Heartflow

The computation is the product and always has been. FFRCT derives lesion-specific physiology from an already-acquired CCTA using computational fluid dynamics and AI, producing information that cannot be obtained from the scan by inspection and that otherwise requires an invasive catheter procedure. The company describes Heartflow One as an AI-driven platform across all four functions. No hardware and no services business underneath.

Decision support delivered as an analysis a clinician interprets and acts on, and the company frames its value as informing management decisions rather than making them. SMART-CT reporting improved inter-reader agreement and increased reader confidence while maintaining diagnostic accuracy, which is the right way to characterise an augmentation tool.

Graded B rather than A because Heartflow's FFRCT workflow has historically involved a processing turnaround with vendor-side quality control, and the extent of any human step in that pipeline is not disclosed in retrieved materials, the same gap flagged on Elucid.

The four functions are clearly delineated and their intended uses distinguished, and the underlying approach has been described across a very large peer reviewed literature, so the methods are checkable in principle. Graded B rather than A for a specific and documented reason: when the Nature Reviews Cardiology QCI Study Group ran a head-to-head comparison of eight FDA-approved plaque quantification systems, the publication states Heartflow was unable to provide the required analysis for inclusion.

Publishing extensively about your own product is not the same as submitting it for direct third-party comparison against competitors. Contrast Lunit, which earned an A partly for entering third-party head-to-head benchmarking twice.

The trust centre here is structured better than almost any in this index because it treats the artificial intelligence layer as raising its own questions rather than folding it into general security. Training data and bias appear as a named category a buyer can interrogate, alongside model security and monitoring, and a structured risk profile is published covering data access level, impact level and third party dependence.

Naming third party dependence as a category is itself a supply chain disclosure, since it tells a buyer the question is recognised and answerable rather than deflected. Controls are enumerated rather than asserted, covering encryption at rest, access monitoring, audit logging, role based access control and backups, and the infrastructure provider is named.

Held below the top grade because the answers sit behind an access request, so a buyer cannot read them before entering a sales process, and because the three that matter most are not published anywhere: how long submitted studies are retained, what deletion is available on termination, and whether customer studies inform model development. A structured list of categories is a promise that answers exist rather than the answers themselves. Secure all three in contract rather than relying on the control list, and ask specifically what the training data and bias category actually says.

The deepest evidence base of any vendor in this index, and it spans diagnostic accuracy, prognosis, workflow and economics rather than accuracy alone. More than 600 peer reviewed publications, over 100 studies covering more than 365,000 patients, and clinical use in over 400,000 patients.

SCOT-HEART randomised 4,146 patients and found CCTA reduced coronary heart disease death or nonfatal MI by 41 percent at five years versus standard care, with post-hoc quantitative plaque analysis showing high total plaque volume associated with sevenfold greater MI risk. ADVANCE-DK reported seven year outcomes where normal FFRCT carried 5.7 percent adverse event risk versus 16.2 percent for abnormal, with plaque quantification improving predictive accuracy from AUC 0.63 to 0.73.

SMART-CT measured a 25 percent reduction in read times. The Mass General Brigham CCTA registry tracked over 15,000 patients with up to 16 years of follow up. DECIDE is a roughly 22,000 patient registry across more than 30 US centres whose primary endpoint is change in medical management, which tests whether the tool changes what clinicians actually do rather than only what they see. NAVIGATE-PCI extends this to intervention planning. Crucially the guideline recognition is the strongest single marker: FFRCT is supported by the ACC/AHA Chest Pain Guideline, a higher bar than clearance and one no competitor in this lane holds.

Stronger than most in this category, though the specifics remain gated. The trust center treats AI training data and bias as a named category a buyer can interrogate, alongside AI security and AI monitoring, and publishes a structured risk profile covering data access level, impact level and third party dependence. Encryption at rest, access monitoring, audit logging, role based access control and data backups are enumerated, and Amazon Web Services is named as the infrastructure provider.

What is not published is the part a buyer most needs in writing: how long submitted studies are retained, what deletion is available on termination, and whether customer studies inform model development. Those answers sit behind an access request. Worth securing all three in contract rather than relying on the control list.

HIPAA appears as a named compliance program on the trust center with documentation available on request, and HITRUST certification rests on HIPAA derived safeguards. Unusually for this category, US and European regimes are addressed together rather than one standing in for the other, with CCPA and GDPR listed alongside HIPAA.

Held below the top of the band because the business associate agreement itself is never named or described in public material, and the HIPAA documentation is reachable only under an access request. A buyer should confirm BAA scope and terms directly, though the surrounding evidence points to a mature program rather than an absence.

Trust center at security.heartflow.com, and the certification stack is the most complete in this category: HITRUST, ISO/IEC 27001:2022, ISO 13485:2016 for medical device quality management, and SOC 2 Type 2 with the type specified, alongside named HIPAA, GDPR and CCPA programs.

Controls are enumerated in depth and include application and network penetration testing listed separately, a software bill of materials, secure development training, audit logging, role based access control, multi factor authentication, encryption at rest, intrusion detection and prevention, and mobile device management. Amazon Web Services is named as the infrastructure provider. A structured risk profile covers data access level, impact level and third party dependence. The one limit worth noting is that supporting documents sit behind an access request rather than open publication.

The strongest regulatory position in the cardiovascular CT lane, on two counts.

First, breadth: all four functions cleared in the US, with Plaque Analysis and RoadMap cleared October 2022 and two further clearances reported May 2026. Second and more important, FFRCT is supported by the ACC/AHA Chest Pain Guideline. Guideline inclusion is a different and higher order of endorsement than a 510(k), because it reflects a professional society judging the evidence sufficient to shape recommended practice, and it is the reason this vendor sits apart from newer entrants with equivalent clearances.

There is a geographic scoping point buyers must catch, and the company does state it plainly. All four functions are cleared in the US, Bahrain, Israel, Saudi Arabia and the UAE, but only FFRCT and Planner are cleared in Europe, the UK, Australia, Canada and Japan. Plaque Analysis and RoadMap are not available for clinical use across most of the developed world outside the US, which inverts the usual pattern where European CE marking precedes FDA clearance.

No demographic subgroup performance analysis was located despite an evidence base spanning hundreds of thousands of patients, which makes the omission more conspicuous here than for smaller vendors. With registries of this size, including Mass General Brigham at over 15,000 patients and DECIDE at roughly 22,000, subgroup analysis by sex, race and age is entirely feasible and would be highly informative.

Sex differences in coronary artery disease presentation and in plaque composition are well documented, making this a substantive rather than procedural gap. The company's trust centre does treat AI Training Data and Bias, AI Security and AI Monitoring as named categories a buyer may interrogate, which is more than most vendors in this lane offer and would ordinarily support a higher grade. Two things hold it here.

The material sits behind an access request, so a buyer cannot establish what any of those categories contains without entering a sales conversation, while several peers in this lane publish their governance disclosures openly. And the company states in public materials that its models deliver reproducible insights across diverse patient populations, which is a claim about subgroup performance made without any subgroup performance being published.

An unquantified diversity claim earns no credit on this axis, and asserting it while the supporting analysis is absent from registries large enough to produce it is a weaker position than silence. Related and worth raising in the same conversation, the company markets a data foundation of more than 200 million annotated CTA images as its central competitive advantage, and nothing retrieved states whose images these are, on what basis they were included, or whether an institution can decline to contribute. A buyer should ask for performance stratified by sex, race and age from the named registries, and for a written statement on training data provenance and exclusion.

The literature is extensive and the one test the vendor could not control is the one it is absent from. The approach has been described across a very large peer reviewed body of work, so the methods are checkable in principle and a reader has a great deal to engage with. What holds this at C is documented rather than inferred.

When an independent group ran a head to head comparison of eight approved plaque quantification systems, the publication states this company was unable to provide the required analysis for inclusion. Publishing extensively about your own product is not the same as submitting it for direct comparison against competitors, and the distinction is the whole point of independent benchmarking: a vendor selects which studies it runs, which endpoints it reports and which comparisons it makes, and a multi vendor evaluation removes every one of those choices.

A competitor graded in this same cluster entered that kind of comparison twice and was credited for it, so the contrast is within the category rather than against an abstract standard. The four functions are clearly delineated with their intended uses distinguished, which is real and belongs on the transparency side rather than here. No warranty, indemnity or remediation commitment was located. Ask why the analysis could not be provided, whether the company will enter a future multi vendor comparison, and for per function performance on your patient population.

The deepest integration position in this category on published evidence. Results are delivered directly into both PACS and the EMR rather than to one or the other, and the upstream side is automated, with the study sent securely to Heartflow without manual export. A dedicated support function exists to deploy and configure the software and integrate it with PACS, EMR and other IT systems, which is an implementation commitment rather than a compatibility claim.

Held below the top of the band because no EHR or PACS platforms are named and no interface standards are specified, so a buyer cannot confirm fit against their own stack from published material. Worth asking which systems are already in production and what the integration requires from local IT.

Cloud service model: CCTA data is transmitted to Heartflow, analysed, and results returned into the clinical workflow, requiring no new scanner hardware or change to acquisition. That is a genuine adoption advantage and works on scans institutions already perform.

Graded B rather than A because the model inherently means patient imaging leaves the institution, and no data residency terms or regional hosting arrangements were published, which matters given clearances across multiple jurisdictions with differing data regimes.

No list price published, but the reimbursement position is documented more thoroughly than almost any vendor in the index, and the company publishes a market access value dossier addressing it directly. Plaque Analysis received an EviCore coverage recommendation in July 2025, CMS began reimbursing plaque analysis as a separate outpatient hospital service, and automated plaque analysis carries an established Category I CPT pathway.

Notably the company's own dossier states candidly that current reimbursement does not provide adequate payment for FFRCT, an unusually frank admission against interest. Heartflow has also published cost-effectiveness analysis, including at AHA 2025, and reported significant cost savings across analyses of over 90,000 patients. Graded B rather than A because per-analysis pricing to the institution is not disclosed.

Within cardiovascular care the coverage is the broadest in the lane, spanning the full CCTA pathway from screening and risk stratification through diagnosis, physiological assessment, medical management and now CT-guided PCI planning via Planner and the NAVIGATE-PCI registry. No competitor covers that span.

Graded B rather than A because it remains a single disease domain, coronary artery disease, serving cardiology and cardiac imaging, and is graded on the same scale as index vendors covering multiple body systems and specialties.