Every rollup inherits five to fifty other people’s IT decisions.
As of January 2026, 82.0% of US physicians are employed by hospitals, private equity firms, insurers, or other corporate entities, and corporations acquired 8,000 physician practices across 2024 and 2025. Every one of those transactions produces the same three things: a heterogeneous estate on mismatched systems, a diligence event, and a post-close integration nobody scoped. We do all three.
Corporations acquired 8,000 physician practices across 2024 and 2025. We have integrated 27 practice acquisitions for platform clients.
The specifics a generalist has never had to learn.
These are the findings that come up repeatedly when a healthcare-specialized team assesses this kind of environment. None of them are theoretical, and none of them are in a generic managed services playbook.
Diligence, before the deal
IT and security diligence on an acquisition target: what they run, what it costs, what is unsupported, what is exposed, what the integration will actually cost, and what liability is being purchased along with the practice. $7,500 per target, delivered as a document a deal team can read.
Integration, after the close
One identity platform, one backup product, one EDR, one standard. Post-close IT integration runs $18,000 to $65,000 by size. The first deliverable is always the inventory, because the target’s own list is wrong.
The platform standard, going forward
Once the standard exists, every subsequent acquisition is a checklist rather than a project. This is why platform relationships compound: one relationship replaces thirty individual sales cycles, and the thirtieth practice onboards faster than the second.
A clean data room, before the next transaction
When the platform sells, the buyer’s diligence team asks for the risk analysis, the BAA register, the incident history, and the security questionnaire responses. Those are the evidence file. Having it already assembled is worth more at that moment than at any other.
We already know what these need.
And, more usefully, what each one breaks when you patch it wrong. This is not a partner list. It is the set of systems currently under management across our book in this segment.
- Microsoft 365 / Entra ID
- NinjaOne
- Axcient x360Recover
- Huntress
- Cisco Meraki
- Fortinet
- Per-target diligence report with cost, exposure, and inherited-liability findings
- Integration runbook and standardization plan with dated milestones
- Consolidated asset and ePHI-flow inventory across the platform
- Platform-level risk analysis and risk management plan covering every entity
Everything in the standard evidence file applies as well: risk analysis, risk management plan, MFA coverage, training records, restore tests, and the Recognized Security Practices attestation.
How the compliance program worksMost start at Compliant.
Platform agreements are quoted rather than rate-carded. Diligence and integration are project-priced and listed on the pricing page.
Chartline Core
Managed IT with a security baseline.
$135/ user / month
15-user minimum · 36-month term
Help desk, patching, EDR, Microsoft 365, enforced MFA, immutable backup, and the asset inventory. Everything a practice needs to be running and defensible.
What is in CoreChartline Secure
Everything in Core, plus 24/7 detection and response.
$189/ user / month
15-user minimum · 36-month term
For practices whose carrier, payer, or health-system affiliate has started asking questions. Containment authority, log retention, segmentation, and the exposure monitoring that finds what a scanner does not.
What is in SecureChartline Compliant
Everything in Secure, plus the HIPAA program and the evidence file.
$255/ user / month
25-user minimum · 36-month term
The security program and the paper trail that proves it existed. A named security officer, a real risk analysis, a dated remediation plan, and an evidence file built for an OCR data request.
What is in CompliantWe only do healthcare, but healthcare is not one thing.
Physician groups and specialty practices
Ortho, GI, ophthalmology, women’s health, and primary care. An Epic Community Connect affiliation inherits the host system’s security and audit obligations, and MIPS attestation is a hard annual deadline.
Dental practices and DSOs
On-premise Dentrix, Eaglesoft, and Open Dental, imaging servers, and operatory workstations. The highest ransomware exposure per dollar of revenue in our book.
Behavioral health and SUD providers
42 CFR Part 2 civil enforcement went live February 16, 2026. Consent management, redisclosure controls, and disclosure accounting sit on top of HIPAA.