Health Tech Acquisition Due Diligence: HIPAA and Contracts
Health tech acquisition due diligence covers more than financial statements. Buyers of billing companies, software firms, IT service providers and remote monitoring businesses also inherit contracts, data, security practices and obligations to clients. Issues in any of these areas can affect the price, the structure or whether the deal closes at all.
This article walks through the main areas buyers and lenders tend to review in a healthcare technology acquisition. It is a planning guide, not a substitute for professional review. HIPAA, data protection, contract and billing matters should be reviewed by healthcare counsel and qualified compliance and security professionals, and nothing here is legal, tax, billing or compliance advice.
Why Due Diligence Is Different in Health Tech
A healthcare technology company often handles protected health information, depends on client contracts that may not transfer and relies on code or systems that need to be clearly owned. A business can look strong financially while carrying hidden risk in these areas. Due diligence helps buyers find those risks before closing, when they can still be addressed through price, structure or protections in the purchase agreement.
Financial Due Diligence
Start with the numbers. Buyers typically review:
- Several years of tax returns, financial statements and bank statements
- Revenue by client, product and month
- Recurring versus one-time revenue
- Renewal, churn and expansion history
- Accounts receivable aging and collections
- Owner compensation and proposed add-backs
Software companies may capitalize development costs, which can make EBITDA look stronger than cash flow. Our article on capitalized software costs explains how lenders adjust for this.
Client Contracts and Change of Control
Client agreements are often the most valuable asset in a health tech company. Buyers should review each one for:
- Assignment clauses that restrict transfer to a new owner
- Change-of-control provisions that require consent or allow termination
- Termination for convenience and notice periods
- Pricing terms, renewal dates and automatic renewals
- Service level commitments and penalties
- Limitation of liability and indemnification terms
Contracts should not be assumed to transfer. In an asset purchase, assignment may require consent. In a stock purchase, change-of-control clauses may still apply. Healthcare counsel can help determine which consents are needed and how to approach clients.
Business Associate Agreements
Companies that handle protected health information on behalf of providers typically sign business associate agreements, often called BAAs. These agreements set out how data must be protected, how breaches must be reported and what happens to data when the relationship ends.
Health tech acquisition due diligence should confirm that BAAs are in place where required, that the company is following them and that subcontractors handling data have appropriate agreements too. Counsel should review whether these agreements can be carried forward after closing.
Security Posture and Incident History
A security incident can create liability, damage client relationships and reduce value. Buyers often review:
- Security policies, risk assessments and how often they are updated
- Access controls, encryption and backup practices
- Past incidents, breaches and how they were handled
- Results of any outside security testing
- Cyber insurance coverage and claims history
Qualified security professionals can assess technical risk, and healthcare counsel can evaluate HIPAA obligations and potential exposure.
Code, Intellectual Property and Systems
For software companies, buyers need confidence that the company owns what it sells. Key questions include whether employees and contractors have assigned their rights, whether open-source components are used in ways that create obligations and whether third-party licenses can be transferred. Vendor programs and software licenses should not be assumed to transfer.
Billing and Regulatory Exposure
Billing companies and remote monitoring businesses may carry risk tied to how claims were submitted on behalf of clients or patients. These practices should be reviewed by qualified billing or compliance professionals. Our guide to buying a remote patient monitoring company discusses how this risk can shape financing, and our guide on how to buy a medical billing company covers related issues.
People and Key Relationships
Many health tech companies depend on a few people: a founder who manages key clients, a lead developer who knows the code or a senior engineer who supports major accounts. Buyers should understand who is critical, whether they plan to stay and what retention arrangements may be needed. Worker classification should be reviewed by qualified professionals.
For IT service businesses specifically, see our guide to buying a healthcare IT managed services provider.
How Health Tech Acquisition Due Diligence Affects Financing
Lenders rely on due diligence findings when underwriting acquisition loans. Unresolved contract consents, security concerns or questionable earnings adjustments can affect how much a lender will finance or whether it will proceed.
SBA 7(a) loans can be used to help finance acquisitions of eligible businesses, including goodwill, subject to program rules and lender approval. Eligibility and terms depend on the business, the buyer, the use of proceeds and lender review, and every loan is subject to approval. Buyers considering a software deal can also read whether a healthcare software company SBA loan may fit.
Final Thoughts
Thorough health tech acquisition due diligence protects buyers from inheriting problems they did not price in. Reviewing financials, client contracts, business associate agreements, security posture, code ownership and key people gives buyers and lenders a clearer view of the risks and helps shape a deal that can close with confidence.
US Medical Funding helps buyers finance the acquisition of healthcare technology companies. Learn more about our healthcare technology acquisition financing.
