iRhythm Technologies

The service could not exist at its scale without the models, and the company's own history shows why.

The raw material is up to 14 days of continuous single lead electrocardiography per patient. That is on the order of a million heartbeats, and reading it manually is not a workflow inefficiency but an economic impossibility at the volumes this company operates. The algorithm classifies rhythms, and since a later clearance also detects individual beats, beat types and heart rates, so the machine performs the first pass across the entire recording and human technicians verify. Remove the model and the business model collapses rather than slows down.

The centrality is confirmed by trajectory rather than only by architecture. The company moved from machine learned to deep learned methods, states that average rhythm detection sensitivity has improved 21 percent since 2010, and describes successive clearances as extending artificial intelligence from rhythm classification down to beat level granularity. That is a decade of the product improving because the models improved.

The patch itself is genuine engineering, more than 50 percent lighter in its current generation with a breathable waterproof layer, and the company is candid that comfort drives adherence which drives data quality. Hardware here serves the model rather than competing with it.

Graded A. The one qualification is that this is explicitly a hybrid service, with qualified cardiac technicians verifying output before physicians see it, so the artificial intelligence is the engine rather than the whole vehicle.

The best documented human oversight design of any record built in this session, and it is structural rather than promised.

The architecture places two layers between the algorithm and the physician. The deep learned model performs the first pass across the full recording, qualified cardiac technicians verify the output, and only then does a physician receive a report. The company describes the algorithm as verified by technicians consistently across its material rather than presenting the artificial intelligence as autonomous, and it frames the model's role as triaging and prioritising the most clinically actionable findings so that expert human interpretation is used efficiently. That is the correct division: the machine handles volume, the human handles judgement.

The verification layer is a real cost the company chose to carry. Employing technicians to check machine output on every study is the expensive option, and a vendor optimising for margin would have removed it as the algorithm improved. Retaining it while publishing that the algorithm performs comparably to cardiologists is a deliberate decision to keep a human in the loop beyond the point where the accuracy argument alone would require it.

The outcome measure supports it. Ninety nine percent physician agreement with the end of wear report indicates the combined system produces output physicians accept, and the residual one percent is precisely where physician judgement is doing work.

What holds this from being complete is the absence of detail on disagreement. Nothing describes how often technicians override the algorithm, what happens when they do, or whether those corrections feed back into training.

Graded A.

The most complete model transparency in this index, and it exists because the company published its architecture in a journal rather than describing it in marketing copy.

The Nature Medicine paper is the disclosure. A peer reviewed publication describing a deep neural network for arrhythmia detection and classification contains architecture, training methodology, dataset construction and performance analysis at a level no vendor web page carries, and it is permanently available to any reader who wants to check the claim. Publishing the method in the open literature is the strongest form of model transparency available to a commercial vendor.

The company's own material adds specifics rather than adjectives. The model is described as structured in layers to form an artificial neural network, thirteen arrhythmia classes are enumerated, the progression from machine learned to deep learned methods is stated, the extension from rhythm classification to beat, beat type and heart rate detection is described as layered on top of the earlier capability, and the training corpus is quantified at more than 750 million hours.

The performance trajectory is disclosed with a number: average rhythm detection sensitivity improved 21 percent since 2010. A vendor publishing how much worse its algorithm used to be is unusual.

Geographic availability of the algorithm is disclosed in a footnote, and the human verification layer is stated rather than behind the artificial intelligence claim.

What is missing is versioning. Nothing describes how a customer knows which algorithm version produced a given report, or how changes are communicated, which matters on a cleared device improving continuously.

Graded A.

Training data is quantified, the technical lineage is published in the literature, and one partner is named, which together make this the strongest supply chain position in remote monitoring.

The training corpus is disclosed at more than 750 million hours of curated heartbeat data, described as the largest labelled electrocardiographic repository in the world. Crucially the provenance is inherently self evident rather than mysterious: the data came from the company's own service, patient by patient, patch by patch, over more than a decade. A reader knows exactly what the models learned from and where it came from, which is more than can be said for any other vendor in this index that has assembled a corpus at scale.

The method lineage is public through the Nature Medicine publication, so the architectural approach is traceable to a document with named authors rather than asserted.

One external dependency is named openly. The wrist worn product was developed and cleared with Verily, an Alphabet company, under a named software designation, so a buyer evaluating that product knows a second party is in it.

What is missing keeps this from an A. No framework, infrastructure provider or third party component is named for the core analysis pipeline, no model versioning is described, and the consent basis on which the training corpus was assembled is unaddressed, which is recorded on the stewardship axis and matters here too, since provenance that is technically clear can still be governed unclearly.

Graded B.

The deepest evidence base of any vendor built in this session, spanning a landmark algorithm paper, comparative effectiveness research and health economics.

The scientific anchor is Hannun and colleagues in Nature Medicine in 2019, establishing that a deep neural network could classify a broad range of arrhythmias at diagnostic performance comparable to cardiologists. Publication in that journal places the core claim in front of the most demanding review available, and it is the paper the rest of this field cites.

Around it sits a body the company states at more than 100 original research manuscripts. Named examples are not vendor white papers: comparative effectiveness of ambulatory cardiac monitoring strategies in the American Heart Journal, a Medicare beneficiary utilisation study, an assessment of variation in ambulatory cardiac monitoring published in a managed care journal, and work in an interventional electrophysiology journal. Comparative effectiveness and utilisation studies are harder evidence than accuracy studies for a buyer, because they address whether the strategy changes outcomes and cost rather than whether the algorithm agrees with a reader.

The operational figure is stated with its basis, 99 percent physician agreement with the end of wear report, described as drawn from a review of all online end of wear reports across three device generations. That is a census rather than a sample, though it is company held data.

One qualification belongs on the record. The company notes that a key comparative study is based on previous generation device data, with current devices deemed substantially equivalent, which is an honest footnote and a real limitation.

Graded A.

The training corpus is disclosed at a scale and specificity no other record in this index approaches, and the basis on which it was assembled is not described at all.

What is stated is remarkable and stated openly: more than 750 million hours of curated heartbeat data, characterised as the largest repository of labelled electrocardiographic patient data in the world, used to expand algorithm training and quality assurance. The company treats this as a competitive asset and says so, and quantifying a training corpus in hours rather than adjectives is disclosure most vendors avoid.

What is absent is everything about how it came to exist. Every one of those hours is a recording from an identifiable patient who wore a patch because a physician ordered a diagnostic test. Nothing published states the basis on which those recordings are retained after the clinical report is delivered, whether patients are told their data trains the algorithm, what de identification is applied before it enters the training set, whether patients or ordering physicians can decline, or what retention period applies.

This is the clearest example in this index of the mechanism by which a clinical service becomes a data business. Each patch returned improves the model that makes the next patch more valuable, which is a genuine virtuous circle for patients collectively and an unexamined question for each patient individually.

The curated description implies human labelling, which means technicians have reviewed the recordings, and nothing describes the controls around that access.

Graded C rather than lower because the disclosure of scale and purpose is real and voluntary, and the governance around it is entirely absent.

No published position was located, and this vendor holds more identifiable patient physiological data than any other record in this index.

The service is not software running in a customer's environment. Patients wear a patch, return it, and the recording is transmitted to and processed by the company, so iRhythm holds the raw continuous electrocardiography of every patient monitored, indefinitely enough to have accumulated more than 750 million hours of it. Reports flow back through a provider portal, electronic health record integrations and a patient facing application, so identifiable data moves in several directions across the company's infrastructure.

Nothing published addresses the terms. No business associate agreement is offered or described, no protected data handling summary exists, no retention position is stated for recordings after a report is delivered, and nothing describes the patient application's data practices.

The international dimension adds a second layer. Operating under four regulatory regimes means European data protection law, United Kingdom data protection law and Japanese privacy law all apply to parts of the business alongside the United States health privacy statute, and no cross border position is described.

As a publicly traded company, some risk disclosure exists in securities filings, which serves investors rather than patients or customers.

One consideration mitigates the practical impact without excusing the silence. A service of this scale, contracting with health systems and payers across four regions, has executed a great many agreements and passed a great many reviews, so the artefacts exist. They are not published, and a company holding the world's largest labelled electrocardiographic archive is the one most owing a public account of how it holds it.

Graded D.

No published security posture was located. No trust centre, no service organisation control report, no information security management certification, no penetration testing statement, no vulnerability disclosure policy, no subprocessor list and no incident notification commitment were found in anything examined.

The absence is more striking here than on most records because of the combination of scale, sensitivity and connectivity. This company holds the largest labelled electrocardiographic archive in the world, operates a provider portal and a patient mobile application, integrates with electronic health record systems, and manufactures a connected wearable cleared with a technology partner. Every one of those is an attack surface, and the archive is an asset of a kind that attracts serious attention.

Regulatory clearance across four jurisdictions means cybersecurity documentation exists in the technical files, since premarket cybersecurity expectations apply to connected medical devices in the United States and equivalent requirements apply in Europe and the United Kingdom. As a publicly traded company, cybersecurity risk disclosure also appears in securities filings and material incidents must be reported. Both are real accountability and neither is a customer facing security posture.

The patient application deserves specific mention. Consumer facing health applications are a well understood weak point, and nothing describes its security handling or what patient data it holds locally.

The pattern across this session repeats here at the largest scale yet: a company that has certainly passed hundreds of health system security reviews and publishes none of the resulting assurance.

Graded D on published evidence rather than on any judgement about the underlying engineering.

Four regulatory jurisdictions, a decade of successive clearances, and an honest footnote about where the artificial intelligence is actually available.

The coverage is documented rather than claimed: United States 510(k) clearance, CE marking, UKCA marking and Japanese approval. Each is an independent submission to an independent regulator, and four is more than any other record built in this session holds.

The clearance history shows a company that returns to the regulator as capability advances rather than stretching an old authorisation. Deep learned rhythm detection was introduced and clinically validated in 2019. Subsequent clearances extended artificial intelligence to beat detection, beat types and heart rates, described explicitly as sitting on top of the earlier rhythm capability. A newer patch received clearance with enhanced detection. The wrist worn product was cleared separately with Verily under its own software designation for atrial fibrillation detection and burden characterisation. Each capability step carried its own submission.

The procedure code detail is a further regulatory dimension worth noting, with the company stating that its thirteen arrhythmia classes were included in the code validation process, which connects the cleared indication to how the service is billed.

The disclosure that lifts this to an A is a footnote most vendors would omit: the deep learned algorithm is available only in the United States, European Union, Switzerland, United Kingdom and Japan. So the company sells devices in markets where its headline artificial intelligence does not run, and it says so in the same material that markets the algorithm.

Graded A.

Published peer reviewed performance and an honest account of algorithm evolution, with no subgroup analysis located.

What exists is better than most. The Nature Medicine work established performance against cardiologist readers in the open literature, so the core accuracy claim is externally reviewable rather than asserted. The company also publishes a longitudinal honesty most vendors avoid, stating that average rhythm detection sensitivity has improved 21 percent since 2010, which is an admission that earlier versions were materially worse and an implicit acknowledgement that performance is a moving property rather than a fixed one.

The scale of the training corpus is itself a partial mitigation. More than 750 million hours drawn from routine clinical use across four regulatory regions is likely to be more demographically and clinically varied than a curated research dataset, and the company frames the expansion as improving diagnostic accuracy and quality assurance.

What is absent is any breakdown. No performance figures by sex, age, ethnicity, body habitus or skin tone were located. That last one is not a generic concern here: an adhesive patch recording a single lead depends on skin contact and signal quality, and adhesion, sensor performance and signal to noise can vary with skin tone, body hair and body habitus. If signal quality varies systematically, so does the proportion of a recording the algorithm can classify, and nothing published examines it.

Atrial fibrillation prevalence also varies by ancestry, and no subgroup detection performance is published for a system whose primary clinical target is that arrhythmia.

Graded C.

No published liability position, and the service architecture allocates responsibility more clearly than most records in this index.

The allocation is structural. The algorithm produces a first pass, qualified cardiac technicians verify it, and a physician receives a report and makes the clinical decision. Three parties sit between the model and the patient, and the two humans are both accountable in their own right, the technician through the company's quality system and the physician through professional responsibility. That is a genuinely better position than a system delivering machine output directly to a clinician, and it means a missed arrhythmia is a failure of a reviewed process rather than of an unsupervised model.

Regulatory clearance in four jurisdictions adds manufacturer accountability with post market surveillance, adverse event reporting and recall powers attached, and that framework covers the algorithm as part of the cleared device.

The exposure that remains is specific to what this service does. A false negative means an arrhythmia present during the wear period was not reported, and the clinical consequence of a missed atrial fibrillation can be a stroke months later, by which time nobody connects the outcome to the report. That harm is delayed and effectively untraceable, which is exactly the kind that contractual recourse never addresses and post market surveillance struggles to detect.

Nothing published states accuracy commitments, indemnity, limitation, or what happens when a report is later shown to have missed a finding. The 99 percent physician agreement figure is a marketing claim rather than a committed threshold.

Graded C.

Integration is claimed at the level that matters for this service and is described without specification.

What exists is coherent and covers three audiences. A provider portal lets clinicians interpret reports and manage patients, with a mobile application for the same purpose. Electronic health record integration is stated as simplifying data collection and entry, enhancing interdisciplinary access and improving workflow efficiency, which is the right claim for a diagnostic service whose output needs to reach the chart rather than sit in a vendor portal. A patient facing application supports the wear period itself.

For a diagnostic service the interoperability question is narrower than for a platform, because the payload is a report and a set of coded findings rather than a continuous data stream, and the company appears to have built for exactly that. The connection between detected arrhythmia classes and procedure code validation suggests the output is structured for billing as well as for reading.

What is missing is every specific. No electronic health record system is named, no interoperability standard is cited, no application programming interface is published, and nothing describes whether the integration delivers a document, discrete coded results or both. Given the company operates across four regulatory regions with different record system landscapes, whether integration coverage is uniform is also unstated.

Against records elsewhere in this session that name four or six record systems each with its own integration page, this is asserted rather than evidenced.

Graded B.

Nothing published on hosting, region or residency, on a service whose entire architecture is centralised by design.

The deployment model is not in doubt even though it is undescribed. This is not software installed in a hospital. Patients wear a patch, the recording is transmitted to or returned to the company, analysis and technician verification happen on the company's infrastructure, and reports are delivered back through a portal, record system integrations and a patient application. So the vendor processes and holds the raw physiological recording of every patient, and the customer holds a report.

That centralisation is what makes the residency silence consequential. The company operates under four regulatory regimes across North America, Europe, the United Kingdom and Japan, and each has its own expectations about where health data may be processed and stored. European and United Kingdom data protection law govern transfers out of those regions, Japanese law has its own requirements, and nothing published states whether recordings from European patients are analysed in Europe, whether the technician verification workforce is regionally located, or where the training archive sits.

No hosting provider, region, subprocessor list, retention position or export term was located, and no availability commitment exists for a service that sits in a diagnostic pathway.

One related disclosure is relevant and points the other way. The company states the deep learned algorithm is available only in certain markets, which implies deliberate regional differentiation in how the service is delivered, and that differentiation is disclosed for capability and not for data handling.

Graded D.

No price is published and the reimbursement architecture is unusually visible, which places this above the pricing floor common in this index.

The substantive disclosure is that the service is reimbursed rather than sold. The company states that its thirteen detected arrhythmia classes were included in the procedure code validation process, and its published research includes Medicare beneficiary utilisation and managed care cost analyses. For a diagnostic service, the reimbursement code is the price in practical terms: a cardiology practice bills the payer and the economics turn on the code and the payer's rate, not on a vendor rate card. Publishing the code validation basis and the health economics literature tells a buyer more about the commercial reality than a list price would.

That also explains why no rate card exists and makes the absence less culpable than it would be for enterprise software. The buyer is a practice or health system whose real question is coverage and margin per study rather than licence cost.

What is still missing is anything a prospective customer could plan with. No per study cost, no device or patch cost, no service agreement terms, no volume arrangements and no statement of what the portal, electronic health record integration or patient application add. Nothing describes what a practice pays when a study is not reimbursed, which happens, and who carries that.

As a listed company, financial disclosure exists at aggregate level in public filings, which is transparency of a different kind and not a price a buyer can use.

Graded C.

Broad across geography, arrhythmia type, care setting and form factor, with the breadth evidenced by regulatory clearances rather than asserted.

Geographic coverage is the strongest element and it is documented through four separate regulatory regimes: United States clearance, CE marking, UKCA marking and Japanese approval. Four independent regulators is genuine international reach and each required its own submission.

Clinical coverage spans thirteen arrhythmia classes, detected across up to 14 days of continuous recording, which is materially longer than the 24 to 48 hour Holter monitoring it displaces and is the reason intermittent arrhythmias are caught at all. The clinical population reaches from diagnostic naive patients through to Medicare beneficiaries, both represented in the published research.

Care setting coverage is inherently broad because the patch is worn in ordinary life. Patients exercise, shower and sleep in it, so the recording spans the settings where arrhythmias actually occur rather than the clinic where they usually do not, and the company argues comfort drives adherence which drives data quality.

Form factor coverage extends further through the wrist worn product cleared with Verily for atrial fibrillation detection and burden characterisation, giving the company both a diagnostic patch and a longer term wearable.

Graded A.