I

InPractice

The models are the mechanism and the unit of charge at once. Every function is model output: chronology construction, narrative summarization, OCR search, duplicate detection and the Case Chat feature that answers questions against the record set. The product is billed per page processed, so a customer is paying for inference directly and nothing else, with no seat fee and no subscription. The vendor states its own scope in the same terms, describing itself as specializing exclusively in medical record review rather than offering a broad legal AI platform. Remove the models and there is a file store with a search box.

Grounding is real, documented and built into the interface. Chronology entries carry an outline view that jumps directly to the underlying source document. A side by side review places each generated summary and chronology entry next to the original medical record to support verification and editing. Export can optionally include the original records, so the chain from output back to source survives outside the platform.

The vendor also publishes its own limitations, stating that the product requires human oversight for final verification and that AI generated content needs review. What is missing is measurement. No accuracy figure is published, no test set is described and no evaluation is linked. The one published number, three seconds per page, measures throughput, not accuracy.

A written commitment that the product works alongside a supervising professional, with a real review surface behind it. The side by side view is the mechanism: generated summaries and chronology entries sit next to the original records, and every entry is individually editable before export so the user controls what leaves the system. The vendor states in its published limitations that human oversight is required for final verification and strategic decision making, which locates the review point rather than merely recommending care.

Duplicate detection operates unattended and is described as hiding exact duplicates only. What is absent is the rest of the control structure: no threshold is published at which the system defers or flags low confidence, nothing describes what happens when an error survives review, and there is no terms of service in which a supervision obligation would ordinarily sit.

There is real deployment evidence with named sources, short of measurement. Five testimonials carry both a person and an organization: Wayne Winders of Williams and Swee, Dylan Barket of Barket Lawyers, Simone Sacks of Orthopedic Expert Services, George Gluck MD of the Hand Center of Nevada, and Jaclyn Meeks of AmarilloMD. They span the legal and medical examiner segments the product sells to. One carries a figure: Winders reports that case preparation time was cut by half and that demand letters improved because detail buried in hundreds of pages was no longer missed.

The vendor separately claims use by hundreds of firms and organizations nationwide. The single figure is self reported, with no matter volume, period or method, nothing is dated, and no case study is published on the site.

The commitment covering the material this product actually holds cannot be read in advance. The privacy policy states in its second paragraph that it does not apply to protected health information processed on behalf of customers, and that such processing is governed by the business associate agreements InPractice has in place with its customers. Those agreements are not published. The whole input to the product is medical records, so the published policy covers account and marketing data while the terms for the case material are not available before contracting.

What is published is real but partial. The security page states that customer information is never used to train AI models or shared with third parties, and describes 256-bit AES at rest, AES encryption in transit and multi factor authentication by SMS or TOTP. Nothing addresses privilege or work product, nothing describes separation between customers or matters, and no retention or deletion position exists on any surface. No model provider is identified, so what any underlying provider may retain is unstated.

No position on the advice line is published, and there is no document in which one would sit. The site publishes no terms of service, no customer agreement and no acceptable use policy: the navigation carries Product, Industries, Security, Pricing and Company, and the footer carries a privacy policy alone. Nothing anywhere states that output is not legal advice or not medical advice, and no attorney client or clinician patient boundary is addressed.

That matters because the same product is sold to attorneys, to qualified and independent medical examiners who write expert reports, and to insurers adjusting claims, and its output is a medical chronology used to argue causation. What is published is adjacent but different: a limitations statement that human oversight is required for final verification and strategic decision making, which speaks to output quality rather than to the advice boundary.

No governance position is published for a system that decides which clinical facts reach a case file. There is no responsible AI statement, no governance framework, no named owner accountable for model behavior, no description of evaluation before release and no published testing results. Nothing addresses bias, which has a specific edge here: a chronology tool that summarizes treatment history determines which diagnoses, gaps and preexisting conditions surface, and uneven performance across record types, providers or handwriting quality would change what a reader concludes about causation.

The Vanta partnership named on the security page automates compliance monitoring for HIPAA and answers a security question rather than a governance one.

A privacy policy covers the company without addressing what happens to the records after processing, and the gap is explicit rather than accidental: the policy states that it does not apply to customer protected health information at all. Access control is the strongest published element, with 256-bit AES at rest, AES encryption in transit and multi factor authentication supporting both SMS and TOTP. Infrastructure suppliers are named as AWS, Google Cloud Platform and Microsoft Azure, and Google Analytics and Google Ads are named in the privacy policy.

Three things are missing entirely. No retention period is published for uploaded records, summaries or chat content anywhere on any surface. No deletion commitment or route exists. And no incident or breach notification practice is published. One published statement cuts against the rest: the privacy policy provides that personal information may be transferred, processed and stored anywhere in the world.

Nothing is published on who bears the loss when the system is wrong. There is no terms of service, no master subscription agreement, no customer agreement and no order form template anywhere on the site; the navigation has no legal section and the footer's only legal link is the privacy policy. No indemnity, no liability cap, no warranty of any kind, no service level and no insurance position is published on any surface.

A buyer purchasing page credits self-serve with a credit card, as the pricing page invites, does so without any published allocation of loss to read. The business associate agreements referenced in the privacy policy govern data protection rather than liability for output, and are in any event unpublished.

No integration into practice systems is published. No case management system, document management system, medical record retrieval service, intake platform or electronic signature product is named anywhere on the surfaces read, and there is no integrations page, API reference or developer documentation in the navigation or footer. What exists is export rather than integration, and it is well specified: chronologies and summaries export to Word, Excel or PDF with a choice of fields, filters and layouts and the original records optionally included.

That moves a finished document out of the platform; it does not connect the platform to the systems a personal injury firm already runs, and records still arrive by upload. The vendor's own published boundary confirms the position, stating that the product is not an EHR or EMR system.

Neither the tenancy model nor the region is stated. Three cloud providers are named on the security page, AWS, Google Cloud Platform and Microsoft Azure, but naming a provider is not naming a location and no region, country or data center appears anywhere. Nothing describes whether the platform is single or multi tenant, and no dedicated, private or isolated option is offered at any tier. The one residency statement located runs the other way: the privacy policy provides that all personal information processed may be transferred, processed and stored anywhere in the world, including but not limited to the United States or other countries with different privacy laws.

For a platform whose stated market is the United States only and whose content is protected health information, an express worldwide processing permission with no residency commitment is the material fact.

No independent security attestation is published. HIPAA compliance is claimed, but HIPAA has no certification scheme, and what the security page actually describes is a partnership with Vanta, a compliance automation vendor whose product monitors controls; a Vanta HIPAA badge evidences a monitoring subscription rather than an audit, and Vanta is not a certifying body or an auditor. No SOC 2 of any type is claimed, which is a notable absence for a platform whose entire content is protected health information.

No ISO certification, no auditor, no report date, no scope statement and no penetration testing appears anywhere, there is no trust center, and no report is offered at any access tier including on request. Applying the third-party verifiability test, a buyer has nothing to check against any register.

Nothing is published about the model supply chain a customer inherits. No model is named, no model provider is identified, no subprocessor list exists, no location is given for inference, and no commitment to notify customers of a change is published. AWS, Google Cloud Platform and Microsoft Azure are named on the security page as the cloud platforms the product runs on. Naming where a model runs is not naming whose model it is.

The security page says customer information is never shared with third parties, while some model must process the records. Nothing reconciles the two or says whether inference runs on a proprietary model or a third party one.

Pricing is published, but the schedules disagree, and a buyer cannot tell from them what they will actually pay. The volume table gives 1,000 pages at 0.10 dollars a page for 100 dollars, 5,000 at 0.09 for 450, 20,000 at 0.07 for 1,400, 100,000 at 0.06 for 6,000 and 200,000 at 0.05 for 10,000. The four purchase cards below it give Starter at 100 dollars for 1,000 pages at 0.10, Pro at 400 dollars for 5,000 at 0.08, Growth at 1,500 dollars for 25,000 at 0.06 and Scale at 5,000 dollars for 100,000 at 0.05.

Three of the four overlapping tiers disagree on both total and rate, and the cards offer a 25,000 page tier the table does not contain. The separate AI information page gives a third version whose 200,000 page row reads 0.10 a page against a 10,000 dollar total, which does not compute. Only the 1,000 page entry tier at 100 dollars is stated the same way everywhere. Every tier includes unlimited users, chronologies, AI summaries, export, OCR and support, with no implementation charge, and the 500 page trial over seven days needs no credit card.

Coverage is documented precisely at both ends, and the outer limits are stated plainly. Three buyer segments each have their own page: legal, medical examiners and insurance. Practice areas are named as personal injury, workers' compensation, medical malpractice and mass tort, and the medical examiner audience is identified as qualified and independent medical examiners scaling their practices. The vendor publishes what it does not do: it specializes exclusively in medical record review rather than general legal AI, it is not an EHR or EMR system, and it serves the United States market only.

What is missing is firm size, which is not addressed. In house legal departments and government use are not mentioned, and nothing states a record volume limit or the document types the system cannot process.