest of the picture. Nothing addresses privilege or work product, nothing describes segregation between customers or matters, and no retention period exists anywhere, with clause 3.1 stating instead that user content may be deleted at any time without prior notice.

No position on the advice line was located, and there is no document in which one would sit. The site publishes no terms of service, no customer agreement and no acceptable use policy: the navigation carries Product, Industries, Security, Pricing and Company, and the footer carries a privacy policy alone. Nothing anywhere states that output is not legal advice or not medical advice, and no attorney-client or clinician-patient boundary is addressed. That matters more than usual because the same product is sold to attorneys, to qualified and independent medical examiners who write expert reports, and to insurers adjusting claims, and its output is a medical chronology used to argue causation. What is published is adjacent but different: a limitations statement that human oversight is required for final verification and strategic decision-making, which speaks to output quality rather than to the advice boundary. Checked home page, security page, pricing page, privacy policy, navigation and footer on 4 September 2026.

No position on the advice line was located anywhere, and the audience makes that a live gap rather than a formal one. The terms of use, the privacy policy and the HIPAA notice were all read in full on 4 September 2026 and none states that output is not legal advice, not medical advice or not a substitute for professional judgment, and no rule of professional conduct, bar authority or accreditation regime is named. The product is sold to lawyers, to independent and qualified medical examiners producing expert evaluations, and to non-lawyer representatives: two of the five published testimonials come from organizations that are consulting and outreach practices rather than law firms, working veterans disability claims. Representation in VA and Social Security matters is governed by its own accreditation and fee rules, and a product generating residual functional capacity assessments and evidence arguments for those claims engages them directly. Nothing published addresses any of this.

No governance position is published for a system that decides which clinical facts reach a case file. There is no responsible AI statement, no governance framework, no named owner accountable for model behavior, no description of pre-release evaluation and no published testing results. Nothing addresses bias, which has a specific edge here: a chronology tool that summarizes treatment history determines which diagnoses, gaps and pre-existing conditions surface, and uneven performance across record types, providers or handwriting quality would change what a reader concludes about causation. The Vanta partnership named on the security page automates compliance monitoring for HIPAA and answers a security question rather than a governance one. Searched the home page, the security page, the pricing page, the privacy policy and the AI information page on 4 September 2026.

A governance standard is invoked without a framework behind it. The home page states the platform is ISO 42001-aligned, alongside HIPAA compliance, and links a Trust Cloud portal. Alignment is the operative word and it is doing a lot of work: ISO 42001 is an AI management system standard that can be certified against by an accredited body, and a claim of alignment is a self-assessment rather than an audited certification, which is why this does not reach the band that a genuine certification would. Nothing behind the claim is published: no management system scope, no named owner accountable for model behavior, no evaluation regime, no testing results, and nothing at all on bias, which matters on a product that decides which clinical findings support a disability or causation argument. The Trust Cloud portal at superinsight.trustshare.com was not opened in this pass and is named rather than credited.

A privacy policy covers the company without addressing what happens to the records after processing, and the gap is explicit rather than accidental: the policy states that it does not apply to customer protected health information at all. Access control is the strongest published element, with 256-bit AES at rest, AES encryption in transit and multi-factor authentication supporting both SMS and TOTP. Infrastructure suppliers are named as AWS, Google Cloud Platform and Microsoft Azure, and Google Analytics and Google Ads are named in the privacy policy. Three elements of the set are missing entirely. No retention period is published for uploaded records, summaries or chat content anywhere on any surface. No deletion commitment or route exists. And no incident or breach notification practice was located. One published statement cuts against the rest: the privacy policy provides that personal information may be transferred, processed and stored anywhere in the world.

Parts of the set are published and the parts that govern the records after processing are not. What exists is real: the HIPAA notice commits to breach notification in accordance with HIPAA requirements, gives rights to inspect, amend, restrict and obtain an accounting of disclosures, and states that no AI or LLM vendor receives protected health information. Access control is described as a one-time passcode sent to the user's phone plus encryption and firewalls. Three things are missing or dated. No retention period is published anywhere, and the terms instead reserve the right to delete user content at any time without prior notice while disclaiming any backup obligation. No deletion route or certification is offered. And the security language is stale, with the privacy policy describing secure socket layer technology and carrying a last-updated date of 21 August 2023, three years behind the HIPAA notice it sits alongside.

Nothing is published on who bears the loss when the system is wrong. There is no terms of service, no master subscription agreement, no customer agreement and no order form template anywhere on the site; the navigation has no legal section and the footer's only legal link is the privacy policy. No indemnity, no liability cap, no warranty of any kind, no service level and no insurance position was located on any surface. A buyer purchasing page credits self-serve with a credit card, as the pricing page invites, does so without any published allocation of loss to read. The business associate agreements referenced in the privacy policy govern data protection rather than liability for output, and are in any event unpublished. Searched the home page, the security page, the pricing page, the privacy policy, the AI information page, the navigation and the footer on 4 September 2026.

Liability is addressed only through a standard limitation clause that disclaims the exposure the product creates, and the cap is the striking number. Clause 7 limits liability for any damages arising from or related to the terms to a maximum of two hundred and fifty US dollars, stating expressly that more than one claim does not enlarge the limit. Clause 6 provides the app as-is with all warranties disclaimed including accuracy. Clause 4 runs the indemnity in one direction only, from user to company. Clause 5.3 goes further than most, with the user releasing and forever discharging the company from every claim relating to the app including personal injuries and death, and California residents waiving Civil Code section 1542. Two published items point the other way and are recorded: clause 2.4 commits the company to maintain the app in good working order and promptly correct material defects that materially impact the delivery or accuracy of reports, and the home page offers a no-risk money-back guarantee. Both are service commitments rather than allocations of loss. No insurance position was located.

No integration into practice systems was located. No case management system, document management system, medical record retrieval service, intake platform or e-signature product is named anywhere on the surfaces read, and there is no integrations page, API reference or developer documentation in the navigation or footer. What exists is export rather than integration, and it is well specified: chronologies and summaries export to Word, Excel or PDF with a choice of fields, filters and layouts and the original records optionally included. That moves a finished document out of the platform; it does not connect the platform to the systems a personal injury firm already runs, and records still arrive by upload. The vendor's own published boundary confirms the position, stating that the product is not an EHR or EMR system. Checked 4 September 2026.

An integration capability is published in the documentation index without any practice system named on a Superinsight surface. The documentation site carries an Integration page under Manage Case, which establishes that the product connects to something, and the app supports case sharing, groups and organization management. What is absent is the detail an implementer needs: no case management system, document management system, intake platform, medical record retrieval service or e-signature product is named anywhere on the home page, the pricing page or the legal documents, and there is no integrations page or API reference on the marketing site. Records arrive by upload in the published three-step workflow. The Integration documentation page was not opened in this pass and is named here so the limit is visible rather than presented as a settled absence; it is the cheapest available upgrade on this record. Checked 4 September 2026.

Neither the tenancy model nor the region is stated. Three cloud providers are named on the security page, AWS, Google Cloud Platform and Microsoft Azure, but naming a provider is not naming a location and no region, country or data center appears anywhere. Nothing describes whether the platform is single or multi-tenant, and no dedicated, private or isolated option is offered at any tier. The one residency statement located runs the other way: the privacy policy provides that all personal information processed may be transferred, processed and stored anywhere in the world, including but not limited to the United States or other countries with different privacy laws. For a platform whose stated market is the United States only and whose content is protected health information, an express worldwide processing permission with no residency commitment is the material fact and is recorded as such.

Neither the tenancy model nor the region is stated. No hosting provider, cloud platform, country, region or data center is named on any surface read, which is unusual: most records at least name an infrastructure supplier. Nothing describes whether the platform is single or multi-tenant, and no dedicated, private or isolated option appears at any of the six published pricing tiers. The HIPAA notice and the privacy policy are both silent on where protected health information is stored or processed, and the privacy policy contains no international transfer section at all. The one adjacent statement is the terms' export control clause referring to US export laws. Searched the home page, the pricing page, the terms of use, the privacy policy, the HIPAA notice and the site navigation on 4 September 2026.

No independent security attestation was located. HIPAA compliance is claimed, but HIPAA has no certification scheme, and what the security page actually describes is a partnership with Vanta, a compliance automation vendor whose product monitors controls; a Vanta HIPAA badge evidences a monitoring subscription rather than an audit, and Vanta is not a certifying body or an auditor. No SOC 2 of any type is claimed, which is a notable absence for a platform whose entire content is protected health information. No ISO certification, no auditor, no report date, no scope statement and no penetration testing appears anywhere, there is no trust center, and no report is offered at any access tier including on request. Applying the third-party verifiability test, a buyer has nothing to check against any register. Checked home page, security page, pricing page, privacy policy and footer on 4 September 2026.

Compliance is claimed on two fronts and neither is an independent attestation, though a trust portal exists. HIPAA compliance is claimed repeatedly, but HIPAA has no certification scheme, so the claim is self-attested by construction. ISO 42001 is claimed as alignment rather than certification, which is the vendor's own careful wording and should be read as a self-assessment. No SOC 2 of any type is claimed, no auditor or certifying body is named anywhere, and no report date, scope statement or penetration testing appears. What keeps this off the floor is a real access route: a Trust Cloud portal is publicly linked from both the home page and the FAQ at superinsight.trustshare.com. It was not opened in this pass, so its contents and whether it is self-serve or gated could not be established, and the lower tier is assumed for that reason and stated here. Two further badges are recorded as what they are rather than as security credentials: NVIDIA Inception membership is a startup program and the CIO Applications listing is a magazine award.

Nothing is published about the model supply chain a customer inherits. No model is named, no model provider is identified, no subprocessor list exists, no location is given for inference, and no commitment to notify customers of a change was located. AWS, Google Cloud Platform and Microsoft Azure are named on the security page, but as the cloud platforms the product runs on: naming where a model executes is not naming whose model it is, and infrastructure never answers this axis. The security page's statement that customer information is never shared with third parties sits in tension with the fact that some model must process the records, and nothing reconciles the two or identifies whether inference happens on a proprietary model or a third-party one. Searched the home page, the security page, the pricing page, the privacy policy and the AI information page on 4 September 2026.

The vendor states who does not see the data and never states what does. The HIPAA notice is unusually direct on the negative half, committing that protected health information is not shared with vendors performing services for Superinsight, naming artificial intelligence and large language model companies expressly, and the privacy policy repeats the same commitment for personal information. Read together with the claim that no human reviewers access records, the implication is that processing runs on models the company controls, but that is inference rather than disclosure: no model is named, no version is given, no provider is identified, no hosting location is stated, and no commitment to notify customers if any of it changes was located. A buyer can therefore establish that no named third party receives their records while being unable to establish what actually reads them.

Real pricing is published for part of the range and a buyer cannot determine from it what they will actually pay. The pricing page carries two schedules that do not reconcile. The volume table gives 1,000 pages at 0.10 dollars a page for 100 dollars, 5,000 at 0.09 for 450, 20,000 at 0.07 for 1,400, 100,000 at 0.06 for 6,000 and 200,000 at 0.05 for 10,000. The four purchase cards immediately below give Starter at 100 dollars for 1,000 pages at 0.10, Pro at 400 dollars for 5,000 at 0.08, Growth at 1,500 dollars for 25,000 at 0.06 and Scale at 5,000 dollars for 100,000 at 0.05. Three of the four overlapping tiers disagree on both total and per-page rate, the cards offer a 25,000-page tier the table does not contain, and the vendor's separate AI information page gives a third variant whose 200,000-page row reads 0.10 a page against a 10,000 dollar total, which does not compute. Only the 1,000-page entry tier at 100 dollars is stated consistently across all three. Everything else the band asks for is present: the unit of charge is published, what is included at every tier is itemized as unlimited users, medical chronologies, customizable AI summaries, one-click export, OCR and support, nothing is charged for implementation, and a 500-page seven-day trial requires no credit card. The axis asks whether a buyer can learn what this costs without entering a sales process. A page that returns three different answers does not let them, so publication alone does not carry the top band.

A buyer can price this completely, compare tiers and start without speaking to anyone. Six options are published with figures: one-time credits at 80 dollars with a one-credit minimum and no commitment, then Starter at 250 dollars a month for 4 credits, Pro at 500 for 12, Grow at 1,250 for 36, Scale at 2,500 for 80 and Enterprise at 5,000 for 200, with yearly billing stated to save 17 percent and to deliver thirteen months of credits upfront. The unit is defined rather than assumed, with a report stated to average about two credits, and a comparison table gives the effective cost per credit at each tier from 80 dollars down to 23. What changes between tiers is itemized across six rows covering templates, priority support, a dedicated account executive and unlimited research queries. Expiry rules are published and specific: monthly credits expire at the end of the cycle, yearly credits roll over, one-time credits expire 30 days after purchase. The first case is free, no credit card is required, and a three-question tool recommends a tier.

Coverage is documented with real precision at both ends, and the outer limits are stated more plainly than almost any record in this corpus. Three buyer segments each carry their own page: legal, medical examiners, and insurance. Practice areas are named specifically as personal injury, workers' compensation, medical malpractice and mass tort, and the medical examiner audience is identified as qualified and independent medical examiners scaling their practices. Unusually, the vendor publishes what it does not do, stating that it specializes exclusively in medical record review rather than general legal AI, that it is not an EHR or EMR system, and that it serves the United States market only. What is missing from the top band is the segment dimension: no firm size is addressed, in-house legal departments and government use are not mentioned at all, and nothing states a record volume ceiling or the document types the system cannot process.

Practice coverage is the most granular in this lane and the boundary is left open. Eight practice areas each carry a dedicated page with a described analytical approach rather than a label: Social Security Disability with residual functional capacity assessments, personal injury plaintiff with causation and damages, personal injury defense with pre-existing conditions and treatment inconsistencies, veteran disability with service connection, workers' compensation with causation and impairment, mass tort with qualifying injuries and exposure documentation and Camp Lejeune named specifically, medical malpractice with standard of care deviations, and medical examiner services for physicians and IMEs. Firm size is addressed indirectly but usefully through the pricing tiers, which are sized by monthly case volume from one or two up to fifty to a hundred or more. Fifty state-specific pages are published. What is missing is the limit: in-house and government use are not addressed, and rather than stating where the product stops, a Custom Solutions page offers to build for any practice area not listed.