AI Agents for Cardiology PracticesRPM, Device Data and Documentation in 2026

Most automation advice written for medical practices assumes one calendar with slots in it. Cardiology does not work that way, and every implementation that treats it as though it does fails in the same place.

A cardiology practice runs three schedules simultaneously. There is a physician clinic, which is the smallest part of the calendar relative to the work it generates. There is a diagnostic testing schedule — echocardiography, stress testing, nuclear and CT imaging — constrained by equipment, by technologist availability, and by patient preparation requirements, with very high no-show sensitivity because a missed nuclear stress test wastes a dose and not merely a slot. And there is a device clinic, whose appointments are not appointments at all. They are transmissions, and they arrive whether or not anyone is rostered to receive them.

The three schedules a cardiology practice runs concurrently. Frenchy Digital operational framing.

Add a fourth pressure that is easy to miss on an org chart: a large share of cardiology's ambulatory volume is transition-of-care follow-up after a hospitalization the practice did not schedule and often did not know about. Demand arrives from outside the building, on someone else's discharge timeline.

There is one piece of long-standing evidence about physician time that is worth citing here precisely because cardiology is inside its sample, and worth citing carefully because it is old. Sinsky and colleagues, publishing in Annals of Internal Medicine in 2016, observed that for every hour of direct clinical face time, physicians spent nearly two additional hours on EHR and desk work. The study observed 57 physicians across 430 hours in four specialties — family medicine, internal medicine, cardiology and orthopedics — in four states, with 21 physicians keeping after-hours diaries that showed one to two hours nightly. The authors themselves note the data came from self-selected, high-performing practices and may not be generalizable. It is a 2016 study. We cite it as the origin of a number everyone repeats, not as a current measurement, and we would encourage you to do the same.

Everything that follows in this article concerns administrative and documentation workflows under explicit human governance. Nothing here proposes that software make a clinical decision. The boundary is not a philosophical preference; it is statutory, and section four of this article maps it precisely.

The thing outsiders get wrong about remote patient monitoring is that they see a data problem and assume more data is better. Billing-wise the opposite is closer to true. RPM pays on calendar-month episodes with day and minute thresholds, and the 2026 restructure made those tiers explicitly mutually exclusive rather than additive. A practice that collects transmissions without tracking, per patient per month, how many days of data arrived and how many minutes of management time were documented cannot bill correctly at any volume.

The scarce resource is documented clinician time. It is not device data.

The 2026 remote physiologic monitoring code structure. Descriptors are summarised; exact CPT descriptor language is copyrighted, and CMS states it is adopting all descriptors, guidelines, prefatory language and parenthetical changes made to the Remote Monitoring section of the 2026 edition of the CPT codebook.

The combination rule is the part that breaks spreadsheets. CMS spells it out, verbatim:

The 2 to 15 day codes (99445, 98984, 98985, and 98986) and 16 to 30 day codes (99454, 98976, 98977, 98978) are not additive and are not a base and add-on code structure. Billing practitioners would only bill for one of those codes for the appropriate number of days of data transmission per 30 days. In addition, the treatment management services describing the first 10 minutes (99470 and 98979) and first 20 minutes (99457 and 98980) are also not additive. Billing practitioners would choose the most appropriate code for the time spent that calendar month. In instances where more than 20 minutes of treatment management is needed after either 99457 or 98980 is billed, 99458 or 98981 can be used.

— CY2026 Medicare Physician Fee Schedule final rule, 90 FR 49396–49397

Read that as an engineering specification, because that is what it is. Per patient, per calendar month, you need two counters and one decision: days of transmission resolving to exactly one code, and documented management minutes resolving to exactly one base code plus zero or more add-ons. That is a state machine, and it is precisely the kind of arithmetic an agent should be doing over data your chart already holds.

There is a second fact about these codes that almost nobody reports, and it should shape how much capital you sink into an RPM programme this year. The rule states that none of the RPM codes — 99091, 99474, 99470, 99457 and 99458 — met the minimum survey requirements established by the RUC, that the RUC recommended they be resurveyed after one year, and that all RPM codes are expected to be reviewed at the January 2028 RUC meeting. The 2026 valuations rest on inadequate survey data and are scheduled to move. Plan for revaluation; do not build a five-year model on a two-year price.

One more structural fact worth having on the whiteboard: cardiology sits in the heart failure cohort of the Ambulatory Specialty Model, a mandatory Innovation Center model running five performance years from January 1, 2027 through December 31, 2031, with a threshold of 20 or more attributed episodes from the relevant episode-based cost measure in the eligibility year. It carries two-sided risk and is scored partly on meaningful use of certified EHR technology — which is the one place where an interoperability and agent story legitimately attaches to a payment model rather than merely to internal efficiency. Note that the ±9 percent figures in the rule text describe MIPS, not the ASM; do not let a vendor attribute them to the model.

This is the question a cardiology practice must answer before it buys anything, and it has a sharper legal edge here than in any other outpatient specialty. The reason is that cardiology's highest-volume data is a signal, and federal law treats signals differently from text.

Start with what is unambiguously permitted. 21 U.S.C. §360j(o)(1)(A) excludes from the device definition, by statute, software intended for

administrative support of a health care facility, including the processing and maintenance of financial records, claims or billing information, appointment schedules, business analytics, information about patient populations, admissions, practice and inventory management, analysis of historical claims data to predict future utilization or cost-effectiveness, determination of health benefit eligibility, population health management, and laboratory workflow

— 21 U.S.C. §360j(o)(1)(A)

That sentence covers scheduling the echo, checking eligibility, assembling the prior-auth packet, tallying transmission days, building the recall list and assembling the monthly documentation packet. An agent doing those things is outside the device definition by statute, not by FDA grace. That distinction matters, because grace can be withdrawn.

Now the other side. §360j(o)(1)(E) governs software that supports or provides recommendations to a clinician, and it is available only if the function is not intended to acquire, process or analyze a medical image, an in-vitro diagnostic signal, or a pattern or signal from a signal acquisition system. Cardiac telemetry is a signal from a signal acquisition system. An implantable device stream is a signal from a signal acquisition system. Software that analyses one of those is a device, and there is no enforcement discretion pathway around it.

FDA sharpened the boundary in its 2026 Clinical Decision Support guidance with a clarification that is directly on point for remote monitoring: discrete, episodic or intermittent point-in-time physiological measurements — routine vital signs obtained at discrete clinical encounters is FDA's own example — generally do not, by themselves, constitute a pattern. Streaming or continuous measurement does. A blood pressure cuff reading uploaded once a day is on a different side of that line from a continuous rhythm strip, and your architecture should reflect it.

FDA also moved automation bias and time-criticality into the Criterion 4 analysis in 2026. In its own words at the March 2026 town hall, FDA considers both the level of automation and the time-critical nature of the clinician's decision making when determining whether the clinician can independently review the basis for a recommendation, and it defines automation bias as the propensity of humans to over-rely on a suggestion from an automated system, producing errors of commission or of omission. Read the qualifier carefully: these are considerations FDA weighs, not a test that settles the question. In every device example in the guidance that turns on time-criticality, the time-critical workflow is paired with a specific or directive output. A list of options surfaced under time pressure is not automatically a device.

The defensible design conclusion, written as analysis rather than as a rule: the more autonomous and the more time-pressured the workflow, the harder it becomes to claim the clinician is independently reviewing anything. An agent that surfaces a recommendation inside a thirty-second decision is in worse regulatory shape than the same recommendation surfaced in an asynchronous inbox. In a device clinic, that argues for asynchronous review queues over real-time interruptive alerts, on regulatory grounds as well as clinical ones.

There is one more federal duty that catches remote monitoring specifically and is routinely missed. 45 CFR §92.210 prohibits discrimination through the use of patient care decision support tools, and imposes an ongoing duty to make reasonable efforts to identify tools that employ input variables measuring race, colour, national origin, sex, age or disability, and to mitigate the resulting risk. It applies whether or not the tool is AI and whether or not FDA calls it a device. An RPM risk-stratification model with age or sex as an input is squarely inside that inventory duty. Reported compliance date is May 1, 2025; the rule appears in the current CFR as of August 2026, and we make no assertion about any pending challenge to it.

Diagnostic scheduling in cardiology is not slot-filling. It is a constraint-satisfaction problem with four dimensions that most scheduling software collapses into one.

• Equipment: The nuclear camera, the treadmill and the echo machine are separate resources with separate throughput. A slot is not a slot.
• Staff: Sonographers, nuclear technologists and stress-test supervision are distinct credentials. Availability is the binding constraint far more often than room time.
• Preparation: Fasting, caffeine restriction, beta-blocker holds and medication timing all have to happen before the patient arrives, on the patient's side of the wall where you have no direct control.
• Authorization: Advanced imaging is frequently authorized through a delegated benefit manager on a different timeline from the clinical decision that prompted it.

The no-show economics are also different from a clinic visit and are the reason this workflow justifies its own agent. A missed nuclear stress test does not merely leave a slot empty — it wastes a dose. The unit of loss is consumable, not just temporal.

This is the moment to name a number we will not print. The medical-practice AI market runs on a figure of roughly two hundred dollars per no-show, frequently paired with an annual national loss figure in the hundreds of billions. Both trace to a single 2017 byline written by the chief medical officer of a scheduling vendor, with no published methodology. We chased it and refused it in an earlier cluster and we refuse it here. It is not that the number is too high or too low; it is that no one can tell you what it measures. If a vendor builds your business case on it, ask for the methodology and watch what happens. The same applies to every phone-abandonment benchmark used to sell voice agents — the seven-percent-abandonment and eighty-five-percent-never-call-back figures have the same problem.

Your own number is obtainable and better. Count completed studies against scheduled studies by modality for three closed months, price the consumable waste for nuclear separately from the staffed-time waste for echo, and you have a defensible baseline that also happens to be the exit criterion for Phase 2 of the implementation path below.

On prior authorization, one regulatory clarification saves a lot of wasted effort. CMS-0057-F binds payers, not practices. Every obligation in 42 CFR §422.122 runs to a Medicare Advantage organization. Live in 2026: a specific reason for denial regardless of communication channel, decision timeframes of 7 calendar days standard and 72 hours expedited under §422.568 and §422.572, and public reporting of prior-auth metrics. The FHIR prior-authorization API is a January 1, 2027 obligation on the payer. Commercial and ERISA plans are not covered at all. If your imaging authorization pain is commercial, this rule changes nothing for you — and a vendor selling you a CMS-0057-F readiness project for a commercial book is selling you a rule that does not apply.

This is the single most important architectural fact in this whole subject area, and it is the one most consistently omitted from vendor conversations. ASTP/ONC's certification companion guide for 45 CFR §170.315(g)(10), the standardized API criterion every certified EHR must meet, states it plainly:

The § 170.315(g)(10) certification criterion requires Health IT Modules to support API-enabled ‘read’ services for single and multiple patients. … These services specifically exclude ‘write’ capabilities, where authenticated and authorized third-party applications would be able to create or modify EHI through a secure API.

— ASTP/ONC — Standardized API for Patient and Population Services, certification companion guide

Certified API access is read-only. Every write an agent performs into your EHR — booking the slot, filing the note, posting the charge, updating the device-clinic record, adding to the problem list — happens through one of exactly three mechanisms, and none of them is a certification right:

1. 1.A vendor-discretionary write API: A commercial arrangement with your EHR vendor, on that vendor's terms, subject to its app-review process, often with per-transaction fees and its own upgrade cadence.
2. 2.UI automation: Robotic process automation or a browser push driving the interface a human would drive. It works until the interface changes, and it fails quietly when it does.
3. 3.A human: Copy-paste, or a staff member executing the action the agent prepared. Slower, and the only one of the three with a clean audit story by default.

Read-only-by-default is also, and not coincidentally, the strongest security control available to you, and it is free. An agent that cannot write cannot be manipulated into writing.

One live regulatory watch item, stated as what it is. ASTP/ONC published a proposed deregulatory rule on December 29, 2025 that would, among other things, remove the clinical decision support certification criterion and reserve §170.315(a)(9). Comments closed February 27, 2026 and we located no final rule. It is a proposal. Nothing in it is binding, and nothing in it changes the read-only scope of (g)(10) today.

Ranked on verifiable attributes as checked on 2026-08-12. Accuracy is excluded by design — see the methodology block above.

Corporate record and contract risk. Funding figures are as announced by the company or as reported by named outlets; where a valuation is trade-reported rather than company-stated, we say so.

Two vendors on this list legitimately span categories. Commure sells autonomous coding and revenue-cycle automation alongside documentation, and Abridge ships coding and revenue-cycle features. We rank both here, in documentation, and point you to our companion article on prior-authorization and revenue-cycle automation for the other half of the evaluation, so that the two rankings stay distinct rather than double-counting the same vendor.

This section exists because the gap between what was measured and what gets quoted is, in this category, enormous. Clinician burnout and clinician satisfaction are not accuracy. Time in note is not accuracy. Star ratings are not accuracy. A customer-satisfaction ranking is not accuracy. Every headline claim in this market is one of those things.

The independent and quasi-independent evidence base for ambient documentation, as of August 2026.

Three readings from that table deserve to be stated in plain language, because they are the ones vendors do not volunteer.

First: the strongest evidence in the category found the market-leading enterprise product produced no statistically significant reduction in note-writing time. The UCLA trial randomized 238 outpatient physicians across 14 specialties into three arms. Nabla achieved −9.5% on the primary endpoint (95% CI −17.2% to −1.8%; P=0.02). DAX achieved −1.7% (95% CI −9.4% to +5.9%; P=0.66). One of those crosses zero comfortably. That is not an argument against ambient documentation — it is an argument for measuring your own deployment rather than assuming the category's marketing applies to you.

Second: read the secondary outcomes with their intervals, not as point estimates. On the UCLA trial's well-being measures, DAX's physician task load (−39.9; 95% CI −71.9 to −7.9) and work exhaustion (−0.32; 95% CI −0.55 to −0.08) intervals exclude zero. Nabla's corresponding intervals (−31.7; 95% CI −63.8 to +0.4 and −0.23; 95% CI −0.46 to +0.01) include it. Both products improved the Mini-Z score with intervals excluding zero. Presenting only the point estimates reverses which product looks better on well-being versus on time, which is exactly why both sets of numbers belong in any honest comparison.

Third: the study most often cited as proof that ambient AI cuts burnout is a pre/post survey with vendor executives among its authors. The JAMA Network Open multicentre study reports burnout falling from 51.9% to 38.8% (aOR 0.26; 95% CI 0.13–0.54) across 263 clinicians at six health systems. It is a quality-improvement study, not randomized. Note accuracy was not measured. One author was senior director of clinical success at the vendor, another was its chief clinical officer during the study, and a third sat on its research advisory committee. That does not invalidate the finding. It does mean the finding should never be introduced as though it were an independent trial.

One more, on the Wisconsin trial, because it is a small lesson in reading abstracts honestly. Work exhaustion and disengagement fell by 0.44 points (95% CI −0.62 to −0.25; P<0.001) — a real result. Professional fulfillment rose 0.14 points (95% CI 0.004 to 0.28) with a nominal P of 0.04, and the authors themselves characterise that as nonsignificant. We print their characterisation, not our own reading of the P value. The vendor is not named in the abstract, so we cannot tell you which product produced either result.

A short list of category figures we chased and will not print: a hallucination rate of roughly one to three percent across leading systems, and a variant claiming approximately seven percent — both appear only in SEO aggregator blogs with no citation to any study. Thirteen to sixteen minutes saved per day, and a thirty-one percent reduction in burnout — aggregator summaries with no attached study. The real, citable numbers are the ones in the table above. And the widely quoted hours-saved figure from the largest deployment evaluation is a model output produced by the deploying health system's own programme evaluation, not a controlled measurement; it is usable with that framing and never as “studies show.”

Documented failure modes: omissions, negations and hallucinated content.

The popular fear about AI documentation is fabrication. The measured reality is that omission is the dominant failure mode, and omission is worse, because it is far harder to catch.

• Omissions dominate: 76.3% of errors in the OHSU and MedStar five-platform evaluation were omissions, with medication errors the most common single type. In the MedStar instrument-validation study, omissions were 83% of one product's errors and 54% of the other's.
• Why omissions are the hard class: The authors state it directly: catching an omission requires the clinician to recall a detail from the encounter that the note simply does not mention. Every other error type puts something wrong on the page for a reviewer to notice. An omission puts nothing there.
• Errors propagate: Roughly 19.5% of raw transcription errors survived into the finished note (95% CI 6.6% to 28.8%). The transcript layer and the note layer are not independent.
• Harm potential is measurable and non-trivial: A mean of 3.0 errors per simulated case had potential to cause moderate-to-severe harm (95% CI 0–4, range 0–21 across cases). Print both intervals as the paper does; the 0–21 is the observed range, not a confidence interval.
• Platform choice changes the chart: Only 35.8% of key clinical elements were captured correctly by all five platforms tested. Which product you buy materially changes what ends up in the record.
• Negation errors — the cardiology-specific danger: The UCLA trial explicitly named negation-detection errors alongside omissions and pronoun-resolution failures. In a cardiac review of systems, a dropped 'no' inverts the record: no chest pain becomes chest pain, denies syncope becomes syncope.
• Speaker attribution fails in crowded rooms: Pronoun-resolution failures in the UCLA trial; difficulty tracking multiple speakers in the largest deployment's quality-assurance programme. Cardiology encounters very often include a spouse or adult child. Assume this failure mode applies to you.

There is a further failure mode that has no reliable detection signal, and we would rather say so than sell you a control that does not exist. Prompt injection is unsolved. A controlled simulation published in JAMA Network Open in December 2025 ran 216 evaluations across twelve clinical scenarios and found injection attacks achieved 94.4% success at turn four and persisted in 69.4% of follow-ups, with extremely high-harm scenarios including FDA Category X pregnancy drugs succeeding in 91.7% of dialogues. A proof-of-concept against flagship models showed 100% vulnerability for two of them across five dialogues each and 80% for a third. The caveats matter: it is a controlled simulation rather than field data, the main experiment used lightweight models with only a small proof-of-concept on flagships, and three co-authors disclose company roles.

Worse for the standard mitigation story, work published in Nature Communications in February 2025 ran 594 attacks against four vision-language models in oncology and found all of them susceptible, with sub-visual prompts embedded in medical imaging data causing harmful output while remaining non-obvious to human observers. A human-in-the-loop who cannot see the injection cannot review it away. Pair that with FDA's own automation-bias language and “we have a human in the loop” stops being a complete answer.

For a cardiology practice the exposed channels are inbound faxes, referral PDFs, portal messages and payer or device-manufacturer portals — unauthenticated text entering a system that treats text as instruction. We should be honest that this is reasoning by extension: we found no published study of prompt injection via patient portal messages, referral faxes or payer portals in a live practice. The absence of evidence is itself the reportable fact. Treat mitigation as blast-radius reduction — least privilege at the API boundary, read-only by default, unique agent identity, audit controls, out-of-band confirmation for irreversible actions — and refuse any vendor's injection-detection accuracy rate, because no independent benchmark for clinical prompt-injection defence exists either.

If you read one section of this article before signing anything, read this one. Everything else is engineering. This is the part that determines who is personally liable when a note is wrong.

CMS has answered the question directly, in a document that names artificial intelligence explicitly. Medicare Program Integrity Manual, Chapter 3, §3.3.2.4, on signature requirements:

NOTE: When a scribe is used by a provider in documenting medical record entries (e.g., progress notes), CMS does not require the scribe to sign/date the documentation. The treating physician/non-physician practitioner's (NPP's) signature on a note indicates that the physician/NPP affirms the note adequately documents the care provided. We note this type of practitioner concurrence is also required when using Artificial Intelligence (AI) technology to capture the transcription of medical record entries.

— CMS Medicare Program Integrity Manual (Pub. 100-08), Chapter 3, §3.3.2.4

That single note is the whole ambient-documentation compliance story. The AI does not sign, and its non-signature is fine — because the practitioner's signature is doing the attesting for both. An AI scribe has the documentary status of a human scribe: it drafts, the clinician authenticates.

The same section closes every workaround. Reviewers shall not consider attestation statements from someone other than the author of the medical record entry in question — explicitly including cases where two individuals are in the same group, where one should not sign for the other. Contractors shall not consider attestation statements where there is no associated medical record entry. And an attestation cannot be used to backdate a plan of care. On electronic signatures, the individual whose name is on the alternate signature method and the provider bear the responsibility for the authenticity of the information attested to.

CMS even publishes a model attestation statement, and its wording tells you everything about where liability sits. It is first-person, it is credentialed, and it ends: “I do hereby attest that this information is true, accurate and complete to the best of my knowledge and I understand that any falsification, omission, or concealment of material fact may subject me to administrative, civil, or criminal liability.” Note the word omission in a statement signed by a physician about a note drafted by a system whose dominant failure mode is omission. That is not a coincidence you can contract away.

Two related boundaries follow from the same principle. There is no “incident to” pathway for AI-performed work: 42 CFR §410.26(a)(1) defines auxiliary personnel as any individual acting under supervision who has not been OIG-excluded and who meets applicable state licensure requirements. Software is not an individual, cannot be excluded, and cannot hold licensure. Whatever an agent does is either an administrative task requiring no licensure, or a task whose professional component was performed by a named licensed human. And artificial entities have no professional powers at all — California Business & Professions Code §2400 states that corporations and other artificial legal entities shall have no professional rights, privileges, or powers, with §2052(b) extending unlicensed-practice liability to anyone who aids or abets. The exposure never lands on the agent. It lands on the practice and on the individuals who deployed it.

Layer on the state disclosure duties that are already in force, because they attach to the practice rather than to the vendor. California's AB 3030, effective January 1, 2025, requires a generative-AI disclaimer and human-contact instructions on communications pertaining to patient clinical information — with two exits that matter operationally: the requirement does not apply if the communication is read and reviewed by a licensed or certified human provider, and “patient clinical information” expressly excludes administrative matters including appointment scheduling and billing. So your appointment-confirmation agent needs no disclaimer; an agent answering “should I be worried about this palpitation?” does, unless a licensed human read it first. Texas HB 149 §552.051(f), in force since January 1, 2026, is broader on its face: where an AI system is used in relation to health care service or treatment, the provider must disclose to the recipient no later than the date the service is first provided, with no human-review exemption written into it. Texas SB 1188 §183.005 permits practitioners to use AI for diagnostic purposes provided they act within their licence regardless of the use of artificial intelligence, review all records created with AI, and disclose the use. Those five words — regardless of the use of artificial intelligence — are the entire doctrine. The licence, and therefore the liability, does not move. And California's AB 489, effective January 1, 2026, makes it a per-use violation for AI to hold itself out with terms implying a health-care licence: naming your intake agent “Nurse” anything is a violation each time it is used.

Every implementation needs this written down before the first line of code, signed by the medical director and the compliance lead, and enforced in configuration rather than in a policy binder. Clinical judgement, billing attestation, and anything with legal or safety consequence stay human. Here is the cardiology version.

Human-in-the-loop boundaries for a cardiology practice. Authorities are cited so you can defend each row to an auditor rather than to a vendor.

Three implementation notes about this table, learned the expensive way.

The agent needs its own identity. 45 CFR §164.312(a)(2)(i) makes unique user identification required, not addressable, and §164.312(a)(1) requires access policies allowing access only to those persons or software programs granted access rights — the rule already contemplates software as an access principal. A shared service account that makes agent actions indistinguishable from a human's is the specific compliance failure to design out. It also makes the audit-log review in Phase 6 impossible, which means you would not detect the failures in the next section either.

Minimum necessary applies to context windows. 45 CFR §164.502(b)(1) requires reasonable efforts to limit PHI to the minimum necessary for the intended purpose, and the treatment exception at §164.502(b)(2)(i) does not cover a billing, scheduling, prior-auth or quality-reporting agent. Retrieval context assembled for an RPM billing agent is not a treatment disclosure. “Dump the whole chart into the context window” is the practice this rule reaches.

The business associate chain does not stop at the app vendor. Under 45 CFR §160.103 a model provider processing PHI is a business associate, the agent framework in front of it is a business associate, and the model provider's own cloud host is a subcontractor business associate requiring a downstream BAA. A single BAA with your scribe vendor does not close that chain. And §164.502(a)(3) limits a business associate to uses permitted by its contract — that is the clause a “we improve our models using your data” term collides with. Ask for the sub-processor list in writing. One major vendor's trust centre lists a foundation-model provider as a data sub-processor; that is a fact you want to know before signature, not after.

One last honest note about the whole concept. “HIPAA-compliant AI” is not a product property. HIPAA attaches duties to covered entities and business associates, never to software. There is no OCR guidance defining a compliant AI product — every checklist claiming otherwise that we examined was a vendor blog. Rewrite the phrase in your own documents as “used under a BAA, with these named controls,” and you will immediately be able to tell which vendors can answer and which cannot.

This is the reason the article exists. Not a list of benefits — an order of operations, with an owner per phase, an entry criterion, an exit criterion, and a written answer to what you do when the phase fails. Weeks overlap deliberately; the dependencies, not the calendar, are what matter.

The sequencing principle is simple and it is the opposite of how most practices buy: start with the ledger, not the scribe. The RPM threshold ledger is pure read-and-reason work, needs no write access, produces a number your CFO can verify against a manual count, and tells you within five weeks whether your data is even in a computable state. The scribe is the workflow with consent exposure, an attestation surface and a vendor-discretionary write path. Doing the easy, verifiable, high-value thing first is how you earn the organisational credibility to do the hard one.

Sequenced implementation path for a cardiology practice. Owners are roles, not people — but each role must be a named person before the phase starts.

A word on Phase 3's exit criterion, because it is the one practices try to negotiate. “A blinded review of 30 notes against the encounter finds no unresolved omission of a negative cardiac finding or a medication” sounds strict. It is calibrated to the evidence: 70% of draft notes in the instrument-validation study contained at least one error, omissions were the dominant class, and medication errors were the most common single error type in the simulated-encounter evaluation. You are not testing whether the product is good. You are testing whether your encounter conditions — your room acoustics, your accompanying family members, your clinicians' speech patterns — produce the error class that would matter most in your specialty. Thirty notes is a small enough sample to actually complete and a large enough one to surface a systematic problem.

And a word on what not to sequence early. Do not start with an outbound patient-facing conversational agent. It carries the disclosure duties, the persona restrictions, the injection exposure and the consent surface all at once, and it produces the least verifiable benefit. Every phase above is either internal or human-committed at the boundary. That is not timidity; it is the order that lets you prove something before you risk something.

Every failure below has been designed for in the phases above. They are listed here separately because a deployment plan that names its failure modes in advance is the difference between an incident and a crisis.

Cardiology-specific failure modes with their detection signals and rollbacks. Every rollback should be executable by one named person in under an hour.

The first row deserves elaboration because it is the one unique to this specialty and the one most likely to become a compliance problem rather than merely an operational one.

The second and third rows — omitted negatives and speaker attribution — are the reason Phase 3 has a blinded review rather than a satisfaction survey. Clinicians will tell you the notes are good. Every study in this article that asked clinicians how they felt got a positive answer, and every study that measured the notes found errors. Both things are true simultaneously. Your review process has to measure the note, not the mood.

The sixth row — silent write-path breakage — is where the read-only constraint becomes an operational reality rather than a legal footnote. If your scribe files notes through UI automation or a browser push, an EHR upgrade can break it without producing a single error message. Alert on the ratio of filed notes to encounters, not on error counts. A ratio that drifts from 0.99 to 0.94 over a week is the only signal you will get.

And the seventh row is the one where we decline to offer you a detection signal, because none exists that we can defend. Prompt injection through inbound unstructured text has no reliable detector, vendor claims to the contrary have no independent benchmark behind them, and the peer-reviewed finding that injected prompts can be non-obvious to human observers means the human reviewer is not a detector either. What you can do is reduce blast radius: read-only by default, least privilege at the API boundary, a unique identity so a successful injection is reconstructable after the fact, and out-of-band confirmation before anything irreversible. Frame it that way internally too. A control that reduces damage is honest. A control that claims to prevent the attack is not.

These are our actual engagement bands, and they are the same across every article in this cluster because the work is scoped the same way regardless of specialty. What changes in cardiology is which workflow you start with, not what it costs to build one.

Senior-led delivery at $150–$225 per hour. Ongoing retainers from $2,500 to $9,500 per month covering monitoring, revalidation after EHR and code-set changes, audit-log review and incident response. Every engagement carries a 30-day post-launch warranty. You receive a written, fixed-price, phased proposal within 5 business days of the discovery call, and full source-code and IP ownership transfers to you at delivery — we do not build businesses on your switching costs.

Frenchy Digital is a senior-led, Black-owned agency based in Los Angeles. The people who scope your build are the people who build it.

Book a discovery call at calendly.com/frenchydigital/discovery-call or call +1 (424) 272-5601. If what you want is the Phase 0 baseline design so your own team can run it, ask on the call and we will walk you through it whether or not you hire us.

Naming the gaps is more useful to an operator than papering over them. Here is everything material we could not establish while writing this, stated plainly.

• No independent accuracy benchmark exists for any named ambient scribe: The two studies that measured correctness deliberately anonymised the products, so no accuracy figure can be attached to a named vendor. We do not know which platforms were A through E, or which products were A and B.
• We could not identify the vendor used in the Wisconsin randomized trial: It is not named in the abstract, so one of the two strongest results in the category cannot be attributed to a product you could buy.
• Public BAA statements are largely absent: We found none on the pages we fetched for Abridge, Microsoft Dragon Copilot, Nabla, Suki, DeepScribe or Commure. Only Sunoh (BAA included) and Freed (organization-wide BAA on Group plans) state it publicly. That is an observation about disclosure, not about whether a BAA is available.
• HITRUST is claimed by no vendor we examined: If a comparison article tells you a scribe is HITRUST-certified, that claim is unverified as far as our checking goes.
• Ambience's certifications are claimed but unnamed: The site says trusted and fully certified and names nothing; its /security page returns a 404.
• Heidi's certification status, BAA and USD pricing could not be extracted: Its trust centre and HIPAA page returned effectively empty content to automated fetch, and its pricing page renders tiers inconsistently. Open it yourself before quoting anything about it.
• Epic's built-in ambient charting tool has no confirmed product name and no published pricing: The only source we have describes the capability without naming the product. We will not invent a name for it, and we cannot tell you what it costs.
• Oracle Health Clinical AI Agent and NextGen Ambient Assist rest on trade coverage only: No vendor page was fetched for either.
• No Medicare payment amounts for any RPM code: The authoritative figures are in PFS Addendum B, which we did not fetch. Every circulating per-code dollar figure we chased came from a remote-monitoring vendor's billing guide.
• The device-monitoring billing intervals are vendor-sourced: The 90-day interval, the 30-day minimum monitoring period and the mutual exclusivity of 93294 and 93295 appear only in vendor and manufacturer material. The 2026 NCCI Policy Manual contains no entry for 93294 through 93299.
• We could not confirm the current corporate status of several RPM-adjacent vendors: A search on 2026-08-12 surfaced no acquisition, rename or shutdown for Octagos, Rhythm360, medxpertservices, Prevounce, ThoroughCare or Tenovi — but a negative search result is not a confirmation. Rimidi is confirmed acquired by Health Recovery Solutions in March 2026.
• No definitive all-party-consent state list: Sources disagree, with counts of eleven and twelve and disagreement centred on hybrid states. We name California §632 as the concrete example and refuse a count.
• No published court judgment exists on liability for an AI-drafted clinical note: The active litigation is about recording consent, not note accuracy. Anyone telling you how courts will treat an AI-drafted note is speculating.
• Colorado's enforcement pause rests on law-firm reporting, not on the docket: The statutory picture itself is settled, and we state it rather than hedge it. SB 24-205 did take effect — its start date was pushed from February 1 to June 30, 2026 — so it is on the books today. SB 26-189, signed May 14, 2026, repeals and reenacts it effective January 1, 2027 under the enrolled bill's SECTION 5, applying to consequential decisions made on or after that date, and it carries a safety clause at SECTION 6 — so the August 12, 2026 date on leg.colorado.gov, a site-wide banner for bills passed without one, does not apply to it. What we could not verify at source is the enforcement posture: on April 27, 2026 a federal court is reported to have granted a joint motion in which the Attorney General stated he does not intend to enforce SB 24-205 until the rulemaking process has concluded. We did not fetch that order and we cite no case number. For a cardiology practice the operative point is the carve-out: HIPAA covered entities are excluded from the core sections from January 1, 2027, except for consequential decisions about employment, and owe patients a general notice that advanced technologies are in use.
• No published study of prompt injection via portal messages, faxes or payer portals in a live practice: The peer-reviewed evidence covers patient dialogue and medical imaging. Our extension to fax and portal channels is reasoning, not a finding, and we label it as such.
• The HIPAA Security Rule NPRM is still only proposed: Final action is projected for July 2027 on the Unified Agenda. The 2003 Security Rule as amended in 2013 governs today, which means encryption at rest is still addressable rather than required — a fact much of this market writes as though it had already changed.

Each row below is a specific, checkable behaviour rather than a vibe. Run the list before the second sales call.

Vendor red flags for ambient documentation and remote-monitoring software. Checked against the vendor landscape as of 2026-08-12.

One meta-red-flag worth stating separately, because it shapes everything you will read while researching this purchase: in the medical-practice AI market, almost every circulating operational statistic was published by a company selling software to the specialty it describes. That is true of the no-show cost figures, the phone-abandonment benchmarks, the RPM per-code dollar amounts, the device-interrogation billing intervals, and every scribe accuracy percentage in existence. When we could not find a non-seller source, we said so in this article rather than filling the gap. Apply the same test to whatever you read next: who published this number, and what do they sell?

A closing note on what the zero-click clinic actually means, since this article is part of a cluster built around the idea. It is not an unstaffed practice and it must never be sold as one. It is a practice where the default administrative path completes without a human click, and where humans are deliberately routed to the exceptions and to every clinical, billing-attestation, legal or safety decision. In cardiology that means the ledger runs itself, the prep goes out and comes back confirmed, the packet assembles, the note drafts — and a named clinician still opens every alert and still signs every note. The point of removing the clicks is not to remove the people. It is to spend them where the statute, the payer and the patient actually need them.