PaceMate

A data aggregation and workflow platform with algorithmic triage inside it, materially less model driven than the Implicity record it competes with.

Most of what this platform does needs no model. Aggregating discrete device data including serial numbers, pairing it with electronic health record data, generating reports, tracking billing cycles, recovering missed charges and synchronising bidirectionally with three major record systems are integration and workflow problems, and they are where the company's most specific claims sit. The single most quantified capability on the record is that 98 percent of manual billing entry is eliminated, which is automation rather than intelligence.

The models are real and thinly described. Auto triage filtering is named as a workflow step, alerts are described as intelligently prioritised, and the company reports a 61 percent reduction in alert burden presented at a professional society meeting. Triage of that kind requires classification, so something is making judgements about which transmissions matter.

What is absent is any regulatory or technical substantiation of those models. No cleared algorithm was located, no algorithm is named, and no performance figure for the triage itself is published. Implicity holds three separately cleared algorithms with published sensitivity and specificity for each; this record has an outcome figure and no visible model behind it.

The consumer electrocardiogram integration is intelligence acquired rather than built, since the analysis of those recordings is performed by the partner whose platform supplies them.

Graded C.

The autonomy is a triage filter, the same shape as the competing Implicity record, and this one publishes far less about how it is bounded.

Auto triage filtering is named as a step in the workflow and alerts are described as intelligently prioritised, with a reported 61 percent reduction in alert burden. So the platform decides which transmissions reach a clinician, which carries the same asymmetric risk identified on the neighbouring record: a suppressed alert is an event nobody reviews, with no downstream reader positioned to catch it.

What is missing is the safety side of that tradeoff. No sensitivity figure is published, no false negative rate is stated, no description of what classification logic or clinical guideline the triage follows was located, and nothing describes whether filtered transmissions remain retrievable or auditable. Implicity publishes sensitivity of 98.3 percent alongside specificity of 61.6 percent and anchors its classification to published cardiology society recommendations; here a buyer has a reduction figure and no way to size what was removed with the noise.

One genuine oversight feature is documented and worth crediting. The one click sign and next capability keeps a clinician reviewing and signing each report, so the human remains in the loop on what does surface, and the company describes reducing click fatigue rather than reducing review.

The billing automation carries a second and quieter autonomy question. Auto generated billing scripts and continuous missed charge recovery mean the platform is initiating claims activity, and nothing describes what human review sits between an automated charge capture and a submitted claim.

Graded C.

Workflow and commercial mechanics are documented in detail, and the models are not described at all.

The documented side is genuinely good. Five procedure codes named individually, billing cycles of 31 and 91 days specified, bidirectional synchronisation with three named record systems, discrete device data captured down to serial numbers, a five step workflow from automated transfer through dashboard ingestion, triage, record integration and billing documentation, and interface details such as one click sign and next. A buyer can picture the product precisely.

The model side is a blank. Auto triage filtering is named without any description of what it is. No architecture, no method, no training data, no accuracy or sensitivity figure, no versioning and no update cadence were located for the triage function, and no algorithm is named at all. The one performance figure available, a 61 percent reduction in alert burden, describes an outcome rather than the model that produced it.

That gap is the sharpest contrast with the competing record. Implicity publishes intended use text verbatim, cites device classes and product codes, and gives sensitivity and false positive rate as fractions with denominators. PaceMate publishes procedure codes with the same precision and nothing equivalent about its intelligence.

The consumer electrocardiogram capability is transparent by attribution rather than description, since the analysis belongs to the named partner.

Graded D on the model dimension, which is what this axis assesses.

One upstream intelligence dependency is named clearly, and the platform's own models are undisclosed.

The named dependency is the AliveCor collaboration, described as first in market, integrating that company's KardiaPro platform to capture and triage electrocardiographic data from named six lead and single lead consumer devices. AliveCor is separately indexed here, so a reader can follow the consumer analysis to its developer's own record and assess the algorithms independently. Naming a partner whose intelligence appears inside your platform, rather than presenting the capability as your own, is proper disclosure and it is the strongest element on this axis.

The record system dependencies are also enumerated, with Epic, Oracle Health and athenahealth named for bidirectional integration, so a buyer knows which external systems hold and receive their data.

What is absent is the platform's own triage. No algorithm is named, no method described, no training data disclosed, and nothing states whether the triage models are built in house, licensed or derived from device manufacturer logic. For the capability that produces the headline 61 percent alert reduction, the supply chain is entirely opaque.

The research grade dataset raises a related question in the opposite direction: the company states outside parties use its dataset, so data flows outward to unnamed third parties, and none of those recipients is identified.

Graded C on the strength of the named partner and record system dependencies.

Operational evidence is strong and specific, clinical evidence is real but thin against the competing record.

The clinical element is a study presented at HRS 2026 reporting a 61 percent reduction in cardiac implantable device alert burden, presented by a named academic cardiologist. Presentation at the discipline's principal professional meeting with an identified academic presenter is credible, and the company has published a multi part discussion of the finding in context rather than only the headline. Further work was presented at the same meeting's health equity session by named clinical authors.

The operational evidence is where this record is strongest and it is unusually concrete. A published case study describes a health system's implementation, characterising electronic health record integration with athenahealth as effectively plug and play and clinician training at approximately 15 minutes each, with the deployment extended from implanted devices to ambulatory monitoring afterwards. Named commercial outcomes include 75 percent average billing capture within 90 days of go live and 98 percent elimination of manual billing entry. Those are the numbers a device clinic manager would actually test.

What is missing is diagnostic performance. A 61 percent reduction in alerts says how much noise was removed and nothing about what was removed with it, and no sensitivity figure was located anywhere. On the neighbouring Implicity record the equivalent claim is accompanied by sensitivity of 98.3 percent and specificity of 61.6 percent, so a reader can judge the tradeoff. Here they cannot.

Graded B.

One disclosure here is more commercially revealing than the company may intend, and the governance around it is absent.

The company markets what it calls the industry's only research grade dataset, aggregating data from cardiac devices and electronic health records, and states plainly that others use the dataset because no one else has built one like it. That is a vendor describing a secondary use business built on customer data, disclosed openly rather than concealed. It also explains the emphasis on capturing discrete device data down to serial numbers: a research grade dataset requires structured fields, not the summary documents manufacturer portals produce.

Nothing published describes the terms. No statement addresses whether customers consent to their patients' data entering the research dataset, whether it is de identified and to what standard, whether patients are informed, who the third party users are, whether the vendor is paid for access, or whether a clinic can decline while remaining a customer. For a dataset combining device telemetry with electronic health record data, the linkage itself is what makes de identification hard, because a longitudinal cardiac record with device serial numbers is close to uniquely identifying.

The ISO/IEC 27001 certification is relevant and does not answer this. Information security governs who may access data and how it is protected; it does not govern whether the data should be repurposed at all.

The consumer electrocardiogram integration adds a further undescribed path, since that data arrives through a partner platform under terms nobody states.

Graded C rather than lower because the existence and purpose of the dataset are disclosed voluntarily, and no governance is described.

The strongest published security certification in this session sits behind this record, and the contractual layer specific to protected data is still not published.

The certification is ISO/IEC 27001:2022, awarded by a named accredited certification body that is a member of the International Accreditation Forum, with the certificate number published so a reader can verify it with the issuer. That is verifiable assurance rather than an assertion, and it covers an information security management system spanning access management, cryptography, operational security, incident response and business continuity, audited independently and requiring continual improvement.

The company makes the comparison explicitly, arguing that the standard goes beyond health privacy statute compliance, which it correctly describes as a regulatory baseline, and beyond service organisation control 2, which it correctly describes as a domestic controls attestation. It names four competitors as relying on those instead. That is aggressive positioning and the technical characterisation is accurate.

The data flows are extensive: discrete device data including serial numbers, paired electronic health record data, bidirectional billing synchronisation with three major record systems, and consumer electrocardiographic data through a partner platform.

What is absent is the health privacy specific layer. No business associate agreement is offered or described, no protected data handling summary exists, no retention position is stated, and nothing describes what governs data flowing to or from the consumer electrocardiogram partner. An information security certification and a business associate agreement answer different questions, and this record has the first without the second.

Graded B.

The only verifiable independent security certification published in this session, and the company argues its significance correctly.

ISO/IEC 27001:2022 certification was achieved in June 2026 from a named certification body accredited by the national accreditation board and a member of the International Accreditation Forum, with the certificate number published. Publishing the certificate number is what converts a claim into something a security reviewer can verify with the issuing body rather than take on trust, and no other record in this session does it.

The standard is the right one. It certifies an information security management system covering access management, cryptography, operational security, incident response and business continuity, audited independently, with continual improvement mandated rather than a point in time snapshot. The 2022 edition is the current and most demanding version.

The company's own comparison is accurate rather than promotional. It characterises the health privacy statute as a United States regulatory baseline and service organisation control 2 as a domestic controls attestation, and positions the certification as internationally recognised and more demanding. Both characterisations are technically correct, and it names four competitors relying on the lesser credentials. Naming competitors is aggressive and it is checkable, which is the kind of claim a vendor only makes if it expects to survive the check.

The practical argument is also sound: enterprise procurement widely accepts this certification in place of custom security assessments, so the credential shortens the buyer's own work.

What is still absent is a trust centre, a vulnerability disclosure policy and a subprocessor list.

Graded A.

No device clearance was located, and the regulatory engagement that does exist is with billing rules rather than with a device regulator.

Nothing in the material examined indicates FDA clearance for any algorithm or for the platform. That may be a defensible position: a system that aggregates, displays and routes data supplied by already cleared implanted devices, without generating its own diagnostic determination, can sit outside device regulation, and the platform's own framing emphasises data management and workflow rather than diagnosis. The neighbouring Implicity record took the opposite path and cleared three algorithms, which shows the alternative was available.

The complication is triage. Auto triage filtering decides which device generated alerts a clinician sees, and software that filters clinical alerts is closer to the regulated boundary than software that merely displays them, particularly where suppression carries clinical consequence. Nothing published sets out the company's regulatory analysis, its intended use statement, or why the triage function sits outside device classification.

Where the company demonstrably engages with regulation is reimbursement. Five procedure codes are named, billing cycle rules of 31 and 91 days are built into the workflow, and annual code updates are maintained by the vendor, which is real regulatory competence applied to payment rules rather than to safety.

The ISO/IEC 27001:2022 certification is a further external assessment, of information security rather than of the device.

Graded C: a plausible but unstated position on device regulation, with demonstrated command of the billing regime.

Nothing was located. No model card, no training data description, no performance figures for the triage function, no subgroup analysis and no bias statement.

The absence is more notable here than on a comparable record because the company evidently has both the data and the analytical capability to address it. It markets a research grade dataset combining device and electronic health record data and states that outside parties use it, and clinical authors from the company presented at a health equity session at HRS 2026. So the raw material and the interest exist, and no performance breakdown has been published.

The mechanism worth naming is specific to alert triage in this population. Cardiac device patients are followed for years, and alert patterns differ by device type, by age, by comorbidity burden and by how engaged a patient is with transmitting, since patients who disconnect generate no alerts at all. A triage model tuned on the transmitting population may behave differently for patients with irregular connectivity, who are disproportionately older, poorer and more rural, and those are the patients least likely to have anyone notice a suppressed alert.

The consumer electrocardiogram integration adds a second population, since consumer device users are a self selected and generally more affluent group whose data now enters the same platform.

Graded D on the absence, with the note that the health equity presentation suggests the company is thinking about these questions internally without publishing on them.

Nothing published addresses responsibility for an automated outcome, and this record carries two distinct exposures rather than one.

The first is alert suppression, the same asymmetric risk as the competing record: triage decides what a clinician sees, a filtered alert is reviewed by nobody, and there is no downstream reader positioned to catch the omission. What makes it worse here is the absence of a published sensitivity figure. Implicity's customers can quantify their residual risk from published numbers; PaceMate's cannot, because only the reduction figure is public. A clinic accepting this filter is accepting an unmeasured false negative rate.

The second is billing, and it is unusual in this index. The platform automatically handles five procedure codes, tracks billing cycles, runs continuous missed charge recovery and eliminates 98 percent of manual billing entry through automated scripts. Automated charge capture in a federally reimbursed service is an area where errors are not merely commercial: overbilling exposes a practice to recovery demands and, in the wrong circumstances, to false claims liability. The practice submits the claim and carries that exposure. Nothing published describes accuracy commitments for automated coding, what human review sits between capture and submission, or where responsibility falls if a systematic coding error is later identified across a customer base.

No indemnity, limitation, performance warranty or service level was located for either exposure.

Graded D.

The deepest record system integration in cardiac remote monitoring, and it is evidenced rather than asserted.

Three major record systems are named for bidirectional integration: Epic, Oracle Health and athenahealth. Bidirectional matters and the company is specific about what flows: device data pairs with record data in the platform, and billing data synchronises back. Most vendors in this index claim integration in one direction and describe it generically.

The evidence is a published implementation account rather than a claim. A health system describes the athenahealth integration as effectively plug and play, notes that record integration is typically complex, and reports subsequently extending from implanted device monitoring to ambulatory monitoring on the same platform. An identified customer describing an integration as easier than expected is stronger than a vendor asserting it is easy.

Device side interoperability is the second dimension and is claimed broadly, with all device types on one platform and discrete data captured down to serial numbers rather than parsed from summary documents. The scope extends beyond implanted devices to ambulatory event monitoring, heart failure monitoring and, through the AliveCor collaboration, consumer electrocardiographic devices, so several data classes that normally require separate systems arrive in one.

The caveat recorded on the coverage axis applies here too: a competitor disputes the multi manufacturer claim and the company does not enumerate supported manufacturers, so the device side breadth is less well evidenced than the record system side.

Graded A on the record system integration, which is documented, bidirectional, named and independently described.

The delivery model is described with unusual clarity on the service dimension, and hosting specifics are absent.

What is disclosed is the operating model rather than the infrastructure. The platform is cloud based with no local installation, and the company offers a range of delivery options described as self service, periodic support or a fully tailored solution. That last distinction matters more than it appears: a device clinic can run the platform with its own staff, or effectively outsource monitoring review, and those are very different arrangements with different implications for who touches patient data. Stating the range up front is helpful and rare.

Implementation evidence supports it, with a published account describing onboarding as straightforward and clinician training at around 15 minutes each.

What is absent is every hosting specific. No cloud provider is named, no region, no residency option, no subprocessor list, no retention position and no export or contract end terms were located. The neighbouring Implicity record names its cloud provider and is available through that provider's marketplace; this one does not.

Two elements make residency non trivial here. The research grade dataset implies data aggregated and retained beyond individual customer instances, and nothing describes where that consolidated dataset lives or how it is segregated from operational data. And the consumer electrocardiogram integration brings data through a partner platform whose own hosting is a separate question.

The ISO/IEC 27001 certification implies documented asset and supplier management internally, without publishing any of it.

Graded C.

No price is published and the revenue side is documented more thoroughly than any other record in this session.

The billing disclosure is the substance and it is specific to a degree vendors rarely attempt. Five remote monitoring procedure codes are named individually. The 31 day and 91 day billing cycles that determine when a transmission becomes billable are described as tracked in the workflow, with patients surfaced before the window closes. Missed charge recovery is described as continuous rather than on request. Annual code updates are maintained by the vendor rather than by the customer. Billing data synchronises bidirectionally with three named record systems. Two outcome figures are attached: 75 percent average billing capture within 90 days of go live and 98 percent of manual billing entry eliminated.

For a device clinic that is the commercial case stated in the terms the buyer uses. Remote monitoring revenue is lost through missed cycles and undocumented review rather than through poor rates, so a platform quantifying capture improvement is selling against a gap the clinic can measure in its own data before signing.

What is missing is the cost side entirely. No per patient or per clinic price, no platform fee, no module structure, no implementation cost, no contract term and no minimum. The company describes flexible options across self service, periodic support and fully tailored delivery, which is a service model description without any pricing attached to the tiers.

Graded B: the strongest revenue side transparency in this session, no price.

The broadest claimed coverage in cardiac remote monitoring, with a genuine conflict in the evidence about whether it holds.

The claim is comprehensive and coherent. The company describes covering implantable cardiac devices, ambulatory event monitoring, heart failure monitoring and consumer electrocardiograms on one platform, which would follow a patient from a wearable bought over the counter through to an implanted defibrillator without changing systems. The AliveCor collaboration substantiates the consumer end specifically, bringing six lead and single lead device data into the same workflow, and the company describes this as first in market. A published case study confirms the implanted to ambulatory extension in practice at a named health system.

The conflict concerns manufacturer coverage. The company's own material claims all device types on one platform. A competitor's published comparison characterises the platform as built for one manufacturer's devices and describes fragmented workflows in multi manufacturer populations. That source is plainly interested and its account cannot be dismissed on that basis alone, because manufacturer neutrality is the single most consequential coverage question in this market and the company does not enumerate the manufacturers it supports anywhere located, where the competing Implicity record names all five.

A buyer should resolve this directly and specifically, by asking which manufacturers are supported at discrete data level rather than through document import.

Graded B: exceptional breadth across monitoring types, unverified breadth across manufacturers.