Heidi Health

Ambient capture and note generation is the product, extended by Heidi Evidence for cited clinical decision support and Heidi Comms for patient call coordination. All three are model driven.

The product level oversight model is the category standard and clearly stated: the system generates notes and summaries from the captured encounter, the clinician reviews, edits and finalises them, and the clinician also controls retention limits on what is kept. What lifts this above a bare category standard is organisational rather than product level, and nothing else in this category has it.

ISO 42001 certification brings a documented corrective action process for when limitations in the AI system are identified, with internal verification and executive participation, audited externally on a three year cycle. That is a mechanism for responding to discovered failures rather than only a promise that a human is in the loop, where most competitors' oversight story stops at the clinician signature.

Held below a higher grade on the same product level absences that apply across this category, which a management system certification does not fill. There is no published accuracy, hallucination or omission rate. Nothing states what the system does when audio quality is poor, when speakers overlap, or when part of an encounter cannot be resolved. And no indication is surfaced to the reviewing clinician of which parts of a generated note are low confidence. That last gap is sharper for a product operating in 110 languages, where transcription confidence will vary far more than in a monolingual deployment.

No model is named, and there is no model class, foundation model provider, architecture description, model card, version or update policy. No published accuracy, error or benchmark figure of any kind was located, which is the decisive absence. That places this behind competitors that name their model provider on a public subprocessor list. One adjacent credit is real and worth recording without changing the assessment.

ISO 42001 certification requires a documented AI management system, which means an internal inventory and control set for the AI systems in scope demonstrably exists and has been examined by an external auditor. That is materially more than an undocumented model, and it means the information exists in reviewable form even though none of it is public.

But this axis measures what a buyer can establish about the system, not whether someone has verified that documentation exists, and on that basis there is nothing. One capability figure is published and is worth pursuing, because it implies an underlying multilingual characteristic: operation in 110 languages across 116 countries. A vendor that can state a language count that precisely almost certainly holds per language performance data internally. Transcription and note accuracy by language would move both this axis and the governance assessment at the same time.

The two halves of this axis split cleanly here and the result sits just below the vendors graded above it. On whether customer content reaches third parties, the answer is unusually strong and stated categorically: no secondary use such as model training or commercialisation, clinical data never shared or sold, and residency specified by jurisdiction rather than as global boilerplate, with United States data held for United States users and Canadian information stored exclusively in Canadian data centres.

On who is actually in the chain, nothing. No foundation model provider, no model class or version, no hosting or cloud provider named anywhere, and no sub processor list located in two passes. That last point is what separates this from peers a grade higher, which name their clouds even when they will not name a model. One adjacent fact is worth recording without inflating the grade.

Certification to the artificial intelligence management standard requires a documented inventory of the systems in scope, examined by an external auditor, so the enumeration this axis asks for demonstrably exists in reviewable form. It is simply not public. That makes this a disclosure choice rather than an absence of governance, which is a materially different thing to tell a buyer, and it means the list is very likely obtainable in diligence. Ask for it, and ask which parties are covered by the residency commitment.

Volume is substantial and consistently reported at more than 2.5 million consults a week. Known product limits are unusually candid in third party review, including that the scribe does not adaptively learn a clinician's writing style and that multi problem visits document less reliably than single problem encounters. No published accuracy study against ground truth transcripts was retrieved.

This is the strongest protected health information posture in the ambient scribe category, resting on four commitments that are stated rather than implied. Audio is not stored, with clinician controlled and configurable retention limits on what does persist, which puts control of the retention window with the practice rather than the vendor.

The secondary use question is answered directly and broadly: data is never used for secondary purposes such as model training or commercialisation, and clinical data is stated never to be shared or sold. That closes the question several competitors leave open, and closes it wider than most by naming commercialisation alongside training.

Residency is regional and specific rather than global boilerplate, with United States data held for United States users and, in the clearest published example, all Canadian information stored exclusively in Canadian data centres. And privacy impact assessments have been completed across multiple Canadian provinces and territories, with examples available on request.

A privacy impact assessment is a jurisdiction specific analysis produced for a regulator or public body, and no other vendor in this index has been found to have done them, let alone offered them. Supported by SOC 2 Type II scoped to all five trust services criteria including privacy, which most SOC 2 claims in this category do not cover, alongside encryption in transit and at rest and audit logging.

HIPAA compliance is stated, but an organization wide Business Associate Agreement is reported as available only from the Practice tier upward. A BAA gated behind an upper pricing tier is a material procurement constraint for any US organization handling PHI, and buyers on lower tiers should not assume coverage.

The certification stack here is broader and more independently examined than anything else in this category. It covers ISO/IEC 27001:2022 for information security management, ISO 9001 for quality management, SOC 2 Type II scoped to all five trust services criteria including privacy where most SOC 2 claims in this category cover security alone, UK Cyber Essentials Plus, and ISO 42001, the AI management system standard, which the company states makes it the first ambient medical scribe to hold it.

No other vendor in this index holds ISO 42001, and it brings three year certification cycles with external audits and a documented corrective action policy. Supporting evidence sits alongside it: privacy impact assessments completed across multiple Canadian provinces and territories, with examples available on request, which is a jurisdiction specific artefact produced for regulators rather than for marketing and which no other vendor here has been found to have.

The engineering commitment that no audio is stored after transcription also stands, alongside stated ongoing monitoring, penetration testing and third party verification. One honest limit remains: no public trust centre with enumerable control detail or published audit dates was located, so certification currency cannot be checked without asking. Requesting current certificates and audit dates is worthwhile.

No FDA clearance, none claimed and none required for ambient documentation; the clinician reviews and finalises, and the signature is the control point. Two regulatory facts matter more than the grade here and are worth tracking. First, the scope has expanded well beyond scribing and is still moving.

The company launched Heidi Evidence, a clinical evidence querying product reported to be built with NICE, BMJ Group, MIMS and HealthPathways content, acquired AutoMedica to extend its platform, describes future receptionist workflows, and entered a revenue cycle management partnership.

Evidence querying is clinical decision support and lands in the territory occupied by dedicated clinical reference products; a receptionist product puts AI in contact with patients; and revenue cycle work touches reimbursement. Those are three different regulatory objects inside one platform, and a buyer should scope which are in contract.

Second, and more striking, the Heidi Evidence product is reported to have restricted its United Kingdom and European Union evidence querying to out of session use only during 2026, amid the same regulatory uncertainty that led another vendor in this index to withdraw from those markets entirely. If accurate, that is a materially more proportionate response than withdrawal. It was reported by a United Kingdom clinical newsletter rather than confirmed by Heidi, and is worth verifying directly.

Heidi states it is the first ambient medical scribe to achieve ISO 42001 certification, the international AI management system standard, and that is a categorically different artefact from anything else on this axis in this category. Most AI governance claims here are self published principles pages. ISO 42001 is an independently audited management system with defined controls and accountability, three year certification cycles, regular external audits and internal reviews.

The company describes an accompanying improvement policy requiring documented corrective actions with internal verification and executive participation, and states that where limitations are identified, governance processes guide corrective action. ISO 27001 is described as the foundational step toward it, and ISO 9001 is also held. Placed on the spectrum this index uses, that sits above a published but unaudited framework and below published measurement.

A further real commitment is that data is stated never to be used for secondary purposes such as model training or commercialisation. Held below the top grade for the reason every scribe falls short here: there is no bias or subgroup disclosure of any kind. No demographic or speaker group performance analysis, no error taxonomy and no published evaluation output.

A certified process for governing AI is not the same as a published result about how the AI performs, and for a product operating in 110 languages across 116 countries the absence of any performance breakdown by language or accent is conspicuous.

The grade rests on an externally audited management standard rather than on a commercial commitment, which is a third distinct route into this band alongside the regulatory floor and the published accuracy figure seen elsewhere in the index. Certification to the artificial intelligence management standard means an auditor has examined a documented system covering the artificial intelligence in scope, including inventory, risk treatment and control operation.

That is a falsifiable public claim with a named certifying body behind it, and a buyer can request the scope statement and see what was actually covered. Supporting it are data commitments that are categorical rather than hedged: data is never used for secondary purposes such as model training or commercialisation, clinical data is never shared or sold, retention is clinician controlled and configurable, and privacy impact assessments have been completed for multiple Canadian jurisdictions with examples available on request.

A completed assessment produced for a public body is an unusual artifact for a vendor of this size and it is evidence of a company willing to be examined. Held below the top grade for the reason this index applies to every certification. A management system standard certifies that processes exist and operate, not that outputs are correct.

It creates no obligation to the customer when a note is wrong, no accuracy commitment, no remediation duty and no indemnity, and none of those was located. The patient position is unchanged. Ask for the certification scope statement, and ask separately what the contract says when the output is wrong.

Push to chart integration with systems including Epic and Oracle Health exists but is gated to the Practice and Enterprise tiers; individual and lower tiers rely on templates and copy workflows. Capability is real but commercially restricted, which is a materially different buyer experience from natively embedded competitors.

The multi jurisdiction position is the best in this category by a clear margin. Where most competitors publish no residency statement at all, or a single country of storage, Heidi operates region appropriate residency as a design property: United States data held for United States users, and Canadian information stored exclusively in Canadian data centres.

Compliance is enumerated per jurisdiction rather than asserted generally, spanning HIPAA in the United States, GDPR in the European Union, NHS requirements in the United Kingdom, PIPEDA in Canada and the Australian Privacy Principles, with privacy impact assessments completed across multiple Canadian provinces and territories.

Scale is correspondingly wide: the company reports supporting more than two million patient consults weekly in 110 languages across 116 countries, and more than 18 million clinician hours returned across 73 million consults in an 18 month period.

The Canadian deployment is the most specifically evidenced, and it is public sector, which matters because those buyers impose procurement scrutiny commercial ones often do not: Ontario Health Teams, government funded community clinics, Primary Care Networks, Family Health Teams, regional health authorities and hospitals. Delivery is cloud based across web and mobile. Short of a perfect record only on the absence of a published implementation timeline, an uptime commitment and a subprocessor list.

The strongest pricing disclosure in the index. Real published tiers with amounts: a free tier with unlimited transcription, Clinician at $150 per user per month billed annually, an Evidence Plus tier reported near $40, plus Practice and Enterprise tiers. A buyer can determine cost without a sales call, which is what this axis rewards. Note that sources conflict on some tier amounts and pricing was restructured in February 2026.

Coverage is stated with unusual precision and breadth: 110 languages across 190 countries and more than 200 specialties. The language coverage in particular is the clearest differentiator in this category.