How we compare AI scribes and healthcare AI assistants

Healthcare and general AI assistants

listed — a profile exists with no published rating. Not a zero; excluded from the mean. network — the figure belongs to the parent Doximity network app, not to Doximity GPT; shown for provenance, excluded from the mean. A dot means no profile exists on that site.

How the average is calculated

• Each site counts once, and counts equally. The mean is across sites, not across reviews, so a site holding 3,000 reviews does not outweigh one holding 12. Capterra, GetApp and Software Advice are counted as three separate sites.
• TrustRadius scores are out of 10. They are shown above on their native scale, marked /10, and halved before entering the mean.
• Unclaimed profiles count. A vendor not having claimed a page is not a reason to drop an unflattering score. This applies to us as well.
• Consumer complaint pages count, but are not comparable to B2B reviews. The low Trustpilot scores for Claude, ChatGPT, Microsoft Copilot and OpenEvidence are billing and access complaints from consumers, not assessments by the clinicians who buy these tools. They are counted for consistency and flagged here rather than removed.
• Tali was read on 26 July 2026, not in the 18 July sweep. Google Play counts marked ~ are approximate.

A rating built on few reviews moves on a single opinion. Several products here rest on a handful of reviews, ours among them. Note also that Capterra, GetApp and Software Advice syndicate a single review pool, so where a product appears on all three the same reviews are represented in each of those columns.

Healthcare and general AI assistants

BastionGPT Professional signs in at secure.bastiongpt.com; Professional Plus at plus.bastiongpt.com, which scores the same B/75.

Why the sign-in host

Marketing sites carry analytics, advertising and chat tags that require loosening exactly the headers Observatory tests, so grading them measures a tag manager rather than a product. The host behind the login is where credentials and patient information are typed. Where a vendor does not publish its application hostname, we resolved the conventional one and confirmed it serves a real sign-in application before scoring it. The host scored is printed under every grade.

What the grade measures

HTTP response headers only: HTTP Strict Transport Security, Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, cookie flags and subresource integrity. Scores run 0–100, with bonus points above 100.

What it does not measure

• Not how any vendor stores, encrypts or handles patient data. Nothing in this scan sees inside an application.
• Not a HIPAA assessment, and no substitute for a BAA or a vendor risk review.
• Not TLS configuration, authentication design, access control or application code.
• A weak grade does not mean a weak product, and an A+ proves nothing about the product behind it.

It earns a column for one reason: it is among the very few security signals a buyer can verify independently, in a browser, without taking any vendor’s word for it — including ours. Treat it as header hygiene, not a verdict.

Pricing

Prices were read from each vendor’s public pricing page in July 2026, and every price in the comparison tables links to the page it was read from.

Five of the ten platforms in the scribe comparison publish no price at all — Abridge, Ambience Healthcare, DeepScribe, Dragon Copilot and Suki AI each route buyers to a sales conversation. Those are marked “Custom”, and any figure beside them is a third-party estimate rather than a quote. Implementation fees, reseller markups, seat minimums and annual prepayment terms sit on top of whatever is eventually quoted and are not visible to us. Prices are per user per month at the entry tier, before annual discounts.