HTFL · CIK 0001464521
What HeartFlow, Inc. told the SEC could break it.
HeartFlow's biggest flag is reimbursement: its revenue depends on Medicare and Medicare-administrative-contractor coverage, and CMS's proposed 2026 OPPS rule could cut the rate for the clinical category including its FFR CT Analysis by up to 15%, while case-by-case MAC coverage of most covered lives adds further uncertainty. Its customer base, though it has no single 10%-plus customer, concentrates purchasing decisions in a small number of large hospital systems, so losing one decision-maker could cost a disproportionate share of accounts. As a still-scaling company it also carries a secured Hayfin credit facility with warrant-linked financing, and it relies on third-party cloud providers for the AI analysis pipeline at the heart of its platform, where an outage or vendor failure would directly disrupt delivery.
4 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Regulatory & policy
- CMS reimbursement cut risk (proposed 2026 OPPS rule, up to -15% for FFR CT APC)high
HeartFlow's revenue depends on Medicare/MAC reimbursement; CMS's proposed 2026 OPPS rule could cut the Medicare rate for the clinical APC including Heartflow FFR CT Analysis by up to 15%, and MAC case-by-case coverage (~75% of covered lives) adds reimbursement uncertainty.
“in July 2025, CMS issued the proposed 2026 OPPS rule, which, if finalized as proposed, could result in a reduction of up to 15% in the Medicare reimbursement rate for the clinical APC that includes our Heartflow FFR CT Analysis, along with other hospital services.”
SEC filing →As of 2026
Customer concentration
- no customer >10%, but purchasing decisions concentrated in a few customersmedium
Although no single customer was 10%+ of HeartFlow's revenue, the purchasing decision for many accounts is concentrated in a relatively small number of customers (e.g., large hospital systems), so loss of one decision-maker could cause a disproportionate loss across accounts.
“no single customer accounted for 10% or more of our revenue during the years ended December 31, 2025, 2024 and 2023. However, the decision-making function for some of these accounts is concentrated in a relatively small number of customers, such that the loss of one customer could result in a disproportionate loss across our accounts.”
SEC filing →As of 2026
Liquidity & debt
- Hayfin secured Credit Agreement with warrant-linked financingmedium
HeartFlow's 2021 Credit Agreement with Hayfin (amended multiple times) carries warrant-linked debt discounts and secured-debt obligations; reliance on this facility and the need for continued financing add leverage and refinancing risk for the still-scaling company.
“On January 19, 2021, in connection with entering into the Credit Agreement, the Company issued Hayfin a warrant to purchase 108,154 shares of common stock at an exercise price of $ 0.03 per share.”
SEC filing →As of 2026
Supplier concentration
- reliance on third-party cloud providers for the production/analysis processmedium
HeartFlow relies on third-party cloud service providers for its production process (the AI analysis pipeline that powers its platform); a cloud outage, security incident or vendor failure would directly disrupt its ability to deliver analyses to customers.
“As we rely on third-party cloud service providers for our production process, we conduct security due diligence on all of our vendors, which is performed annually for critical vendors, including reviewing their third-party audits, penetration test results and other security documentation.”
SEC filing →As of 2026
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch