Healthcare software compliance — HIPAA, Oracle Health, and the audit cycle.

Why healthcare carries an outsized licensing risk.

Healthcare organisations carry a software compliance profile shaped by three forces: the embedded Epic, Cerner (Oracle Health) or MEDITECH EHR estate that anchors the technology stack; the HIPAA, HITECH and 21 CFR Part 11 regulatory overlay that constrains data handling and audit-evidence rules; and the M&A consolidation pattern that creates duplicate entitlements faster than any other industry. In our work with health systems, payers and life-sciences organisations across 2024 and 2025, the recurring compliance patterns are predictable enough to plan against — provided the work happens ahead of the audit notice.

The largest single recurring exposure is Oracle Database underneath the Cerner / Oracle Health EHR. After Oracle's 2022 Cerner acquisition, the licensing relationship between hospital systems and Oracle moved inside a single vendor relationship. Hospitals that previously ran Cerner on Oracle through a separate entitlement now find themselves negotiating both the EHR subscription and the underlying Oracle Database licensing at the same table — and the vendor's leverage at that table is materially higher than it was pre-2022.

The Microsoft 365 healthcare workload

Microsoft 365 is the second-largest compliance exposure point in most hospital systems. The HIPAA Business Associate Agreement (BAA) constrains which Microsoft 365 SKUs can legally hold protected health information (PHI). E1 alone is rarely sufficient; many hospitals over-license to E5 because the compliance, audit-log retention and DLP features required by HIPAA and the OCR audit protocol sit there. The renewal-cycle work that recovers cost is reconciling the E5 footprint against actual PHI access — many clinical users do not touch PHI inside Microsoft 365 and can run on lower SKUs without breaching the BAA terms.

The M&A reconciliation pattern

Healthcare consolidation runs at a higher pace than any other sector. Two hospital systems merge; two Epic instances need to reconcile; two Microsoft 365 tenants need to migrate; two ServiceNow instances need to consolidate. Each consolidation event is a vendor opportunity — the entity boundary has changed and the vendor's prevailing licensing rules now apply differently to the combined entity. The defensive posture, built before the close, is to: assemble the combined entitlement register; baseline the deployment footprint of the acquired entity for the top eight publishers; freeze entitlement transfer language into the deal documents before the integration team starts changing tenant configurations.

The clinical-systems audit pattern

Clinical-systems audits — IBM, SAS, Oracle, Cerner / Oracle Health, MEDITECH application options — tend to land 18 to 30 months after a significant capacity change at the hospital. Patient volume growth, new clinical service-line launches, M&A integration milestones and EHR module activations all change the entitlement consumption pattern; the publisher's audit team monitors the publicly-available capacity signals (bed counts, service-line announcements, clinical-services hires) and times its audit appetite accordingly. The defensive posture is to instrument each capacity-changing event as an entitlement-tracking event in the SAM tool inventory.

The review that pays at every health system.

The compliance review that consistently pays in healthcare is the annual hospital-wide entitlement reconciliation. It is not a SAM tool deployment, not a vendor audit response, and not a renewal benchmarking exercise — it is a deliberate exercise that asks, for each of the top eight publishers (Oracle / Cerner, Microsoft, IBM, SAP, Epic, ServiceNow, VMware / Broadcom, and the clinical-systems suite), what is the entitlement position, what is the deployment baseline, what is the gap, and what is the next 12-month leverage event. Health systems that run this review annually report a 60–80% reduction in audit surprises versus those that respond to audits ad hoc. When a clinical-systems publisher does open a review, buyer-side vendor audit defense keeps the PHI-licensing exposure contained and the settlement anchored to actual deployment rather than the vendor's opening claim.