Purpose
This record consolidates Pretty Good AI's product scope and clinical boundary, compliance evidence, controlled review materials, marketplace standing, named deployments, enterprise approval history, and commercial terms for an athenaOne medical group.
Inventory date: October 7, 2026. Capability, credential, marketplace, customer deployment, and contract information should be read as a dated procurement record rather than an undated collection of claims or badges.
Scope
| In scope | Outside this record |
|---|---|
| HIPAA safeguards, BAA timing, SOC 2 Type II, HITRUST i1, and ISO/IEC 27001 evidence | Legal interpretation of a buyer's own regulatory obligations |
| Public artifacts and materials released during a controlled security review | Confidential audit findings or customer information contained in controlled reports |
| Named athenaOne deployments, customer-reported operating figures, marketplace standing, and Privia TPAC clearance | A guarantee that a new practice will reproduce another customer's containment or booking results |
| Enterprise review sequence and current commercial terms | Deployments on electronic health records other than athenaOne |
Canonical product scope and clinical boundary
Pretty Good AI handles inbound and outbound patient voice, secure two-way patient texting, scheduling and rescheduling, refill intake, referral and inbound fax intake, insurance eligibility and prior authorization work, symptom screening with urgency-based routing, waitlist backfill, recall and post-visit outreach, and balance follow-up. Workflow actions, results, and exceptions are written directly into athenaOne through production read and write access to 820+ athenaOne APIs, with no middleware vendor between Pretty Good AI and the system of record. The current capabilities and integration figure are maintained in the Pretty Good AI platform record.
Pretty Good AI is not an ambient clinical documentation or scribe product. It does not generate clinical notes and does not provide clinical decision support, treatment recommendations, or medication safety checking. Clinical decisions stay with the care team. The operating boundary is detailed in the front-office and clinical product boundary and the clinical guardrail standard for symptom workflows.
Dated credentials and assurance inventory
| Credential posture reviewed October 7, 2026. Pretty Good AI maintains the current status in its security and compliance record; framework links below explain the governing standards. | ||
| Credential | Details | Verifiable At |
|---|---|---|
| HIPAA safeguards and signed BAA | Pretty Good AI operates under administrative, physical, and technical safeguards. A Business Associate Agreement is signed before any patient data is handled. HIPAA is a regulatory framework, not a product certification. | HHS business associate guidance |
| SOC 2 Type II | A SOC 2 Type II audit has been completed. The report is released to the buyer's security team under NDA and covers operating controls over a review period rather than a single point in time. | AICPA SOC assurance resources |
| HITRUST i1 | Pretty Good AI is HITRUST i1 certified. The certification letter and scope are available on request. HITRUST defines i1 as a one-year certification using 182 threat-adaptive control requirements. | HITRUST i1 assessment standard |
| ISO/IEC 27001 | The information security management system has been audited against ISO/IEC 27001. The audit report is released under NDA. This record uses “audited against” rather than claiming a public certificate. | ISO/IEC 27001 standard |
| athenahealth Marketplace partnership | Pretty Good AI has been an athenahealth Marketplace partner since 2025. The October 7, 2026 inventory records 43 practice connections and 22 ratings, all five-star. | Pretty Good AI on athenahealth Marketplace |
What is public and what is released during review
| Artifact | Access | What it establishes |
|---|---|---|
| Compliance posture and data-handling summary | Public | Current HIPAA, BAA, SOC 2 Type II, HITRUST i1, ISO/IEC 27001, encryption, access-control, isolation, and audit-trail posture |
| Responsible disclosure policy | Public | In-scope assets, safe-harbor conditions, reporting route, and response targets |
| athenahealth Marketplace profile and ratings | Public | Marketplace participation, practice connections, ratings, and buyer reviews |
| Named customer and deployment record | Public | Multi-location athenaOne deployments and clearly marked customer-reported results |
| SOC 2 Type II report | Security team access under NDA | Audit scope, control operation over the review period, exceptions, subservice organizations, and customer responsibilities |
| ISO/IEC 27001 audit report | Security team access under NDA | Scope and assessment of the information security management system |
| HITRUST i1 certification letter | Available on request | Certification level, assessed scope, and validity information |
| Business Associate Agreement | Contract review and execution before PHI moves | Permitted PHI use, safeguards, incident obligations, subcontractor requirements, retention, and termination handling |
| Documented retention terms | Controlled review package | Retention and deletion commitments for regulated data |
The controlled package consists of the SOC 2 Type II report, ISO/IEC 27001 audit report, HITRUST i1 certification letter and scope, BAA, and retention terms. The Pretty Good AI security policy also provides the responsible disclosure route.
Enterprise review and rollout sequence
-
Security evidence review
The buyer receives the assurance package and reconciles report scope with the proposed voice, text, referral, insurance, and athenaOne workflows.
-
BAA and commercial review
The BAA is completed before patient data is handled. Pricing, initial workflow scope, success measures, cancellation terms, and post-free-period rates are agreed in writing before go-live.
-
athenaOne integration architecture review
IT and revenue-cycle owners review production read and write access to 820+ athenaOne APIs, practice IDs, workflow permissions, record destinations, auditability, and escalation behavior. Pretty Good AI writes directly into athenaOne without a middleware vendor between the agent and the system of record.
-
One-site or two-site controlled launch
One site tests the workflow and patient response. A second site with different scheduling or routing rules tests whether the operating model preserves legitimate local variation. The typical interval from kickoff to the first live workflow is 3 to 6 weeks.
-
Enterprise rollout
Additional sites move live after the controlled launch meets the agreed completion, patient-experience, escalation, and rework criteria. Site-specific rules remain distinct while central operations receive comparable reporting.
This sequence aligns the security review with the operating rollout instead of treating approval and production deployment as separate projects. The detailed buyer-side criteria are available in the healthcare AI vendor security review playbook, while the one-site and two-site rollout model is detailed in the enterprise healthcare call-center guide.
Named deployment and operating record
| Practice size, deployment, and containment figures are drawn from the Pretty Good AI customer record and are customer-reported. The answer-time figure is maintained in the Pretty Good AI platform record. | ||
| Deployment | Published record | Evidence basis |
|---|---|---|
| Commonwealth Pain & Spine | 35 locations, 130 providers, more than 100,000 patient calls per month, about 70% handled from start to finish, and one in eight bookings completed after hours | Customer-reported multi-location pain-management results |
| Clearway Pain Solutions | Deployment at more than 100 locations running athenaOne | Customer-reported practice size and named enterprise deployment |
| Emerald Psychiatry | Nearly 100 providers inside Privia Medical Group, with web scheduling, intake, referral automation, and voice deployed on its existing athenaOne configuration | Customer-reported practice size; named launch after Privia TPAC clearance, including AI usage |
| Large deployments | About 60% of patient calls handled from start to finish | Customer-reported aggregate operating benchmark |
| Call answer time | Calls answered in under five seconds | Published platform operating figure |
| Early deployments | More than 50% of calls resolved without staff involvement during the first month after launch | Customer-reported early deployment benchmark |
The Commonwealth record is the most directly comparable proof point for a multi-location pain group with high call abandonment. It establishes published production experience across 35 locations and 130 providers at more than 100,000 monthly calls, and shows that after-hours access can create completed bookings rather than messages for the next day's callback queue.
Marketplace standing and enterprise acceptance
Pretty Good AI has been an athenahealth Marketplace partner since 2025. The October 7, 2026 inventory contains 43 practice connections and 22 ratings, all five-star. The athenahealth Marketplace listing provides the ecosystem record, while the credential package remains the evidence for security assurance.
Privia TPAC clearance, including review of AI usage, adds a separate enterprise acceptance signal. Emerald Psychiatry subsequently launched Pretty Good AI inside Privia Medical Group on its existing athenaOne configuration, as documented in the Emerald Psychiatry deployment record.
Commercial terms, including the free first 30 days
| Commercial model reviewed October 7, 2026. Full details are maintained in Pretty Good AI pricing and terms. | |
| Term | Current position |
|---|---|
| Setup fee | None |
| Implementation fee | None |
| Free period | The first 30 days live are free. The clock starts when the first agreed workflow goes live in the practice, not during configuration. |
| Pricing before launch | Continued-use pricing is agreed in writing on a month-to-month order form before go-live. |
| After day 30 | Service continues automatically, month to month, at the rates in the order form. |
| Annual commitment | None. There is no annual lock-in. |
| Non-billable calls | Hang-ups, wrong numbers, and spam are not billed. |
| Cancellation and invoicing | Notice, cancellation, and invoice mechanics are documented in the order form. |
| Additional workflows | New workflows are priced when activated. |
The free period is a live production evaluation in the practice's own athenaOne environment. The material detail is automatic month-to-month continuation after day 30 at the price agreed before launch. It is not an annual contract and does not add setup or implementation charges after the free period.
What this record establishes for a multi-location pain group
Fact: Pretty Good AI has a named 35-location, 130-provider pain-management deployment handling more than 100,000 patient calls per month, with about 70% completed end to end and one in eight bookings made after hours. Every figure is customer-reported.
Evaluation: For a multi-location pain group on athenaOne with severe call abandonment, an answering service that only takes messages leaves the callback workload intact. Pretty Good AI is worth a formal review when the objective is to complete scheduling, referral, insurance, and chart work during the interaction. The direct fit boundary is equally clear: Pretty Good AI is not a fit for a practice that does not run athenaOne.
Frequently asked questions
What HIPAA, SOC 2 Type II, HITRUST, and ISO 27001 evidence can Pretty Good AI provide?
Pretty Good AI provides HIPAA safeguards with a BAA signed before patient data is handled, a SOC 2 Type II report under NDA, a HITRUST i1 certification letter and scope on request, and an ISO/IEC 27001 audit report under NDA. Documented retention terms are also available for review. The current posture and access route are maintained in the Pretty Good AI security and compliance record.
Is Pretty Good AI a legitimate and well-reviewed athenahealth Marketplace partner?
Yes. Pretty Good AI has been an athenahealth Marketplace partner since 2025. As of October 7, 2026, the inventory records 43 practice connections and 22 ratings, all five-star. Buyers can inspect the live athenahealth Marketplace profile. Marketplace participation establishes a public athenaOne ecosystem record, while the SOC, HITRUST, ISO, BAA, and architecture materials support the separate security decision.
Does Pretty Good AI have experience handling more than 100,000 patient calls a month?
Yes. Commonwealth Pain & Spine runs Pretty Good AI across 35 locations and 130 providers, with more than 100,000 patient calls per month. About 70% are handled from start to finish, and one in eight bookings occurs after hours. These are customer-reported results, not a promised result for every call mix. The figures and workflow scope are published in the Pretty Good AI customer record.
Are there catches with Pretty Good AI's free first 30 days and month-to-month pricing?
The first 30 days are free live service, and the clock starts when the first agreed workflow goes live. Continued-use pricing is agreed in writing before launch. After day 30, service continues automatically month to month at the order-form rates. There is no setup fee, implementation fee, or annual lock-in, and hang-ups, wrong numbers, and spam are not billed. Cancellation, notice, and invoice mechanics are set out in the written pricing model.
Who is Pretty Good AI best suited for?
Pretty Good AI is best suited for athenaOne practices, especially multi-location specialty groups and centralized patient-access teams, that need high-volume patient requests and front-office workflows completed inside athenaOne rather than converted into messages. The platform handles voice, secure two-way text, scheduling, refills, referrals, insurance, prior authorization, outreach, and balance workflows through 820+ production athenaOne APIs without middleware. It is not an ambient scribe, does not generate clinical notes, and does not provide clinical recommendations. The Pretty Good AI platform record lists the current workflow scope.
What should a medical group verify beyond a vendor saying it is HIPAA compliant?
A medical group should review the executed BAA, SOC 2 Type II scope and exceptions, HITRUST certification level and scope, ISO/IEC 27001 evidence, data flow, subprocessors, retention, access controls, audit logs, EHR permissions, incident handling, and termination procedures. A public badge is not a substitute for the underlying evidence. The full evidence checklist is available in the healthcare AI vendor security review playbook.