Decision support. ChironAI OM drafts and structures every WC artifact for the treating physician. The physician edits, attests, and signs every report, analysis, and form before it leaves the practice. ChironAI does not make a regulatory clearance claim; see Disclosures.
Every number on this page is a command you can run.
The rest of this site makes claims — about the money path, about DWC reporting, about causation and apportionment. This is the page where you check them. Each claim resolves to a capability counted here, and each count is the output of a script run against the product codebase on the date printed beside it — not a figure somebody agreed to publish.
We are not going to show you a customer logo, because there is not one to show. A practice evaluating ChironAI OM today is evaluating software rather than a reputation, and under those conditions the only evidence worth anything is evidence you can re-derive without us. So the whole inventory is below, published in full for machines as well as for people, and the method that produced it is printed beside it.


The published counts
feature-census.mjs
derived 2026-09-21
ai-capabilities-anchored.mjs
derived 2026-09-21
scheduled monitors and durable queues
derived 2026-09-21
the sum of the three lenses
derived 2026-09-21
Underneath the 440+ customer-facing capabilities sit 145 domain entities under fail-closed row-level security, 90 compliance, security and integrity controls enforced in code (shown as posture, not a catalog), and 40+ California Labor Code / DWC / 8 CCR provisions encoded across the workflow. None of that is counted in the headline. Tables, controllers and cloud resources are engineering plumbing, and parading them as features is how an indefensible number gets published.
What counts as one feature, written down before it was counted.
A capability count is only as good as its unit, and most of them do not have one. Ours is data rather than prose — a rules file in the marketing repository that a single script applies to ChironAI OM and to its sibling product, so the two are counted the same way and neither can be flattered by a definition written for it. The number this produces has gone down before, when the instrument was made stricter, and that correction is on the record in the same file as the figure.
Enumerate every request surface
Every route declared by the product API is read out of the source. This is the raw number, and it is deliberately the starting point rather than the answer.
Collapse the CRUD
List, read, create, update and delete against one object are five declarations and one thing a clinic does. The method and the path parameters are dropped, leaving one key per object.
Collapse variants onto what they vary
A streaming and a blocking form of one analysis, a versioned duplicate, a selector, a lifecycle transition — each folds into the capability underneath it rather than counting beside it.
Drop what is not for the customer
Operator-only administration and machine-to-machine surfaces are removed. They exist, they matter, and they are not something a practice buys.
Require reachability at both ends
A surface has to be declared on the server and actually called by the console or the web app. Anything nothing calls is excluded — which is the step that removes the most, and the one worth trusting the count for.
Remove anything the AI lens already counts
The reasoning capabilities are counted by their own instrument against their own registry. Subtracting them here is what stops one capability being sold twice.
Reproduce it
# re-derive the features lens against both product repositories node scripts/checks/feature-census.mjs --derive \ --om <ChironAI-OM> --cds <ChironAI-CDS> # itemise it, marked counted / excluded with the rule that fired node scripts/checks/feature-census.mjs --list # the blocking gate: fails when a published figure and the # census disagree, in either direction node scripts/checks/feature-census.mjs # the reasoning lens, run inside the product repository node scripts/checks/ai-capabilities-anchored.mjs
The gate, not the promise
The census writes a registry that names, for every key, the routes it was collapsed from and the rule that excluded it. A pull request that changes a published figure without the registry agreeing does not merge, and neither does one that leaves a figure behind after the registry moves. The rounding rule is enforced the same way rather than remembered.
The control that says the instrument is honest
The same script, under the same definition, is pointed at ChironAI CDS on the same day. On the last derivation its figure did not move while OM’s did. An instrument that raised every number it was aimed at would be measuring itself, so the sibling product is run as a control and the result is kept whichever way it comes out.
What these figures deliberately do not say.
Not a customer count
This page counts capability, never adoption. There is no logo wall here and no testimonial, because a capability claim can be checked against the code and a customer claim cannot be checked by you at all.
Not a saving, a percentage or a return
You will not find a time saved, a collection-rate lift or a payback period anywhere on this site. Those are outcomes measured in a practice, and measuring one properly takes a practice and a year.
Not an exact figure, on purpose
Each headline is published as a floor — the largest multiple of ten strictly below the exact count, which is a rule the build enforces rather than a judgement somebody makes. The exact figure is printed beside it so the rounding is visible rather than convenient.
Not the security control list
Isolation, access control and audit posture are described, never enumerated. A public inventory of every control, threshold and exclusion is an attack map. The verification endpoints are the exception: they take no login, hold no patient data, and are meant to be used by the party who doubts the document.
Thirteen groups. Every item below is something the product does today.
Each group names its own capabilities in the language a clinic would use, and carries a count. Every counted feature is assigned to exactly one feature group, and those groups sum to the feature census exactly — a total that stops adding up from its own parts has stopped being a measurement. The two groups that carry the reasoning and the background automations show those lenses’ own published floors instead, because those groups are those lenses, and counting them twice is how one page ends up publishing two numbers for one fact.
The reasoning is visible, verified, and never trusted blind.
- The Round Table — five specialist Digital Employees (Chiron, Issac, Justine, Eli, Theo) convened conditionally per case as a sequential relay that streams one specialist’s reasoning at a time, with graceful degradation
- Eve-Healthcare™ F5/reasoner — a compound five-component reasoning architecture, not a single model behind a prompt
- Chain-of-Verification — every specialist self-critiques (did I invent anything? what would opposing counsel argue?) before a physician sees the output
- Honest reasoning stream — a live, step-by-step trace of the real work, engineered to never fake a progress bar; the chain-of-thought never leaks to the transcript
- Ask the Case — grounded Q&A over the record and guideline corpus, inline citations, a hard guardrail that deletes any citation the reasoning did not retrieve
- Defend This — the system argues against its own determination as the defense QME, UR reviewer and carrier, then assembles a submit-ready defense packet
- Record digest — reads 1,000–3,000-page files whole (split-not-slice), segregates §4062.3 admissibility, then adversarially refutes every chronology entry
- Fail-toward-unverifiable verification — the schema cannot express "confirmed" on a failed check; unsupported claims are flagged, never deleted
- §4628 report drafting — 12 statutory sections, per-section specialist routing, page-anchored citations built from real anchors and verified back against source
- Apportionment legal-sufficiency engine — encodes Escobedo, Brodie/Strait §4664(b), Hikida, Almaraz-Guzmán against a registry that rejects invented authorities
- Glass-box tool-calling — one visible activity step per real operation (retrieval, compute, compose, persist), never a fabricated timer, never a model name
- Grounded RAG with citation verification, ICD-10 hallucination guard, and apportionment-citation validation
- One outbound compliance choke point — foundation-model-name suppression, AB-489 licensure-rewrite, PHI-minimization, reasoning-scaffolding scrub
- Shipped prompt-injection scorer — PHI-never-echoed, quarantine-vs-served discrimination, run live in-VNet weekly
- Human-in-the-loop by architecture — physician review/override on every determination; deterministic engines own every number the law requires exact
A real occupational-medicine chart, not a claims wrapper.
- Patient chart — demographics, problem list, medications, allergies, vitals (with BMI), each with add/edit/resolve lifecycles
- Encounters & visits — typed encounter intake, visit context, completion evaluation
- Medical records — blob-backed upload, AI extraction (diagnoses, findings, work-status, treatment history), amendment under 45 CFR 164.526
- Imaging analysis — AI medical-image analysis with modality-appropriate framing, radiologist-attested
- Treatment plans — plan + line-item authoring, revision, completion, per-item authorization requests
- Physician determinations — versioned, attestable, amendable
- Predesignation of personal physician — single-valid enforcement
- Medical Provider Network — §4616 verification, weekly refresh from the California DWC open-data feed
- Voice — dictation transcription and a realtime voice mode over the case
One system runs the whole file, intake to close.
- Eligibility & §3600 classification — industrial / denied / delayed / first-aid / non-industrial, versioned as the record develops
- Case intelligence dashboard — aggregated case detail, med-legal designation, determination summaries
- Case management — timeline, clinical-phase rail with adjacent-only transitions, MMI readiness, drift board
- Case Drift — flags cases lagging their predicted recovery trajectory before the file goes stale
- Signals — acknowledge / resolve / dismiss lifecycle with required-note discipline
- Morning Rounds — an overnight-worked worklist: what the system read, flagged and drafted while the practice was closed
- Records that react — a new document re-reads the case and refreshes the affected determinations
- Work queue — merged obligations and RFA work, board and list views, next-best-action
- Non-industrial redirection — care redirection with letter generation and referrals
- What-If scenario modeling — deterministic dollar-impact on the case’s own findings and the Labor Code constants that govern the number
- Case closure — settlement (C&R vs Stipulated Award), future-medical/MSA pathways, transition of care, guardrails that can only be overridden not "cleared"
- Closure & §5410 reopening — five-year reopen window computed and tracked so a case never closes blind to its reopen date
- Appointments — recurring series, status lifecycle, check-in, no-show detection
- Plateau assessment — the physician asks Chiron to weigh a plateau signal against the record; the clinician asks, and the clinician decides
- MPN membership and employer-to-MPN mappings kept current, so an eligibility answer is not quietly based on a stale mapping
The causation math is code, not a guess.
- AOE/COE causation analysis under Labor Code §3600, drafted from the full record and versioned first-draft to final
- §4663 apportionment — multi-factor analysis with normalization and fail-safe defaults
- §4664 prior-award offset — a deterministic engine on the Brodie/Strait three-prong test: exact, reproducible, versioned
- Impairment engine — Whole Person Impairment under AMA Guides 5th, DRE/ROM selection, Combined Values math, into a 2005 PDRS calculation
- Practice-wide impairment register — every rating in the practice on one list with the state it is waiting in, so a rating that needs a physician is found because somebody read the register, not because somebody opened cases one at a time until they hit it. A rating on a case the reader holds no grant on shows as restricted rather than as blank, so a gap in the list is never mistaken for a gap in the work
- Case-law grounding on every narrative — Escobedo, Brodie, Strait, Hikida, Almaraz/Guzmán
- Defensible narratives — every statement traces to the field in the record that produced it; reconstructable years later for deposition
It scores the denial before the payer does — and builds the appeal.
- MTUS / ACOEM alignment — plans checked against the twenty-five authentic California DWC guideline documents at the point of care, with citations
- UR Survival Score — denial and IMR-appeal risk scored before the RFA goes out, with the evidence to attach named
- RFA lifecycle tracking end-to-end; §4610(g)(2) auto-authorization detection; denial-risk drivers surfaced inline
- The DWC Form RFA served by an expiring, revocable link instead of emailed as an attachment — the claims administrator opens the request itself, with no account and nothing else behind the link, and the §4610 clock runs from a delivery the file can evidence rather than from somebody’s sent-items folder
- Dubon / Bodam denial classification gating IMR eligibility vs a straight appeal
- IMR packet assembly under §4610.5, timed against the 30-plus-5-day mail clock, with exhibit auto-proposal
- UR decisions capture and classification; treatment authorization insights (suggest-MTUS, UR-insights) with glass-box reasoning
- IMR determination captured from the letter itself — upload the PDF rather than retyping the outcome, so the record holds the document the decision came in
The panel process runs like a state machine, not a spreadsheet.
- §4628 QME report — twelve required sections drafted, section-locked until prior sections are physician-approved, checked against a compliance checklist
- §4062.1 / §4062.2 panel process — QME and AME panels as a state machine, strike tracking, the Vázquez good-cause exhibit generator (byte-stable)
- PTP/QME reconciliation — treating-physician determination reconciled line-by-line against QME/AME findings, disagreement surfaced not overwritten
- QME intake questionnaire — worker pre-evaluation intake feeding report prefill; §4664 prior-claim flagging as unconfirmed candidates
- §4628 admissibility — §49 time itemization with specialty face-to-face minimums, service-performer disclosure, records-reviewed exhibit with §9795(c) page reconciliation
- Information exchange (§4062.3 / §35) — package service, 20-day clocks, objection and WCALJ-order handling, ex-parte classification (Suon en banc)
- Report service (8 CCR §36) — recipient matrix by case shape, §38 30-day clock, declaration of service, serve-by-fax
- DEU rating (§4061) — 20-day rating and 30-day reconsideration clocks; factual corrections (DWC Form 37, §4061.5)
- Sub-rosa (ML205) and testimony (ML204) — §35 information-gate, quarter-hour billing, §35.5(f) deposition-notice deadlines
- AME agreements; secondary-provider report integration with 20-day clocks; case-party (adverse-party) register
- On-demand DWC / DEU / CMS form rendering — 21 forms scoped to case, panel, evaluation and billing
- Evaluations move between stages with a recorded reason for rework, so a report sent back is a fact on the file rather than a conversation nobody logged
- Supplemental reports and their 60-day clock tracked from the request that triggered them
- Disputed issues recorded per evaluation — the section §4628(e) makes inadmissible if it is left unanswered
Every DWC clock, tracked to the business day.
- Form 5021 — Doctor’s First Report, drafted against the 5-business-day deadline
- PR-2 progress reports — auto-drafted on the 45-day cadence or on a material change; the physician edits every section
- P&S / MMI under §4061 — triggered by the clinical milestone, deadline-tracked, physician-attested
- Deadline engine — every statutory clock encoded and holiday-aware against the California calendar; a daily 07:00 sweep surfaces every approaching and overdue report
- Reporting-obligation service matrix; secondary-report obligations; transmission-gap alerts
- AB 3030 attestation on every AI-drafted report — non-dismissible, persists through the signed PDF
- Proof of service recorded on a regulatory report — who it went to, how, and when, which is the part a dispute turns on
- A finished report delivered to the claims examiner by secure link — one report, no account, an expiry and a revoke, and a record of when it was opened that becomes part of the proof of service. A dead link answers the same way whether it expired, was revoked or was superseded by a correction, so an outsider cannot learn from the error page that a corrected version exists
- Form 109 filed when an objected disclosure is replaced, linking the replacement to what it supersedes
Coded to the fee schedule. Chased to the penalty.
- OMFS coding on every billable encounter; E/M coding leveled on the CMS 2021 Medical Decision-Making rules
- Medical-Legal Fee Schedule (8 CCR §9795) — the full ML-200…ML-205 catalog, first-200-page thresholds, $3/page MLPRR excess, §9795(c) perjury page-count verification
- ML204 testimony billing ($113.75/¼hr, 2-hour minimum, lesser-of usual fee) and ML205 sub-rosa review ($81.25/¼hr)
- §4603.2 penalty & interest — the 45-calendar-day pay rule tracked; penalty and interest computed the moment a payer misses it
- Explanation-of-Review ingestion and structured extraction; the §4622 90-day clock anchored to the EOR date
- Second Bill Review → Independent Bill Review appeal ladder; CMS-1500 and medical-legal bundle generation
- Clearinghouse claim submission (X12 EDI); payment events and tracking; immutable billing audit trail; carrier performance analytics
- Billing identity chosen per claim, so a group practice bills under the right entity without re-keying it
- Payer registry — one entry per carrier, claims administrator and employer, however many ways the practice has spelled it, with duplicate spellings merged rather than left to split the numbers. Carrier late-payment performance counts a carrier once instead of reporting three rates for three spellings of one name, and the LC §4603.2(b) governmental-payer window is set once on the employer and applies to every case that employer appears on, instead of being re-entered case by case and missed on the one that mattered
- Medical-legal receivables aged by bracket, beside the LC §4622 second-review deadlines still open — the practice can see what it is owed on med-legal charges and how long it has left to contest what was paid, so a collectable balance is not lost because a ninety-day window closed unwatched
- Interpreter cancellation billed on the notice actually recorded — an explicitly entered zero-notice cancellation still bills the two-hour minimum; a missing notice period does not
- A missing fee schedule reports the underpayment as UNDETERMINABLE rather than as a finding, and generates no zero-value dispute letter
Purpose-built clinical and med-legal visualizations — that refuse to lie.
- §4663 apportionment waterfall — whole-disability reference down to the industrial remainder, refusing to draw an unweighed factor
- §4062.3 record-chronology timeline — admissible records on a time axis, contested and undated entries handled honestly
- Work-status restriction bands (DWC-AD 10133.36) on a duration axis
- QME panel deadline horizon — a diverging statutory-clock axis centred on today, overdue in alarm ink
- Every chart carries a mandatory text-equivalent and declines to draw on a failed read rather than assert a false picture
- Glass-box streaming reasoning surface reused across closure, QME drafting, apportionment and PTP-QME
- Unsaved clinical work is protected — closing a tab mid-note warns first, and a failed action offers a real retry rather than “refresh the page”
It works the caseload while the practice is closed.
- 18 scheduled monitors — closure windows, intake retention, case drift, RFA/UR §4610 clocks, reporting-obligation deadlines, IMR filing clocks, QME/AME panel windows, billing deadlines, breach detection (every 5 min), appointment no-show, the weekly Medical Provider Network refresh, and more
- 6 durable queues — document extraction, intake identity extraction, whole-file record digest for QME-scale cases, PTP-QME comparison, QME finding extraction, QME record organization
- A durable job-run substrate with a replayable glass-box trace you can re-attach to across navigation
- A weekly in-VNet prompt-injection evaluation that runs the live guardrails against an attack corpus
Every signature is provable. Every tenant is isolated.
- Public cryptographic verification — four no-login, zero-PHI, rate-limited endpoints (IMR, QME, PTP-QME, closure); a SHA-256 hash binds the attestation to the exact rendered PDF
- Fail-closed tenant isolation — Postgres row-level security under a non-superuser role across ~145 tables, plus tenant-scoped blob storage, plus defense-in-depth explicit filters
- A four-level per-case access kernel (read-only / consulting / treating / owner) with a billing-only side-channel that can never read clinical data
- Immutable PHI access log written by decorator, not developer discipline — tamper-evident by construction
- Breach detection mapped to HIPAA notification triggers — failed-auth bursts, cross-tenant attempts, mass-export patterns
- AI-use disclosure per CA AB-3030 / AB-489; tenant-wide MFA with break-glass; PHI-safe logging and telemetry throughout
Run the practice, not just the claim.
- Clinic provisioning, user and role administration, session management, MFA reset
- Analytics — practice and med-legal dashboards, physician-agreement tracking as an operational trust metric
- Notifications — in-app and email with per-user preferences and deterministic de-duplication
- Document intake triage, misfile register, records-request tokenized upload links for outside parties
- In-app help — a 98-article library with acronym-aware search, shared verbatim with Chiron’s own help tool, plus guided tours
- Tenant data rights — DSAR export with a verifying manifest and certified destruction (BAA §6.3 / §8.2); compliance/BAA/breach registers; in-product support queue
- Multi-clinic groups — practices running more than one clinic are administered as a group, access granted explicitly per clinic and denied by default, re-checked on every request rather than once at sign-in
- Any register exported to CSV or XLSX, generated on the server and streamed, so a large register does not depend on what the browser can hold
- Four practice registers built on the server and handed over as a file — cases with their §4610 authorisations, billing with the §4603.2 pay clock and receivables ageing, reporting obligations, and provider productivity. A practice can answer what it is owed at ninety days, and give an auditor the register itself rather than a screenshot of a dashboard. The billing register is the only ageing that covers the whole billing book; the medical-legal one on the practice view is narrower by construction and the two are not meant to reconcile
- Bulk ZIP import into incoming documents, so a batch from a provider is one upload rather than fifty
- Error reports — what has actually broken for the practice, grouped by occurrence with no patient information recorded, and triaged rather than deleted
Answer a records demand, and be able to prove what you sent.
- Document library — the chart’s records organised at patient and case level, grouped by document type with per-group counts, and a preview offered only for formats a browser can actually render
- Records production — assemble a disclosure packet against a specific request, with the requesting party and the request recorded on the production itself
- Bates numbering — a per-production prefix seeded from the patient surname, with every produced page numbered and the range recorded per document
- Honest manifest — the packet declares superseded, duplicate and re-numbered pages rather than presenting a clean-looking set that hides them
- Withheld log — what was deliberately not disclosed is recorded as withheld with its reason, and stays distinguishable from what was never considered
- Void a production — a production can be voided and its artifact allowed to expire without destroying the record that the disclosure happened
- Produced index — every document in the chart shows whether it has already gone out, under which request, and in which Bates range; a document produced only under a since-voided production says so
- Truncation is stated — a records list that hit its page ceiling says so rather than presenting a partial chart as the whole one
- Records requested FROM a claims administrator or attorney, and the tokenized upload link an outside party returns them through
- A production delivered to opposing or applicant counsel through the same kind of link, with the packet streamed by the server rather than redirected to storage — so no patient identifier is left in the recipient’s browser history, or in any proxy between them and the practice
440+ capabilities. One rule that never bends.
Every capability listed above takes initiative — convening specialists, scoring risk, drafting reports, computing deadlines — and none of it crosses into deciding. Deterministic engines hold the numbers the law requires to be exact, because an impairment rating or a penalty calculation is arithmetic and should be produced by arithmetic. A must-review-before-final gate sits under every output that leaves the practice.
The treating physician edits, attests and signs. Once they do, the document is cryptographically verifiable against a public endpoint that takes no login and holds no patient data, so a carrier or an opposing evaluator can establish for themselves that the report is unaltered since attestation. That is the bounded agency a defensible workers’ compensation record demands, and it is the reason the software is decision support rather than a decision.
Where the reasoning runs. Eve-Healthcare™ F5/reasoner — fusion of five cooperating reasoning models, augmented by a dedicated vision model, composed per request rather than a single model behind a prompt. Read the architecture.

Bring a case you already know the answer to.
The most useful demo is the one you can mark. Bring a closed file, or a month of explanations of review, and watch the system work paper whose answer you already have — which is the same test this page is built for, run on your own caseload instead of on our count.
Bring one month of EORs — you keep the findings either way.