Vendor Sprawl: Why Health Systems Have the Harder Compliance Problem

Ask a Medicare Advantage plan what it has to track across its vendors and you get an answer. It may be an exhausting answer, but it exists: 42 CFR 422.504 tells the plan what to flow down, CMS program audits tell it what to produce, and a delegation calendar organizes the year.

Ask a health system the same question and there is no answer, because nobody wrote one.

That is the actual difference between the two sides of healthcare vendor compliance, and it is the opposite of how the software market treats them. Payers get purpose-built tooling shaped around their regulatory framework. Health systems get the same tooling with the framework filed off, which fits badly, because the health system's problem was never a framework problem.

What sprawl actually looks like

A health system does not have a vendor program. It has a thousand-odd separate procurement decisions that happened over fifteen years, a few hundred of which carry obligations that matter.

Imaging maintenance was signed by facilities. The staffing agency came through HR. The revenue-cycle outsourcer was legal and finance. The EHR integration vendor came in with the EHR. Environmental services renewed on a template nobody has revisited since the last system merger, and the two hospitals that joined in 2021 brought their own vendor books with their own paper.

Each of those agreements says something about insurance. Each says something, or nothing, about subcontractors. Some carry business associate agreements because they touch protected health information, and some carry them because somebody added one out of caution. The insurance limits differ. The notice periods differ. The audit rights differ.

None of that is dysfunction. It is what happens when a large organization buys things over a long period. The dysfunction is that no system holds what any of those agreements require, so the only way to answer "are we covered on this vendor" is for a person to open the contract.

The number nobody can act on

When Ponemon surveyed 554 IT and security professionals at healthcare organizations in 2019, the average provider had 1,320 vendors under contract, and just 27% assessed all of them even once a year.

Read the second figure alongside what the same study found about effort, because the obvious explanation is the wrong one. The average provider ran 3.21 dedicated full-time staff putting more than 500 hours a month into vendor risk assessments, which is roughly six thousand hours a year. Counting everyone else pulled in - security and risk staff, supply chain managers, clinicians, line-of-business managers - the total came to 5,040 hours a month.

So this is not a story about teams unwilling to do the work. One two-hour pass over 1,320 vendors is 2,640 hours, comfortably inside what providers already spend. They are spending well over double that and roughly a quarter of them still get all the way around the vendor list once a year. The hours are real and they are going somewhere other than verification: chasing questionnaires, reconciling spreadsheets, re-collecting documents somebody already collected. That is the part worth attacking, and it is not a staffing problem.

Five years later, in fieldwork run at the end of 2024, the Healthcare Cybersecurity Benchmarking Study asked 69 health systems and payers to rate their own coverage of the NIST framework. Supply chain risk management came back at an average of 52%, the weakest category on the list for the second year running, against 73% across all other categories combined. Different measure, different sample, so not a like-for-like comparison. Also not the shape of a solved problem.

Why the payer playbook does not transfer

A payer's compliance work has a spine. The CMS contract creates the obligations, the regulation names them, and the audit asks for them in a known format. Software can be built against that spine, and it has been - delegation oversight modules, universe management, attestation calendars.

A health system has no spine. There is no regulator publishing a list of what your imaging vendor owes you. The obligations exist, they are enforceable, and some of them carry real money, but they live only in each individual agreement. That has two consequences.

The first is that a template-driven tool cannot help much. A generic vendor questionnaire asks the same questions of every vendor, which means it asks nothing about the $5 million per-occurrence requirement your specific agreement negotiated, or the 30-day breach notification window that differs from your standard by fifteen days.

The second is more encouraging. Because there is no template to conform to, there is also nothing to argue with. Working from what each contract says is not a compromise on the health system side. It is the only correct approach, and it happens to be the one that scales when reading is cheap.

The four that carry most of the exposure

Across most health system vendor books, four recurring obligations account for the bulk of the risk that recurs rather than the risk that happens once.

Insurance certificates, because coverage lapses and renews at worse terms and a current-looking certificate hides both. We wrote about what a certificate does and does not prove separately, and the short version is that the expiry date is the least interesting field on it.

Business associate agreements, because 45 CFR 164.504(e) requires specific provisions in them, subprocessors change without telling you, and an unexecuted BAA on a vendor touching protected health information is a finding waiting to be found.

Exclusion screening, because the OIG updates its list monthly and payments touching an excluded party are recoverable, which makes an annual check an eleven-month exposure.

Subcontractor disclosure, because your vendor's subcontractors are where your visibility ends and your obligations do not.

None of these are exotic. All four are in most agreements. Almost no health system can produce current evidence on all four across its whole vendor book, which is the actual state of the problem.

What changes when reading is cheap

The reason vendor sprawl felt permanent is that the only way through it was proportional to the number of contracts. Two hundred agreements meant two hundred readings, by someone who understood insurance clauses and BAAs and could hold the difference between per-occurrence and aggregate in their head.

Harper reads the executed agreements and extracts what each one requires, with the clause it came from. The same obligation recurs across dozens of contracts in slightly different words, so it is stored once and referenced everywhere it appears, which means the two hundredth agreement costs less to process than the first. That is the inversion. Sprawl stops compounding against you and starts working in your favor, because volume is now the cheap part.

Then it does the recurring work: requesting the certificate, reading it against the clause that required it, chasing the vendor who has gone quiet, screening on a real schedule, and escalating the handful of things that need a person. Keep whatever system holds your agreements. Icertis, Ironclad and Gatekeeper all store and route contracts well, and Gatekeeper reaches further into vendor management than the other two. This runs on top of that record rather than replacing it.

A first pass you can run this week

Take your fifty largest vendor agreements by spend and answer four questions from evidence rather than memory.

1. What insurance limits does each one require, and does the certificate on file meet them - not the template you assume applies, that specific clause?
2. Which of them touch protected health information, and is there a countersigned BAA for every one that does?
3. When was the last exclusion screening run against each vendor and its personnel, and can you produce the result?
4. Which of them are permitted to subcontract, and do you know who their subcontractors currently are?

Most teams get partway through question one before they run out of retrievable answers. That is the measurement. The gap between what your agreements require and what you can evidence today is the whole of the problem, and it is worth knowing its size before anyone proposes a solution to it.