Forbes · 26 Aug 2026
Paying By The Token And Why The Unit Economics Of Clinical AI Matter
The trade press is now writing about the pricing problem, not the technology.
The gateway landscape
Some of them publish an agreement. None of them changes the unit.
These are the LLM gateways a healthcare team actually shortlists. Three of the six publish that they will cover protected health information; the other three publish nothing either way, which is not the same as refusing. Compliance is close to table stakes now, not a differentiator. What none of them changes is the unit you are billed in: underneath the platform fee, what the models bill still passes through.
Every claim below links the page it came from, checked 2026-09-03. Every price cell links the vendor’s own pricing page. Where a vendor publishes no number, this page says so rather than estimating one — and where our research recorded no source for a claim, the cell says that too, instead of asserting it.
The whole landscape, on one question
What unit does the bill arrive in?
Priced in vendor units — a platform fee, plus what the models bill
- Aptible LLM Gateway
- TrueFoundry
- Portkey
- Featherless · Standard Compute (flat developer subscription, usage quotas underneath)
- OpenRouter (provider prices passed through, plus a 5.5% fee on credits)
Priced in a clinical unit — per patient, per case, per encounter
Router
Nobody else is in this box.
Placed on published price only, each one linked in the table below. Bifrost publishes no enterprise price, so it is not placed in this picture — it is in the table.
01Not our argument
This is not our argument. It is already the market's.
The case for pricing clinical AI in a clinical unit is being made in the trade press and in the literature, by people with nothing to sell you.
npj Digital Medicine
Pricing models for diagnostic AI
Hospital and lab budgets run in clinically legible units — per patient, per case — not in tokens or API calls, and buyers want a fixed base fee with a variable component tied to a clinical metric.
Becker's Hospital Review
Health systems race to rein in AI costs
The organisations furthest along are the ones now trying to get the bill back under control.
02Vendor by vendor
Published price, agreement status, and the unit the bill arrives in.
| Vendor | Published price | Publishes a business associate agreement? | Priced in a clinical unit? |
|---|---|---|---|
| Router | A base fee plus a per-patient charge, quoted for your setup — no published number | Agreements cover the model providers behind the gateway | Yes — per patient, in the unit you bill in |
| Aptible LLM Gateway | $400/mo + usage passthrough (pricing) | Yes — one agreement covering Anthropic, OpenAI and Bedrock-hosted models (product page) | No |
| TrueFoundry | $0/mo / $499/mo / $2999/mo, with "2M requests and 5 API keys for additional $499 per month" (pricing) | Yes — HIPAA agreement available, SOC 2 Type II (playbook) | No |
| Portkey (Palo Alto Networks) | Free / $49/mo / enterprise custom (pricing) | Yes at the enterprise tier — the "Enterprise Essentials" tier lists "Custom BAAs" and "Advanced Compliance (SOC2 Type 2, GDPR, HIPAA)" (pricing) | No |
| Bifrost (Maxim AI) | Open source; enterprise price not published (healthcare page) | Publishes no agreement — its healthcare page attaches "SOC 2 Type II, HIPAA, and ISO 27001 compliant" to the on-prem or VPC deployment option (healthcare page), and its enterprise tier is "Custom Pricing" with no BAA listed (pricing) | No |
| OpenRouter (Stripe agreed to acquire) | Model prices passed through "without any markup", plus "a 5.5% ($0.80 minimum) fee when you purchase credits" (FAQ) | Publishes no agreement — its enterprise page lists GDPR, SOC 2 and zero data retention, not HIPAA (enterprise page) | No |
| Featherless · Standard Compute | Flat, with usage quotas underneath. Featherless: chat plans from $25/mo, developer plans from "$50+" per unit per month (plans). Standard Compute: seven tiers from $19/mo to $2,499/mo, each with a stated allowance of "API work included" (pricing) | None found published as of 2026-08-31 | No — a flat developer subscription is not a clinical unit |
Two of these names just changed hands.
Palo Alto Networks completed its acquisition of Portkey on 29 May 2026 and folded it into a security platform (announcement). Stripe agreed to acquire OpenRouter in August 2026; that deal has not closed (Stripe newsroom). If you are picking infrastructure to depend on for years, it is worth knowing who sets the roadmap and the price from here: a security company and a payments company. Neither of them is buying the pricing unit.
A note on the cloud platforms.
Reaching a model through a hyperscaler is not the same as the hyperscaler covering it. Google Cloud will enter into a business associate agreement, but the agreement covers a specific list of products, and Vertex AI as a whole is not on it — several individual Vertex AI services are, and Google tells customers not to use uncovered products with protected health information (Google Cloud HIPAA compliance).
The lesson generalises: check the covered-products list for the exact service you route through, not the platform's name. That check is one of the things a gateway is supposed to do for you.
03Questions about the others
01
Is there a HIPAA-compliant alternative to OpenRouter?
Yes, several. Aptible and TrueFoundry both publish that they will cover protected health information, and Portkey lists custom BAAs at its enterprise tier. Bifrost publishes no agreement; its healthcare page attaches HIPAA compliance to its on-prem or VPC deployment option. The sources are in the table above. Every one of them prices in vendor units, with what the models bill passing through underneath.
Router is the alternative that also changes the unit: a base fee plus a per-patient charge, in the unit you already bill in.
02
Does OpenRouter — or a direct OpenAI key — cover protected health information with a business associate agreement?
OpenRouter publishes none. Its enterprise page lists GDPR, SOC 2 and zero data retention, and does not mention HIPAA (enterprise page). If you are routing protected health information through OpenRouter today, that traffic is not covered by anything OpenRouter publishes.
A direct OpenAI key can be covered: OpenAI publishes a process for requesting an agreement (help page) and a healthcare addendum setting the terms (PDF). Reaching a model through a cloud platform is a separate question with a per-service answer — see the note on the cloud platforms above.
03
Which of these will price per patient?
None of them, on anything they publish. Every published price in the table is a platform or subscription fee with model usage passing through underneath, or a flat developer subscription with usage quotas. That is the box Router is in on its own, and it is the box the npj Digital Medicine study says buyers are asking for.
04
Why does this page leave some cells blank?
Because the claim had no source we could link. A cell that reads "not sourced here" means our research did not record a page saying it — not that the vendor does or does not do the thing. Ask the vendor. Everything else on this page links to where it came from, and anything we could not stand behind was removed rather than softened.
04Back to the point
None of this is what we sell. What we sell is a cost per patient.
Router is an LLM gateway for healthcare companies that run their own AI: many models behind one interface, an approved list you control, a patient identifier on every request, and a record of the model, the patient and the cost. Priced as a base fee plus a per-patient charge.
Request a quote