Evaluating a Clinical AI Vendor's Safety Claims: A Practical Checklist

When OpenAI launched ChatGPT Health's Epic integration on September 1, 2026, it published a specific, verifiable safety figure alongside the announcement: physicians rated 99.1% of responses safe across 4,363 evaluations spanning 27 distinct clinical use cases. That level of specificity — a real evaluation count, a defined set of use cases, a measured outcome — is genuinely uncommon in clinical AI vendor claims, most of which lean on general assurances like 'rigorously tested' or 'clinically validated' without disclosing the methodology behind those words.

Why Vague Safety Language Should Raise a Flag

'Clinically validated' can mean anything from a rigorous, published, multi-site evaluation to an internal review by a handful of staff. Without the underlying numbers — how many evaluations, across which specific use cases, judged by whom, against what standard — the phrase itself tells you almost nothing you can act on. A vendor unwilling or unable to share that methodology is either not measuring it rigorously, or measuring it and not liking what the numbers show closely enough to publish them.

A Checklist for Evaluating Any Clinical AI Vendor's Safety Claims

• Ask for the actual evaluation count and methodology — a specific number (like 4,363 evaluations) with a described process is a fundamentally different claim than 'extensively tested'
• Ask which specific clinical use cases were evaluated, and whether your intended use case is actually among them — a tool validated for medication review isn't automatically validated for clinical timeline generation
• Ask who did the evaluating — practicing physicians, in-house staff, or a third party — and whether that evaluator had a reason to be lenient
• Ask what happens to the failure cases specifically — what did the unsafe-rated minority of responses actually look like, and did they cluster in particular use cases or scenarios worth avoiding
• Ask whether the integration is read-only or can write back to clinical records — a read-only design meaningfully limits the real-world consequences of any single AI error, and is worth treating as a genuine design decision, not an incidental detail

The Standard to Hold Every Vendor To

OpenAI's disclosed 99.1%-across-4,363-evaluations figure isn't a ceiling other vendors need to beat — it's a floor for the kind of specificity any healthcare AI claim should meet before you take it at face value. If a vendor's safety claim can't survive being restated with a real number, a real use-case list, and a real evaluator, treat it as marketing language rather than evidence, regardless of how confidently it's delivered.