C

Codes Health

The models drive the core capabilities and sit on a workflow system that would still function without them. Four AI functions are described in present tense on current pages. They are an agentic retrieval system, error checking that reviews an authorization for misspellings, missing dates of service and absent signatures before submission, missing record detection that flags gaps in the treatment history, and generated medical chronologies, encounter and bill summaries and extracted case insights.

Underneath that sits a request tracking platform with per request status, visibility into every fax and call, and a provider network. The vendor states its own framing plainly: retrieval runs on a mixture of AI and human intervention, insights are verified by humans, and the headline operational measure is a turnaround time. Remove the models and a firm would still receive a tracked, chased retrieval service.

Grounding is claimed and accuracy is asserted, and nothing is measured. The product is described as grounded in the firm's specific case context, with chronologies drawn from the client's own retrieved records, so the output has a real source. No retrieval method is described, no output is shown citing a record a user can open, and there is no accuracy figure, test set, evaluation or failure mode statement on any page.

Human review is offered in place of measurement: insights are stated to be verified by humans, and every batch is stated to be verified for completeness before it reaches the firm. The published figures are operational rather than accuracy claims: 80 percent less manual review, 2.5x faster retrieval, 50 percent more case capacity and 1.7x larger settlements, none attributed or dated. Accuracy and grounding are addressed without being evidenced, on a product whose extracted insights include breaches in care.

Real review points are published and the threshold at which the system runs alone is not. Three controls exist and each names when it happens: AI insights are verified by humans, every batch is verified for completeness before it reaches the firm, and the firm has real time request status with updates for every fax and call plus a full audit trail. The humans in the loop are the vendor's, not the buyer's. Nothing describes what a lawyer at the firm should check on receipt, what the review point is for a chronology or an extracted insight, or what happens when one is wrong.

Daily automated follow up workflows plainly run unattended, and a customer account states the case manager did not lift a finger. No published material reconciles those with the review claims by stating where the automated boundary sits. No abstention behavior and no confidence signal is described.

Named customers and published figures both exist and are never joined to each other. Three testimonials carry full attribution with role and firm: Charles Brown, Managing Partner at Daly & Black P.C.; Kelman Harrel, Partner at Louis Law Firm; and Skinner Louis, Managing Attorney at Louis Law Firm. Skinner Louis gives an operationally specific account of a matter needing records and bills from nine to ten providers, with each request tracked independently so an issue on one did not block the others.

Six further customer logos appear unattributed. Separately the site publishes 80 percent less manual review, 2.5x faster retrieval, 50 percent more case capacity and 1.7x larger case settlements. A state guide adds an average turnaround of 3 to 5 days attributed to the company's own operational data. None of those figures is tied to a named firm, none carries a date, and the named firm accounts carry no numbers. A fourth quotation is attributed to Sarah Miller, Shareholder at a national mass tort and litigation firm, with the firm unnamed. The turnaround figures also disagree: the home page states one to two weeks and the state guides state 3 to 5 days.

Substantive and specific commitments are published where a buyer can read them before signing, and none of them is contractual. The security section states that data is never used to train the vendor's models, that all AI processing is scoped to the firm's own cases, and that there is no data sharing between clients. It adds end to end PHI encryption with AES-256 at rest and TLS 1.2 or above in transit, role based permissions with a full audit trail, and Business Associate Agreements executed with all relevant vendors.

That answers training use and separation between customers. No privilege or work product treatment appears anywhere. Both legal instruments the company publishes scope themselves away from the product. The Terms of Use govern the marketing site, defined as a place for current and prospective customers to access information about the services. The Privacy Policy applies to Personal Data collected from Users of that site.

Neither reaches a claimant's medical records. No customer agreement or BAA is published, so every commitment above rests on a product page.

Nothing published addresses the advice line, on a product whose own headline describes it as a nurse, paralegal and assistant all in one. There is no statement that Codes Health is not a law firm, no disclaimer that it does not provide legal advice, no description of what the product is and is not, no jurisdiction limit, and nothing on how a firm should supervise the output. The Terms of Use disclaim warranties and describe permitted use of the website, and one clause restricts the site to personal and noncommercial use; none of it speaks to legal work.

The absence matters because of what the product produces: medical chronologies and extracted case insights covering diagnoses, breaches in care and future expenses, which feed a demand package.

No governance position of any kind is published. There is no responsible AI page, no principles statement, no management system, no named person or function accountable for model behavior, no prerelease testing regime, and nothing on uneven output across matter types, injury types or populations. The navigation and footer were inventoried across the full site on 4 September 2026. The only policy documents published are the Terms of Use, the Privacy Policy and a Responsible Disclosure Policy, and none of them addresses how the models are governed.

The nearest statement is the AI data policy block, which commits that data is not used to train the models and that processing is scoped to the customer's own cases. That is a confidentiality commitment rather than a governance position. The gap matters on a product that extracts clinical findings from the records of injured claimants and flags which of them matter to a case.

Access control is published in real detail, and retention and deletion are absent entirely. Published: AES-256 at rest, TLS 1.2 or above in transit, PHI encrypted end to end, single sign on, role based permissions, a full audit trail on every action, regular third party penetration testing, 24/7 monitoring and alerting, an incident response plan, and multi region redundancy with a 99.9 percent uptime SLA. The Responsible Disclosure Policy adds a published process with committed timelines.

It acknowledges a vulnerability report within seven business days and triages within ten, gives a safe harbor authorization with named exclusions, and reaches subdomains, services and applications rather than only the website. No retention period is stated for retrieved records, chronologies or prompts, and no deletion or return of data commitment exists for case material. No subprocessor is named, only an assertion that BAAs are executed with all relevant vendors, and no cloud provider is identified.

The Privacy Policy states in its first line that it applies solely to information collected by the website, so nothing published governs client data in normal operation.

Nothing published addresses who bears the loss when the product is wrong. The Terms of Use contain a full allocation of loss: the service is provided as is with all warranties disclaimed, consequential damages are excluded, liability is capped at 100 dollars, indemnity runs one way from the user to the vendor, claims must be brought within two years, and Delaware law governs. Every one of those provisions is scoped to use of the website.

The instrument defines the Site as the place customers access information about the services. None of it reaches a missed record, an inaccurate chronology or a wrongly extracted case insight, so it is not a product liability position. No customer agreement, service level commitment on accuracy, indemnity, warranty on output or insurance position is published on any page.

One named integration is described at workflow level, with no depth behind it. Codes Health publishes an exclusive partnership with Filevine and a dedicated page for it. The page states that record retrieval is integrated directly into the case system, so a firm can request, receive and review records inside Filevine through a custom Filevine partner workflow. That is a named connection with a stated function rather than a logo.

Two further connection classes are named without being specified: direct connections to major claims clearinghouses and payors, and custodian integrations alongside electronic claims networks, none of which identifies a counterparty. A state guide adds that high volume firms can integrate directly with CRM platforms and case management software, without naming one. Nothing states what syncs, in which direction, on what trigger, or what a firm must configure, and there is no integrations page, developer documentation or API.

The FAQ asks whether the product works with a firm's existing case management system, but the answers on that page did not render, so the question is published and its answer was not.

Cloud delivery is implied, and neither tenancy nor region is stated for the product. The security section says the platform is hosted with enterprise grade infrastructure and has multi region redundancy with a 99.9 percent uptime SLA. That is a resilience statement rather than a residency one: copies exist across regions, but no region is named and no choice is offered. No cloud provider is identified. Nothing states whether the platform is single or multi tenant, and no dedicated or isolated option is described.

The one residency sentence is in the Privacy Policy, which states that data collected through the site is stored on secure servers in the United States and that third parties may not transfer it outside the United States. That policy applies by its own terms to website Personal Data rather than to claimant records, so it does not settle where claimant data sits. Where the AI processing happens is a separate silence, since no model provider is named.

The product is a customer application at a published subdomain with its own login, so delivery is not in doubt; the tenancy and the region are.

A compliance claim is displayed as a credential, with no scope, no date and no report. HIPAA compliance appears in the home page hero as one of three headline stats, reading fully compliant, and is repeated in the security section. HIPAA is a statutory obligation that a covered entity or business associate self attests to, not an independent attestation, and no assessor, assessment date or scope accompanies it. Regular third party penetration testing is claimed with no testing firm, date, scope or summary.

No SOC 2 of either type, no ISO certification, no HITRUST and no named auditor appears anywhere, and there is no trust center or portal. The only route offered is the line that full compliance documentation is available on request, with no self service mechanism or form, only a general contact address. The site rendered in full, so this is an absence rather than a retrieval limit.

The vendor refers to its models repeatedly and identifies nothing underneath them. The site speaks of an agentic retrieval system, medical grade AI, and the first legal grade AI for medical records. The AI data policy refers to our models, which asserts models the company controls without saying whose they are or what they are. No model, version, provider, hosting arrangement or processing location is named on any page, and no commitment to notify customers if any of that changes is published.

The nearest thing to supply chain disclosure is the statement that Business Associate Agreements are executed with all relevant vendors. That concedes that third parties touch protected health information while naming none of them. The vendor does describe an architecture and does claim models of its own, but a buyer cannot learn from any published source whose model reads a claimant's medical file.

The charging model is published clearly and repeatedly, and no figure appears anywhere. There is no pricing page in the navigation. Across the state guides the vendor states flat fee pricing charged per request rather than metered by volume. The guides list no per page markups, no charge for follow ups or status checks, no charge for requests resent because of provider issues, and AI generated chronologies included in the service rather than priced separately.

They close with an instruction to contact the company for current pricing. That is a unit of charge and a clear inclusion boundary, so something real is published about how a buyer would be charged. What is absent is the number: no rate, no range, no minimum, no term, no volume tier and no implementation cost. One state guide calls the pricing transparent while the same section directs buyers to a sales conversation to learn it. A buyer can describe the shape of the invoice before contacting the company and cannot estimate it.

The buyer is stated without ambiguity and the boundary is left open. Every page names plaintiff law firms, with personal injury and mass tort practice named throughout and the workflow described in that idiom: prelitigation, demand packages, settlement negotiation, case intake and acceptance decisions. Jurisdictional coverage is documented in depth. Retrieval is claimed in all fifty states, and individual state and city guides set out facility level submission requirements, statutory response windows and fee schedules for named hospital systems.

Firm size is addressed only loosely, through references to high volume firms qualifying for custom integrations. What is not stated is where the product stops: defense firms, insurers, in house departments and government are never addressed, and no practice area or matter type is excluded. A separate page addresses healthcare providers about their own intake process, a second audience the coverage material does not reconcile with the plaintiff firm framing.