Light gray square, with a dark gray border on the sides.

Blog

Your Cardiology Department Just Added CCTA Plaque Analysis. Did Your IT Stack?

June 2, 2026

Part 2 of 5 in Circle's Coronary Plaque series. Also read:

Part 1 — How Advanced Plaque Analysis Changes the Clinical Calculus


When clinical cardiology adopts a new capability, IT inherits the infrastructure. And right now, coronary plaque analysis is moving from research tool to clinical standard fast enough that many IT and PACS teams are still catching up.


The demand is real. The 2021 ACC/AHA Chest Pain Guidelines made CCTA a Class I recommendation for stable chest pain evaluation. More recent trial data — including 10-year outcomes from SCOT-HEART and the ongoing SCOT-HEART 2 trial — is driving cardiology programs to go further, adding quantitative plaque characterization alongside standard stenosis reporting. That means new software, new data flows, new integrations — and new complexity landing in your environment.


How that complexity lands depends almost entirely on the path the department chooses. There are essentially two: a unified platform that performs plaque analysis natively, inside your existing environment — or a send-away service that moves CCTA data out of your network to a vendor cloud, runs the analysis there, and returns a result. Those two paths lead to very different IT outcomes.

What a Send-Away Plaque Service Actually Means for IT


Most CCTA plaque analysis tools on the market today are delivered as cloud-based send-away services. The CCTA dataset is auto-routed or uploaded to a vendor endpoint, the analysis runs on the vendor's infrastructure, and a structured report or DICOM-encapsulated result comes back. A smaller number are delivered as on-premise standalone applications. Either way, when a clinical team selects a single-purpose plaque tool, the IT implications are predictable — and the send-away flavor stacks an additional layer of concerns on top of the standard point-solution overhead:


A new outbound PHI transfer for every CCTA. A send-away plaque service moves your CCTA datasets out of your network, through your perimeter, to a vendor cloud — and back. That is a new firewall rule, a new egress route, a new TLS or VPN tunnel to monitor, and a new bandwidth profile for studies that can easily exceed several hundred megabytes each. Every CCTA your department reads becomes an outbound transfer of protected health information.


A new BAA scope to enforce. Once the data crosses your perimeter, your Business Associate Agreement with the vendor governs everything that happens next — where the data sits during analysis, who at the vendor can access it, how long it is retained, whether it can be used to train models, what your notification timeline looks like if the vendor is breached. The BAA is the contract; verifying it holds in practice is your security team's job.


A new data-residency question. If the vendor processes data in a cloud region outside your jurisdiction — or outside your patients' — your compliance officer needs to know. State health information laws, cross-border PHI handling rules, and institutional policy on where patient data can sit are not always obvious from a vendor's marketing page.


A new DICOM routing configuration. CCTA datasets need to route from the PACS or modality to the plaque analysis endpoint, then results need to route back. That means new DICOM rules, new AE titles, new storage overhead, and at least one new server or cloud endpoint to maintain.


A new integration to validate and support. Whether that's a HL7 or FHIR-based results feed to the EMR, or a custom PACS integration, someone on your team owns it — and every upgrade cycle on either side potentially breaks it.


A new access control and identity layer. New users, new roles, new authentication paths. If the tool sits outside your existing SSO environment, that's additional credential management, additional offboarding risk, and another surface in your HIPAA access control audit.


A new patching, update, and uptime dependency. A send-away service patches on the vendor's schedule and is available when the vendor is available. Maintenance windows, regional cloud outages, and version changes happen outside your change-management process — and your readers feel them.


A new vendor relationship and support queue. When something breaks at 11 PM during a busy cardiac imaging day, you're working two support channels — the plaque service vendor and your existing imaging vendor — and neither owns the end-to-end workflow.


None of these things are insurmountable. But each adds overhead. And when you're already managing a cardiology IT environment with cardiac MRI post-processing, CT reporting, structural heart planning, and electrophysiology tools — all with their own integrations and maintenance schedules — adding another point solution means adding to a stack that's already complex.


The Security Dimension


Healthcare cybersecurity risk scales with surface area. The HIMSS Healthcare Cybersecurity Survey consistently shows that fragmented, multi-vendor IT environments are harder to secure, harder to audit, and slower to recover after incidents. Cardiovascular imaging data is high-value — it's PHI, it's voluminous, and a send-away plaque workflow moves it across organizational and often geographic boundaries on every study.


Each additional tool in the stack is another endpoint, another authentication boundary, another data transit path. A send-away plaque analysis service introduces a specific set of questions your security team will need answered:


  • Where does the data sit during analysis, and how long does it persist after the result returns?
  • Is the transit encrypted end-to-end, with mutually authenticated TLS, and is the encryption-at-rest configuration documented?
  • Which cloud region processes the data, and does that satisfy your institution's data-residency policy and any applicable state or cross-border regulation?
  • Can the vendor's audit logs be reconciled with your own audit trail end-to-end, so that a single study's access history is reconstructable across both environments?
  • What is the vendor's breach-notification SLA, and how does their incident-response process integrate with yours?
  • Is the data used for model training or other secondary purposes, and is your consent or opt-out clearly documented in the BAA?


These aren't hypothetical concerns. They're exactly the questions your security team and your compliance officer — and you're the one who has to answer them. The more of those answers that live inside someone else's cloud, the longer your security review takes and the thinner your assurance is.


What a Unified Platform Changes


The alternative is a post-processing platform that includes CCTA plaque analysis as a native, in-house capability — not as an external integration or a send-away service, but as part of the same application your team already uses for cardiac MRI, CT function analysis, and structural heart planning.


cvi42 is built on this architecture. Plaque quantification, stenosis analysis, high-risk plaque feature assessment, and coronary reporting all occur within the same application environment as CMR function, tissue characterization, and EP planning. From an IT standpoint, the implications are materially different:


Data stays inside your network. Plaque analysis runs in the environment you already operate. There is no outbound PHI transfer for each study, no new BAA scope to negotiate for plaque, no third-party cloud to add to your annual security review. The data never crosses your perimeter to be read.


One DICOM routing path. CCTA data routes to the same destination it always has. No new AE titles, no new storage nodes, no new routing rules.


One EMR integration to maintain. Results — including plaque metrics — flow through the existing reporting integration. No second results feed to configure or maintain.


One authentication environment. SSO, role-based access, audit trails — all managed within a single application. Your access control policies apply uniformly, and your offboarding process remains clean.


One patching cadence, one uptime profile. One vendor, one release schedule, one compatibility matrix to track. When cvi42 updates, plaque analysis updates with it. Availability is yours to manage, not a third party's to schedule.


One support relationship. When something needs attention, there is one call to make.


This is the architectural difference between adding a capability and adding a system. The former extends what you already manage. The latter multiplies it — and, in the send-away case, exports part of it to someone else's data center.


A Note on Deployment: In-House Doesn't Have to Mean Inflexible


A send-away service often gets positioned as the "easier" deployment because there is no software to install. That framing ignores the actual operational burden: every CCTA produces a new PHI egress event, every result depends on the vendor's cloud being available, and every security review has to extend into a third-party environment your team does not control.


In-house plaque analysis does not have to mean a heavyweight on-premise project. cvi42 supports on-premise, hosted, and hybrid deployment models, and can be configured to fit within existing hospital IT architectures — your PACS admin does not have to stand up a new server, and your security team does not have to open new outbound firewall paths to a vendor cloud just to read coronary plaque. The capability extends from within the environment you already secure.


For IT and PACS teams evaluating any new cardiovascular imaging tool, the DICOM standards compliance, EMR integration model, and PHI data-flow diagram are the right starting questions. A platform that speaks the same interoperability language as your existing infrastructure — and keeps the data inside it — is always easier to deploy, maintain, and defend than one that requires custom bridging to a vendor cloud.


The Bottom Line for IT


CCTA plaque analysis is coming to your department whether the decision is made with IT input or not. The question is whether it arrives as a send-away service that exports your CCTA data to a vendor cloud on every study, or as an in-house capability that extends a platform you already manage.


The IT case for a unified, in-house post-processing platform isn't about clinical preferences — it's about surface area, security posture, integration count, PHI egress, and maintenance overhead. Fewer systems to manage and fewer outbound data paths to defend mean a cleaner, more defensible environment. That's an outcome worth advocating for in the vendor selection conversation.


Explore cvi42's deployment and integration architecture →


Stay tuned for more on Advanced Plaque Analysis from the perspective of CFOs and finance leadership, imaging lab directors and department heads.

Two people talk across a desk in a green-toned office, with a coronary CTA in the background.
May 19, 2026
Part 1 of 5 in Circle's Coronary Plaque series. Consider a familiar scenario. A 52-year-old presents with atypical chest discomfort. The stress test is borderline. The referring physician is uncertain — is this true coronary disease, or something else? Standard imaging has been done. The anatomy looks, on the surface, mostly normal. And yet something about this patient doesn't sit right. This is the case where clinicians have historically had to make consequential decisions with incomplete information. Escalate to invasive angiography and risk an unnecessary procedure. De-escalate and risk missing a vulnerable plaque that hasn't yet caused significant stenosis — but will. Coronary artery disease doesn't announce itself neatly. A substantial share of acute coronary events occur in patients with non-obstructive coronary disease — lesions that would not have triggered revascularization on a standard angiogram. The stenosis grade has always been an imperfect surrogate for risk. What matters is the plaque itself: its composition, its burden, and its vulnerability. Advanced CCTA plaque analysis changes that calculus.
A medical professional in a navy blue scrub top points to heart scan imagery on a monitor while consulting a colleague.
May 12, 2026
The Effort, Risks, and Why It’s Worth It Quantifying the Effort of a Single Platform Learning a new (or deeper) way of working Even for existing cvi42 users, full standardization across cardiac imaging means: Adapting to new modules or modalities. Rethinking how you structure reading lists when more work is visible in one place. Helping develop shared templates and protocols. It’s completely normal to see a temporary dip in productivity when something new is introduced. Our brains are wired for loss aversion: we tend to focus more on what we might lose than on what we could gain. Recognizing that bias helps put the slowdown in perspective: it’s not a setback, it’s just part of the process that leads to long‑term progress.
Secure data within the cvi42 cardiovascular imaging application for AI enabled postprocessing
May 5, 2026
Local Processing for Complete Data Security When cvi 42 processes imaging data, everything takes place within the customer’s secure environment. All image data and derived results are managed locally, whether on a hospital workstation or through a customer-managed server installation. No data is ever transmitted outside the institution. This architecture ensures compliance with strict hospital IT policies and data protection frameworks. For clinical users, this means AI-powered results without any compromise to data privacy or network security. The Circle AI Engine: Trained, Validated, and Frozen “Each of the AI models powering cvi42 is architected and developed within Circle’s controlled research and development environment. Circle’s data science and clinical AI research teams use diverse and representational datasets to train and validate each algorithm. The process typically involves supervised learning, where the AI learns to recognize patterns and structures such as the left ventricle, myocardium, or aortic root by comparing its results to expert-annotated data. Once performance meets clinical and regulatory standards, the AI model is locked, “frozen” and encrypted during its integration within cvi42. This means the model’s behavior is fixed, it does not continue to learn or change once deployed at a customer site. The model you use in cvi 42 is the validated version approved for clinical use, ensuring consistent and reproducible results across all installations. No Learning from Customer Data It is important to clarify: the AI in cvi 42 does not learn from any data processed at the customer site. The algorithm applies its pre-trained parameters to each image set locally. It does not store patient data, send information externally, or modify its internal model based on what it sees or whether a user edits its outputs. Each analysis is isolated, ensuring the AI’s decisions remain consistent and the patient’s information stays protected within the facility’s network. How the AI Analyzes Medical Images At a technical level, cvi42’s AI is a deep learning-based image analysis engine trained to recognize and segment cardiac anatomy on MR and CT images. Primarily using convolutional neural networks, it performs pixel- or voxel-level classification to delineate key structures, including the endocardial and epicardial borders. These segmentations enable the measurements of clinically relevant metrics such as chamber volumes, ejection fraction, and myocardial mass. This process mimics how expert readers would interpret the same dataset, but it happens in seconds and with objective consistency across cases. Designed for Trust, Built for Performance AI in cvi 42 is designed to automate routine analysis while keeping clinicians fully in control. Users can review, adjust, and approve AI-generated contours as needed, ensuring that results always meet their clinical standards. Combined with local data processing, frozen AI models, and Circle’s rigorous training pipeline, this approach delivers accuracy and reliability without ever compromising patient privacy.
A healthcare worker in a white coat juggles colorful balls in a hospital corridor, with staff and a patient nearby.
March 23, 2026
Clinical Wins and Daily Practice Introduction A single cardiovascular imaging platform like Circle’s cvi42 changes daily work for cardiologists and radiologists from “tool juggling” to focused clinical practice. But it also asks for effort and carries real, though manageable, risks. Seeing this change from your perspective, the people interpreting images and shaping programs, makes it easier to decide whether adopting a unified platform is worthwhile.

Subscribe to our newsletter

 Don’t miss future articles or publications.