HealthKey
HealthKey is an AI patient-identification service for clinical trial sites. It connects to the clinic's EHR, encodes a protocol's inclusion and exclusion criteria, then returns a prioritized candidate list with supporting evidence for coordinators to review.
What is HealthKey?
HealthKey is an AI-powered patient identification service built for the research teams that run clinical trials at investigative sites. Its stated purpose is to replace manual chart review: rather than have coordinators read charts one by one to find who might qualify for a protocol, the platform reads the whole patient base and hands back a shortlist.
The workflow has three steps. Connect: HealthKey links to the clinic's electronic health record, which it says it does in a HIPAA compliant way. Fourteen systems are named on the home page, among them Epic, athenahealth, Veradigm, NextGen, eClinicalWorks, Practice Fusion and Greenway. Prescreen: the trial's inclusion and exclusion criteria are encoded into machine-applicable logic during a guided onboarding, then applied across the record set, structured fields as well as unstructured material such as consultation notes, imaging reports, pathology and lab PDFs. Review: matches come back ranked by likelihood of enrolling, each attached to the evidence in the record that produced it, so the coordinators still make the eligibility call and flagged near-misses go to a separate queue.
The published case studies indicate the scale involved. One urology institute connected its athenahealth system in two weeks; 5.2 million records covering 5,360 patients were evaluated against 24 criteria, producing 21,115 criteria evaluations, six eligible patients and one randomization on a protocol that had enrolled nobody in two years. A four-clinic network on two different EHRs ran 32 criteria across 11,041 patients and 4.19 million records, reaching 175 patients screened and 74 passed in a first month. Claimed time savings across the studies range from roughly 626 to 3,312 hours.
Access is through a web dashboard plus a daily email of eligible patients; there is no API, no mobile application and no self-serve signup. Security rests on the HIPAA and FHIR badges and a link to an external Oneleet trust center, with no SOC 2 report or data processing document published. The company is a young American startup from Y Combinator's W25 batch, listed by YC as ten people in Austin, Texas, with Josh Sabol as Founder and CEO.
What it does
- Connect the clinic's electronic health record, with fourteen systems named as supported
- Encode a protocol's inclusion and exclusion criteria into machine-applicable logic
- Scan the entire patient base, structured fields and unstructured documents alike
- Rank candidates by how likely they are to enroll
- Open every match together with the record evidence that produced it
- Receive a daily email listing newly eligible patients
- Route borderline cases to a separate queue for human judgement
When to use HealthKey / When not to
A quick filter to help you decide if HealthKey is the right fit.
When to use HealthKey
- Investigative sites struggling to enroll on protocols with long criteria lists, from 24 to 42 criteria in the published studies
- High-volume clinics where manual chart review across thousands of records is no longer realistic
- Multi-site networks running different EHR systems that need several clinics prescreened in parallel
- Study teams on trials running behind their enrollment target or approaching an enrollment cutoff
- Oncology, urology, rheumatology, endocrinology, cardiovascular and neurology sites where eligibility hinges on unstructured notes, imaging and pathology reports
When not to use HealthKey
- Patients looking for a trial to join: the product is sold to research sites, not to individuals or sponsors directly
- Clinics with no connectable EHR, or running a system outside the fourteen named integrations
- European or GDPR-bound organizations that need published data terms, an EU hosting commitment or an Article 27 representative, none of which the site provides
- Teams that need an API, a mobile app or a self-serve signup with published pricing before speaking to sales
- Sites expecting the AI to decide eligibility on its own rather than return a shortlist that coordinators still have to qualify
How to use HealthKey
A typical end-to-end flow, from setup to results.
- Book a 15-minute demo slot or submit the contact form on the home page, as there is no self-serve signup
- Arrange authorized access to the clinic's EHR: connection took two weeks on athenahealth in one case study and minutes per clinic in another
- Hand over the trial protocol with its inclusion and exclusion criteria
- Let the guided onboarding encode those criteria into logic that applies to structured and unstructured data
- Launch the scan across the patient base, with first results announced within days
- Open the prioritized candidate list in the web dashboard hosted on the hk subdomain
- Follow the daily email listing newly eligible patients
- Check every match against its linked evidence, such as PSA values, imaging reports, medication history, lab results and weight or BMI measurements
- Handle the borderline cases flagged separately for human judgement
- Move qualified candidates into the site's usual screening and consent pipeline
Pros & Cons
Pros
- Ten case studies published with named sites, named sponsors, NCT numbers, criteria counts and volumes, which is unusually specific for a company this young
- Reads unstructured records, where the case studies report that the EHR's own reporting tools lacked the precision needed
- Documented time savings ranging from about 626 hours on one study to roughly 3,312 hours on another
- Results reported on protocols considered lost, including a site that had enrolled nobody in two years and a trial more than a year behind schedule
- One case study reports a qualifying patient that a competing platform had missed entirely
- No upfront cost at entry, with billing presented as success fees per patient
- Fast to start, one week announced and minutes per clinic on some EHRs, with multiple sites handled at once
Cons
- No privacy policy, no terms of service and no legal notice are published, on a product that processes medical records
- No email address, no postal address and no full legal entity name: contact runs only through a form or a booking link
- No published price, and the success-fee-per-patient basis is never quantified, so any figure requires a sales conversation
- Nothing published on data retention, hosting, subprocessors, model training or an opt-out option
- The GDPR is never mentioned and the operating scope is American in practice, with no EU commitment of any kind
- All ten case studies are self-published with no independent verification, and randomization counts stay in the single digits per study despite enormous prescreening volumes
- No API, no mobile app and no free trial, and the whole value depends on connecting to one of the fourteen listed EHRs
Pricing & Plans
No free plan and no free trial are advertised, and no price is published, so no entry price point can be quoted. The company states that it charges success fees per patient with $0 upfront costs, describing a basis that scales with the number of sites, studies and subjects. The only monetary figures shown on the site, $15,000, $5,000 and $2,500, are stated values of free bonus items rather than prices. A quote is obtained solely through the contact form or a 15-minute booking.
- $0 upfront costs
- then success fees charged per patient
- with no named tiers and no published rate card
- free implementation
- stated at a $15
- 000 value
- free protocol setup for five trials
- stated at a $5
- 000 value
- free premium support
- stated at a $2
- 500 value
- valid through 31 July 2026 and limited to 20 new sites per quarter
- therefore lapsed at the review date
Data, GDPR & hosting
A consolidated view of how HealthKey handles your data.
GDPR overview
The site makes no mention of the GDPR. The term appears nowhere in the pages reviewed, and there is no privacy policy or terms document in which to look, since the domain's sitemap declares only the home page. No data protection officer, no Article 27 EU representative and no privacy contact address are named. The framework the company does claim is American: a HIPAA badge and a FHIR badge on the home page, plus a link to an external Oneleet trust center scoped to HIPAA. All ten published case studies involve US clinics and networks, although several named sponsors are international, among them Novartis, Merck, Eli Lilly, UCB, Johnson & Johnson, Alnylam and Biohaven. This is an absence of published signal, not evidence of non-compliance: a European deployment would require the terms to be established directly with the company.
Who owns the data?
No terms of service, privacy policy or legal notice is published: the domain's sitemap declares a single URL, the home page. Nothing on the site therefore states who owns the data, who may access it, or what HealthKey is permitted to do with it. The only statement on record is that the company connects to the customer's EHR to analyze patient data in a HIPAA compliant way. In practice the material processed is the medical record held by the client clinic, which remains the covered entity, with HealthKey positioned as its vendor. Ownership, permitted uses, sublicensing and any sharing with third parties are matters to settle in a signed contract, because no public document addresses them.
Reuse rights
The site describes a single use: the platform encodes a trial's eligibility criteria and scans the connected EHR for candidates, returning matches with evidence from patients' records so the research team can qualify them. Published case studies put that at 21,115 criteria evaluations for one protocol and 63,515 for another, across structured fields and unstructured documents, including 652,000 clinical PDFs ingested for a single study. Because the underlying records belong to the clinic, what the customer may do with the output is governed by its own obligations rather than by any HealthKey document. Nothing is published on model training, de-identification, secondary reuse or disclosure to third parties, and targeted searches for opt-out, do-not-train, de-identification and PHI language returned no match.
Data retention & training
Hosting summary
No hosting country or region is published. The site names no data center, no cloud provider and no subprocessor, and there is no privacy policy or readable trust documentation in which to look: the external Oneleet trust center linked from the home page is a JavaScript application whose controls do not render without a browser. Two technical observations are available, and neither is a statement by the company. The public site resolves behind Cloudflare at 172.67.172.24 on AS13335, an anycast node that serves the marketing page and says nothing about where patient data lives. The customer application on the hk subdomain answers unauthenticated requests through an AWS load balancer, which points to AWS infrastructure but is an inference from a server header, not a disclosure. For a service that ingests medical records, jurisdiction, region and infrastructure all have to be established directly with the company before any deployment.
Things to keep in mind
Risks and trade-offs to weigh before adopting HealthKey.
- The promotional offer on the home page is dated valid through 31 July 2026 and has not been updated, so it had already expired at the review date
- No privacy policy or terms exist for a tool that processes medical records, so those commitments have to be obtained contractually before any deployment
- No business associate agreement and no data processing agreement are published: HIPAA compliance is claimed but not publicly documented
- Public traceability is thin, with no email, no postal address and no full legal entity name, leaving only the domain and a Y Combinator profile
- The Oneleet trust center is promoted but its controls do not render without JavaScript, so the claim cannot be checked from outside
- Every cited result is self-published by the vendor, and randomization figures stay in the single digits per study even when prescreening volumes are enormous
- Over-reliance is a real risk: coordinators who stop reading charts inherit whatever the model misses, and a success fee per patient can cover very different bases until it is priced in writing
Setup & Integrations
Technical difficulty
Low on the customer's side. The site announces getting started in one week, and the case studies broadly match that: two weeks to connect an athenahealth system in one instance, minutes per clinic on Practice Fusion and eClinicalWorks in another, with first results within days. The client's main input is the protocol, since HealthKey encodes the criteria itself during a white-glove onboarding, and coordinators then work from a dashboard and a daily email that require no technical skill. The demanding part is administrative rather than technical: obtaining authorized access to the institution's EHR.
Deployment
Integrations
Behind HealthKey
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement HealthKey.
Frequently asked questions
Who is HealthKey for?
Which EHR systems does it connect to?
How long does it take to get started?
What does it cost?
Does the AI decide who is eligible?
What security credentials are shown?
Is there a privacy policy or terms of service?
Is there an API or a mobile app?
What results are documented?
How do you contact the company?
Should you pick HealthKey?
HealthKey does one thing at a scale humans cannot match: reading an entire patient base against a protocol's criteria, including the parts of the record that sit in free text. The evidence offered for that is unusually concrete for a company barely out of Y Combinator, with ten case studies naming sites, sponsors, NCT numbers, criteria counts and hours saved, and the most striking results come from protocols that had already been written off.
The counterweight is documentary opacity. There is no privacy policy, no terms of service, no legal notice, no email address, no postal address and no published price. For a product that ingests millions of medical records, that is a substantial gap: HIPAA compliance is claimed and pointed at an external trust center, but the controls behind it cannot be read, and nothing is said about retention, hosting, subprocessors or model training. Every published result is the vendor's own and none has been independently verified. The promotional offer still displayed on the home page had already expired when this review was written.
It is worth a look for investigative sites and site networks running one of the fourteen supported EHRs, particularly on protocols with long criteria lists where enrollment has stalled. The success-fee model removes much of the financial risk of trying, which matters to a small research site. What it does not remove is the need for your own diligence: ask for a signed business associate agreement, written retention and hosting terms, a documented pricing basis, and references you contact yourself. Those documents either exist or they do not, and the website will not tell you which.
- Choosing a selection results in a full page refresh.
- Opens in a new window.