The challenge
A PE-backed value-based healthcare provider had several technology projects running at once (a data project, an ERP upgrade and a cloud migration), with vendors setting the agenda and no unified plan, scope, timeline or cost control.
It was locked into a costly two-year HITRUST r2 audit cycle, and vulnerability scanning had turned up unresolved network exposures, including a DNS weakness that could be used for a denial-of-service attack.
Our approach
We stepped in as the company’s strategic advisor across every initiative. We assessed the environment and vendors, found quick wins and prioritized projects against the sponsor’s goals, and made the data project define its plan, scope, timeline and cost before any commitment. We ran network and application vulnerability scans, flagged the DNS exposure and advised on the ERP upgrade and the sequence of the Azure migration.
We negotiated the company’s financial close software contract: implementation cost cut from $20K to $7.5K, license savings locked in for three years, the first payment deferred until the software was fully live and extra modules added at no cost. When the vendor wouldn’t sign a business associate agreement, we negotiated a security addendum into the contract to protect patient data. We also led an evaluation of the annual HITRUST i1 certification against the more expensive two-year r2 cycle.
The outcome
The company saved $12.5K on implementation and about $39K in licenses over three years, with its first payment deferred eight weeks until the software was fully live. Patient data is protected by contract, the DNS exposure was caught before it could be exploited, and projects now run to the sponsor’s priorities rather than the vendors’.
saved on implementation, from $20K to $7.5K
first payment deferred until the software was live
