Selling to hospitals: how health systems buy, and how marketing gets you through each gate

Selling to hospitals means getting one purchase through six gates: the clinical champion, the budget holder, IT and security, value analysis or IT governance, contracting, and the staff who will use the product. Each gate has a different owner asking a different question, and most of them never touch what they approve. The deals that close treat one department as the account, state value in the capacity the hospital is short of, and answer each gate's question before the deal reaches it.

Key takeaways

• A hospital purchase passes six gates, and the budget, security and value analysis gates can run in parallel. A vendor who waits for the champion's yes before starting the security pack adds months to the deal for nothing.
• About 70% of US community hospitals belong to a health system, according to the American Hospital Association's 2026 Fast Facts. The contract, the security review and the GPO relationship sit at the system, while the problem, the champion and the usage sit in one department.
• The "12- to 18-month hospital sales cycle" quoted across sales blogs has no primary source. In Menlo Ventures' 2025 survey, health systems reported average buying cycles of 8.0 months for traditional IT and 6.6 months for AI.
• There is no single hospital budget season. Among Fitch-rated hospitals, 34% close their fiscal year on June 30, 36% on December 31 and 23% on September 30, so each prospect's pilot readout has to be timed to its own calendar.
• GPO contracts cover about 73% of US hospital non-labor purchasing, according to an industry study the GAO cited, but buying through them is voluntary. In Europe, public hospitals must tender most purchases above €216,000, which moves marketing's window to before the tender opens.

This guide draws on TGS's health tech marketing report, built on six practitioner interviews, and on the gates we see clients stall at in our B2B healthcare marketing work. Figures come from primary sources such as the American Hospital Association, the GAO, KLAS Research, EU procurement law and NHS England. Where the research is thin, as on value analysis committee size, the article says so.

How do hospitals buy technology?

Hospitals buy technology through a sequence of gates. A clinical or operational champion identifies the problem, a budget holder funds it, IT and security clear it, a value analysis or governance committee approves it, contracting buys it, and staff adopt it. Several of those gates can run at the same time, and should.

The idea behind the gate map is that each gate is run by a different person answering a different question, and the purchase stalls wherever someone asks a question nobody prepared for. A chief information security officer does not care that the radiologists love the product, and a value analysis committee does not care about the demo. Marketing's job in a hospital deal is to produce the asset that answers each gate's question and put it in front of that gate's owner early.

The number of people involved is large but not unusual for enterprise software. Gartner's 2025 survey of 632 B2B buyers found buying groups of 5 to 16 people across up to four functions. What sets hospitals apart from other industries is that almost none of those people use the product.

The six gates, with the person who runs each and the asset that gets it open, look like this:

Hospitals are the extreme case of a structure every enterprise buyer shares: the person who signs is rarely the person who uses the product. Nurses and front-office staff run the tool every day and almost never see the contract, while the CMIO and the CIO approve it and almost never open it.

"

"B2B becomes real B2B when there is transaction complexity, buying committee size, and this logic that it's not the purchasing person that is using the service."

Clément Dumont Co-founder, The Growth Syndicate

Hospitals buy back capacity

Hospitals spend most of their money on people, and people are what they are shortest of. About 60% of hospitals' total expenses in 2025 went to the workforce, and total expenses grew 7.5%, more than twice the 3.3% growth in hospital prices, according to the AHA's 2026 Costs of Caring report. The July 2026 National Hospital Flash Report from Kaufman Hall, a Vizient company, put the calendar-year-to-date median operating margin at 1.4% including allocations.

That pressure shapes what hospital executives buy. KLAS Research's May 2026 acute care EHR market share report found that the number of hospitals affected by EHR purchase decisions fell 40% against 2024 and nearly 50% against 2023, as health systems redirected money toward AI and other tools with more immediate financial returns. Marcel Alberti, co-founder of Coforix (formerly HealthSage AI, a TGS client), described the same pull toward administrative AI in his interview for TGS: "Despite being a slow industry, being adopted much faster than, for example, cloud technology or AI in diagnostics, because everybody's suffering from the admin burden."

In TGS's client conversations across hospital AI and diagnostics, physicians and nurses who liked a product still said no, because the department had no staff to run it or no budget left. So the value case that works is stated in the resource the hospital lacks: clinician minutes returned, beds freed, cases added per operating room day, denials avoided. A claim of clinical superiority with no capacity number attached asks a constrained institution to spend scarce staff time on your behalf.

Sell to the department, contract with the system

In the US, the organization that signs is usually a health system, while the organization that wants the product is a department inside one of its hospitals. The AHA's 2026 Fast Facts, based on 2024 survey data, count 6,100 US hospitals, and 3,567 of the 5,121 community hospitals (about 70%) are part of a system. That makes the hospital system the level where the security review, contracting and standardization happen, even when the need sits in one hospital.

Inside the system, the buyer is still a department. Radiology, the emergency department, perioperative services, pharmacy services and the revenue cycle office each have their own workflow, budget line and approver. A product aimed at "the hospital" or the whole hospital system reaches none of them, while a product aimed at the patient access office of Epic-based systems with five or more hospitals reaches a buying center you can name.

How you count systems depends on the definition. The AHA counts 397 health systems on FY2023 data in its 2025 systems fact sheet, defining a system as two or more hospitals or one hospital with three or more pre- or post-acute organizations, while the AHRQ Compendium of US Health Systems counts 639 in 2023, because it requires a hospital and a physician group providing primary and specialty care under common ownership or joint management. For an account list, the definition matters less than knowing which one your data vendor used.

Physicians have moved inside those systems too. The AMA's 2024 Physician Practice Benchmark found that the share of physicians in private practice fell from 60.1% in 2012 to 42.2%, while the shares working in hospital-owned practices or directly for a hospital both rose:

For a vendor, that means a physician practice you once sold to directly may now buy through system rules, with the physicians now employees of the system that owns the practice.

Why does selling to hospitals take so long?

Hospital sales run long because a purchase needs agreement between people who do not report to each other, and because vendors work the gates in sequence when several could run in parallel. The widely quoted 12 to 18 months has no primary source. Survey data puts most health system purchases at under a year, with wide variation by product.

Menlo Ventures' 2025 State of AI in Healthcare, based on a Morning Consult survey of more than 700 healthcare executives in August and September 2025, found that health systems' average buying cycle was 8.0 months for traditional IT and 6.6 months for AI purchases. Payers moved the other way, from 9.4 to 11.3 months. Across the interviews behind TGS's health tech report, cycles ranged from six months to five years.

Averages hide that spread. Treat any single cycle-length figure as a range, and ask the prospect how long their last comparable purchase took and where it waited. That answer is worth more than any benchmark.

The length has a structure. Before joining TGS as Head of Growth, Ysabel Camus was the sole marketer at Fireleaf, a patient data interoperability company, marketing to a decision-making unit of five: the chief executive, the head of IT, the head of data, the CISO and a head of data interoperability. Cycles ran eight to twelve months, and six was the optimistic case.

In the Netherlands, many physicians operate through their own companies rather than as hospital employees, so the board cannot direct them, and insurers are not reliably aligned with hospitals either, Marcel Alberti told TGS. TGS's health tech report describes the result as assembling agreement across committees whose members answer to nobody in common.

"

"Demand means someone is in the market to buy now, with the budget, the authority, the need and the timing. If one of those is missing, you wait for it. That's also why you can't meaningfully compress a sales cycle."

Ferdinand Goetzen Co-founder, The Growth Syndicate

Marketing cannot create a hospital's need or move its fiscal year. What it can remove is stall time: most delays happen between gates, in the weeks a deal waits because nobody prepared the answer the next gate needs.

Health tech runs on two clocks, the clinical need and the institution's calendar, and a company's evidence stage decides which clock it is on. Our stage-by-stage guide to B2B healthcare marketing covers the evidence side; this guide covers the institution's clock.

Gate 1: how do you find and equip a champion?

The champion is the clinical or operational lead in the department that feels the problem, often joined by the chief medical information officer (CMIO) when the product is software. Champions have conviction but little time and rarely control a budget. The vendor's job is to hand them proof from peers like them and a pitch they can carry upstairs without you in the room.

Champions sit in predictable places inside every prospect: service line directors, department chairs, nurse managers, directors of revenue cycle or patient access, and the CMIO or chief nursing information officer for clinical software. Some health systems also run a digital innovation office that scouts vendors, which can open doors but rarely owns a budget. Physicians and nurses are found through their specialty associations, conferences and peers, while CMIOs and CIOs are reachable on LinkedIn, where a well-targeted post from a clinical founder often does more than a sequence of emails.

Peers are the evidence a champion trusts most. A 2018 KLAS Decision Insights analysis, reported by Healthcare IT News, found that each point of customer satisfaction raised a vendor's likelihood of being selected by 1.3 percentage points. Reference customers compound, and the first referenceable site is worth more than the next ten prospects.

"

"Generic case studies carry less and less weight. What convinces a buyer is proof from their own vertical, ideally shown live: naming what will and won't work in their world before they've told you."

Clément Dumont Co-founder, The Growth Syndicate

The internal pitch kit your champion needs

Champions struggle to rebuild a vendor's pitch for their CFO, and most lose half of it on the way. Give them a kit built for the internal meetings you won't attend. It needs six things:

1. A one-page problem statement in the department's own unit. Minutes per encounter, beds, cases per day or denials. Leave the feature list out.
2. Evidence from a comparable site. Same specialty, similar size and, for software, the same EHR.
3. The effort ask, stated in staff hours. Every hour you ask for competes with patient care, so show the version where the department's effort is close to zero.
4. The budget route. Which line the purchase comes from, capital or operating, and which fiscal year.
5. The security pack status. Proof that the review has already started, so IT is not the reason to wait.
6. A named peer the champion can call. A physician-to-physician call moves faster than any campaign.

The most common failure at Gate 1 is a single-threaded deal. Champions change jobs, burn out or get pulled onto other projects, and a deal that depends on one person dies with their next job change. A second supporter in the same department, often a nurse manager or an operations lead, keeps the deal, and the knowledge of why it matters, alive when the first one moves.

Gate 2: when do hospitals set budgets, and how do you get into one?

Hospitals budget annually against a fiscal year that may end on June 30, September 30 or December 31, and the budget is set months before the year starts. A product that misses next year's capital or operating budget waits a full cycle, so the pilot readout and business case have to land before the prospect's budget closes.

There is no single hospital budget season. In Fitch Ratings' rated portfolio of acute care hospitals, reported by The Bond Buyer in March 2023, 34% had June 30 fiscal year-ends, 36% December 31, 23% September 30 and 7% another date. The sample skews toward larger, bond-issuing nonprofits rather than small community hospitals, and states cluster: most general acute care hospitals in Pennsylvania close on June 30, while most acute hospitals in Massachusetts close on September 30.

Look up each prospect's year-end instead of assuming one. Nonprofit hospitals report their tax period on IRS Form 990, which is public, and audited financial reports state the fiscal year. Then ask the champion when department budget requests are due, because that date is your real deadline.

"

"You can't create timing. Budget cycles and leadership changes open the window, and what converts is being there when it opens."

Ferdinand Goetzen Co-founder, The Growth Syndicate

Capital or operating budget?

Capital budgets fund long-lived assets such as equipment and construction, and sometimes large software implementations, through a capital committee and a multi-year plan. Operating budgets fund recurring costs such as subscriptions, services and staff. Capital budgeting in healthcare tends to run on a longer, more competitive cycle, because every department's equipment request is ranked against every other's.

Most SaaS lands in the operating budget. Qualifying implementation costs for cloud software can be capitalized under US accounting guidance on cloud computing arrangements (ASU 2018-15), and some hospitals fund those costs from a different budget than the subscription. Ask the champion to find out from the CFO's office which line your fees would hit before you price the deal.

How the two budgets differ for a vendor:

The business case, stated in the hospital's constraint

A business case for a hospital converts your product's benefits into the unit the budget holder already manages. A department head can act on "13 extra physician-hours a day", whereas "better documentation" gives them nothing to put in a budget request.

Here is how that conversion works, using a published range and illustrative volumes. Across 13 studies of ambient AI scribes, Goodson and colleagues (2025) found time savings of 0.7 to 2.1 minutes per encounter, mostly among self-selected users. For an illustrative department of 40 physicians who each see 20 patients a day, one minute saved per encounter returns 800 minutes, or about 13 physician-hours, every day.

Two inputs decide the result: the minutes saved and the share of physicians who actually use the tool. For the same illustrative department of 800 encounters a day, the physician-hours returned each day move like this:

A CFO will discount the right-hand column, and should. Adoption never reaches every physician, and savings measured in volunteers overstate the average user. Build the case on an adoption rate you can defend, and state what the hours become, whether that is added appointment slots, less overtime or less charting after hours.

Gate 3: what does a hospital IT and security review require?

A hospital IT and security review checks that a vendor fits the systems the hospital runs and can be trusted with its data. Expect to provide a business associate agreement, a SOC 2 Type II report or HITRUST certification, a security questionnaire, an architecture and data-flow description, and an integration plan. Start the review alongside the champion conversation.

Third-party risk management in healthcare has drawn more scrutiny since the February 2024 attack on Change Healthcare, and the risks are measurable. KLAS's June 2026 third-party risk management report cites a 2025 KLAS and EY study in which 74% of healthcare organizations reported being affected by a third-party breach in the previous 24 months. The report, based on interviews at 44 organizations, describes a formal intake that triggers procurement, legal, privacy, security and business associate review before any approval.

That intake is why the security review belongs in parallel with Gates 1 and 2. Once a champion at a prospect submits a request, the vendor enters a queue alongside every other vendor, and the queue does not care how much the department wants the product. In practice, a healthcare vendor risk assessment answered in advance is the cheapest time any vendor can buy back, and the vendors who struggle most at this gate are the ones who start it last.

Under HIPAA, a vendor that creates, receives, maintains or transmits protected health information on a hospital's behalf is a business associate and must sign a business associate agreement setting out how it protects that data. Have your own template ready, and decide in advance which of the hospital's redlines you can accept, because the privacy office's concerns will focus on where clinical data goes once it leaves the hospital.

The security pack most hospitals will ask for contains eight documents:

HITRUST or SOC 2: which do hospitals ask for?

Hospitals accept different evidence, and the answer sits in each system's third-party risk policy. A SOC 2 report is an attestation by an independent CPA firm against the AICPA's Trust Services Criteria, and a Type II report covers how controls operated over a period. HITRUST certification assesses controls against the HITRUST framework, which maps to HIPAA and other standards, at three levels: e1, i1 and r2.

How the two compare:

Neither replaces the hospital's own questionnaire, which most systems send anyway. The practical move is to ask the prospect's third-party risk team in the first conversation which evidence their policy accepts, and sequence certification spend around your target list. A company selling mainly to large academic systems may need HITRUST earlier than one selling to community hospitals, and both should expect the security risks of AI features to draw extra questions.

Do you need to integrate with Epic?

Not to start. Epic runs in 43.7% of US acute care hospitals and 56.9% of hospital beds, according to KLAS's 2026 market share report, so integration will matter in the future. A standalone version that works without the EHR clears Gate 3 faster, because it keeps the product out of the integration team's queue.

Epic's program for third-party developers and partners has changed twice. The App Orchard marketplace, launched in 2016, gave way to Connection Hub in December 2022, and in January 2024 Epic launched Showroom, which now houses Connection Hub, where any vendor with a live connection to Epic can list for a $500 annual fee. Federal rules help on the read side: EHRs certified to ONC's standardized API criterion must offer FHIR-based APIs that support SMART app launch, the standard SMART on FHIR apps are built on.

Ask each prospect which EHR it runs before you promise anything. The integration routes, from lightest to heaviest:

Marcel Alberti told TGS that deep EHR integration has been notoriously slow in every country he has sold into, and that a basic standalone version is usually good enough to begin. Nemanja Stamenovic, Head of AI at Empedoc Labs, went further: "Zero integration, zero PII exchange. Compliance pushed us into a distribution model that's better than what we would have built without the constraint."

Gate 4: what is a value analysis committee, and how do you prepare for one?

A value analysis committee is a hospital or health system group that decides whether a new product is adopted, weighing its clinical evidence and cost against the alternatives. Its main territory is supplies and devices, especially physician preference items. Committees usually meet monthly, and their staff gather data for weeks or months before a request reaches the agenda.

Members typically include physicians, nurses, supply chain, finance, clinical engineering, IT and risk management. Many systems run a two-level structure, and Premier's value analysis guide describes a steering committee that sets policy above multidisciplinary value analysis teams for each service line. The Advisory Board notes that committees typically meet monthly and that staff research can take several weeks or months, with trials extending it further.

Nobody has published a reliable count of how many people sit on these committees. The closest guidance is an opinion: David Kalainov, a past co-chair of the orthopaedic surgery value analysis committee at Northwestern Medicine, recommends a maximum of 20 voting members, with additional nonvoting members, in a 2024 article in Clinical Orthopaedics and Related Research. Plan for a room where each member weighs benefits and risks from a different position, and assume none of them has seen your demo.

What each seat weighs, and what to hand it:

What goes into a value analysis submission

A value analysis submission is the packet the committee reviews, assembled by value analysis staff from the requester's input and the vendor's documents. Vendors who hand over the pieces in the committee's format save the staff weeks. The submission should cover eight areas:

Most submissions struggle because they lead with clinical outcomes and bury the capacity return. Put capacity and cost on the first page, because finance and supply chain hold as many votes as the physicians. A lower price rarely rescues a submission that has no capacity case, because it only moves the conversation to what the product costs.

Why the physician who wants your product may not be in the room

A request typically starts with a physician, and that physician is often absent when the committee decides. In a 2024 survey of 1,635 US healthcare leaders by GHX and AHVAP, 85% reported less than strong physician engagement in value analysis. A request without its physician voice reads to the committee as a vendor asking, rather than a department needing.

The champion should present in person, or send a physician colleague who can answer clinical questions. Before the meeting, the champion should talk to the committee members who will vote, so no one sees the request for the first time on the agenda.

"

"Don't build it in a silo and present it cold. Months before the meeting, ask the people in the room what they'd fix and what blocks them. By the time you present, everyone feels they were part of it."

Joliene van Grieken Co-founder, The Growth Syndicate

Where software goes instead

Software often skips the value analysis committee altogether. The Advisory Board describes these committees as managing medical and surgical products used within hospitals and IDNs, including commodities, supplies and physician preference items, and in practice many health systems route software through IT governance and, increasingly, a dedicated AI governance committee. Ask the champion which route your product takes in the prospect's system before you build the submission.

Gate 5: how do GPOs, IDNs and hospital contracting work?

Contracting is where the hospital decides how it will buy. In the US that runs through group purchasing organizations, which negotiate agreements hospitals can buy under, and through health system contracting teams that standardize purchases across sites. Buying through a GPO is voluntary, so a GPO contract helps a sale but rarely makes one on its own.

What is a GPO in healthcare?

A group purchasing organization (GPO) is an organization that negotiates contracts with manufacturers and distributors on behalf of member hospitals, which then buy at the negotiated terms. A 2009 industry study cited by the GAO in 2010 put GPO contracts at about 73% of hospitals' non-labor purchases, and industry figures cited by the GAO in 2014 put GPO use at 96% to 98% of US hospitals, with two to four GPOs each on average.

GPOs are paid by vendors. Vendors pay administrative fees on member purchases, which the Anti-Kickback Statute's GPO safe harbor permits when there is a written agreement with each member, the fee is 3% or less of the purchase price or the amount is disclosed, and the fees are reported to members. The GAO found weighted average fees of 1.22% to 2.25% across six large GPOs in 2008.

The market is concentrated, and it has been for decades. Vizient, Premier and HealthTrust are the three names most vendors meet, and Premier's fiscal 2025 annual report counts more than 4,250 acute care healthcare providers among its members. In the GAO's 2010 report, the six largest national GPOs accounted for almost 90% of hospital purchasing through GPO agreements in 2007.

What is a GPO contract?

A GPO contract is an agreement between a vendor and a GPO that sets price tiers, the administrative fee, the contract term and the conditions under which members can buy. It makes a product purchasable on pre-negotiated terms without committing any member to buy it. Being on contract removes one objection from supply chain, but it does not create a champion.

GPOs award agreements by product category through competitive bids on a cycle, which can leave a new entrant waiting for a category to reopen. Some GPOs run separate programs for innovation that has no existing contract category, such as Vizient's Innovative Technology Program, which suppliers enter through an online submission. Ask your first customers, and every serious prospect, which GPOs they belong to, because an agreement nobody buys under is paperwork.

What is an integrated delivery network?

An integrated delivery network (IDN) is a health system that owns or manages hospitals together with other care settings, such as physician groups and outpatient centers, under one management. Large IDNs usually run their own system-level contracting and value analysis, standardizing a product across every hospital once it is approved.

Larger systems lean less on GPOs because they can negotiate for themselves. A 2003 Lewin Group survey of purchasing managers, summarized in a 2014 Wharton literature review by Lawton Robert Burns for the AHA and AHRMM, found that freestanding hospitals routed 79.6% of purchases through GPOs, against 50% for 13-hospital systems. The data are more than 20 years old, so treat them as a direction, and for a large IDN expect system contracting to be the real Gate 5, with the GPO as a pricing reference.

The two are easy to confuse because both sit between you and the hospital. The difference in how they affect your deal:

Do you need a GPO contract to sell to hospitals?

No. GPO use is voluntary, and the Healthcare Supply Chain Association, the GPOs' trade group, says providers are free to purchase off-contract and often do. Off-contract purchasing costs more effort, because each prospect's supply chain team has to negotiate terms locally and some systems require a justification for buying outside a contracted category.

In practice, early-stage companies start off-contract, with direct agreements at their first sites. A GPO contract becomes worth the negotiations once several customers ask for it, or when the target list shifts toward community hospitals that buy mostly on contract. Those negotiations take their own months, so start them when the second or third customer asks.

Gate 6: how do you get from signed contract to daily use?

A signed contract gives the vendor permission, and the hospital's staff decide whether the product gets used. Two things sit between signature and value: vendor credentialing, which controls whether your people can be on site, and adoption, which decides whether clinicians and front-office staff change how they work. Renewal depends on the second.

What is hospital vendor credentialing?

Hospital vendor credentialing is the process a hospital uses to verify that vendor representatives entering clinical or restricted areas meet its requirements. The ANSI/NEMA SC 1-2020 standard for supplier credentialing sets out the typical hospital vendor credentialing requirements: a background check and drug screen, sanctions checks, immunizations, annual HIPAA and other training, and acknowledgment of hospital policies, with liability insurance held by the company.

What each requirement asks for, and how much of it applies to a software company:

Hospitals run credentialing through platforms such as symplr, GHX Vendormate, IntelliCentrics and Green Security, and a vendor that sells into many systems pays for several. AdvaMed has estimated that the total annual cost of vendor credentialing, borne by suppliers and providers, exceeds $800 million, a figure the Consortium for Universal Healthcare Credentialing cites in its push for a common standard. That figure is an industry estimate.

For a medical sales rep who supports cases in the operating room, credentialing is part of the job every week. For a software company with no one on site, it usually shrinks to remote-access agreements and user accounts, which the security review already covers.

Enabled is not used: planning adoption before go-live

A product that is live but unused will not survive its renewal, because using it means changing clinical practice. The gap between a tool that works in a validation study and one that works in a busy clinical environment is well documented. In a CHI 2020 study of a deep learning system for diabetic eye disease, Beede and colleagues observed nurses in eleven clinics across Thailand and found tensions between the model's thresholds for data quality and the data a resource-constrained clinic could actually produce.

Implementation shapes performance as much as the product does. KLAS's Arch Collaborative, whose dataset holds feedback from more than 700,000 clinicians, reported in its 2025 key drivers report that only 26% of physicians at organizations in its lower levels (1 to 3) agreed their EHR enables efficiency, against 70% at the top level. KLAS traces the gap to education, governance and personalization, all of which depend on how the organization implements and supports the system.

An adoption plan belongs in the proposal. It names super-users among the department's physicians and nurses along with any implementation partners, schedules training inside the workflow, sets a weekly usage measure per user, and gives the champion usage reports they can take to the next budget meeting.

Renewal is the gate nobody maps

Most digital health contracts come back up for decision quickly. In the Peterson Health Technology Institute's 2025 State of Digital Health Purchasing, a survey of 309 decision-makers at health plans, employers and health systems run with NORC, 73% of contracts lasted two years or less and more than half of respondents reviewed their offerings annually.

That makes utilization data the first page of next year's value analysis submission. A vendor that can show usage by department, by user and over time goes into every future renewal with the evidence the committee will ask for, while a vendor that cannot is back at Gate 1.

How do you run a hospital pilot that converts into a contract?

A hospital pilot converts when it is designed backward from the contract: a signer named in advance, a budget line and date, success metrics the budget holder accepts, near-zero staff effort, and a readout scheduled before the budget closes. Its real job is clearing Gates 2 to 5, and proving the product works is the smaller part.

Published data on pilot conversion is thin. In a 2017 Rock Health survey of 85 digital health startup founders, 60% to 70% of pilots converted to full customers, but the respondents were the startups themselves, reporting on pilots they had chosen to run. Treat that as an upper bound rather than a forecast.

Plan the pilot as the device that produces each gate's evidence over the course of the pilot:

The conversion clause is the part most vendors skip. If the price at scale and the contract vehicle are not written down before the pilot starts, the hospital will negotiate them from zero after it ends, sometimes with a new budget owner. That is also where a marketing-sourced opportunity becomes a sales-owned deal, and where sales and marketing alignment gets tested: the team that generated the pilot has to hand over the gate evidence along with the contact.

A prospect that will not name a signer or a budget line before the pilot starts is telling you where the deal will stall. Hope is not a conversion plan, and neither is a champion's enthusiasm.

How does account-based marketing work for health systems?

Account-based marketing for health systems targets a named list of systems and, inside each one, the department that owns the problem and the people who run each gate. The unit of targeting is a buying center, meaning the persona, budget holder and approver, and content is sequenced so security and value analysis teams hear from you before the deal reaches them.

The account universe is small enough to name. The AHA counts 397 health systems and the AHRQ 639, plus independent hospitals, and Epic's 56.9% share of hospital beds lets you segment by EHR where integration matters. For most health tech companies, account based marketing in healthcare is simply the only sensible strategy, because every prospect can be named in advance.

Coverage by gate is what separates hospital ABM from a campaign aimed at job titles. The champion needs peer evidence, the budget holder a capacity model, the CISO a security page they can review without a meeting, value analysis staff a submission-ready summary, supply chain your contract status, and hospital leadership a system-level business case. Account-based marketing programs that only reach the champion leave five gates dark.

"

"ABM only works in my opinion (the one-to-one, focus on one company) if the deal size is at least like 300K a year. Otherwise, why spend all that effort on one client?"

Clément Dumont Co-founder, The Growth Syndicate

Tier the list by the size of the deal you can realistically win:

TGS ran this for a hospital-facing AI company selling four hospital products. Each product was aimed at the team that used it, with its own persona, budget holder and approver, rather than at "the hospital", and the program generated more qualified interest than the client's sales team could follow up. Our ABM agency team now starts every health tech program by naming the department before naming the account, because the insights that move a hospital deal are department-specific.

How is selling to hospitals different in Europe?

Public hospitals in Europe buy through procurement law. Above €216,000 for supplies and services, a purchase must go through an EU-regulated tender, run by the hospital or by a central purchasing body, and is awarded to the most economically advantageous tender. Value analysis and contracting merge into that tender, and marketing's window closes when it opens.

The routes differ at almost every gate:

Tenders, MEAT and the window before the tender

From January 1, 2026, the EU threshold for supplies and services fell to €216,000 for sub-central contracting authorities, which covers most public hospitals, and €140,000 for central government, under Commission Delegated Regulation (EU) 2025/2152. Tenders above those values must be advertised EU-wide, with notices published on TED, the online supplement to the Official Journal. Under Directive 2014/24/EU, the contract goes to the most economically advantageous tender (MEAT), judged on price or cost, such as life-cycle costing, or on the best price-quality ratio.

The window that matters is before publication. Article 40 of the directive allows preliminary market consultations, provided they do not distort competition, in which hospitals ask suppliers what the market can deliver while they write the specification. A vendor whose capacity case and evidence reach the physicians and procurement officials at that stage helps shape the criteria, while a vendor that first hears of the need on TED is answering someone else's specification.

Central purchasing bodies are Europe's closest equivalent to GPOs, with one legal difference: a hospital buying through a framework the body has already tendered meets its obligations under the directive, although it still runs any mini-competition itself. France's UniHA handles about €6.7 billion of hospital purchasing a year, and pooled purchasing accounts for 35% of French hospital purchasing spend, according to Marie Daudé, head of the health ministry's hospital care directorate (DGOS), in testimony to the French Senate on May 13, 2025.

Selling to NHS trusts in England

NHS trusts usually buy digital products through framework agreements, which let trust procurement officials buy without running a full tender of their own. Most digital frameworks are run by the Government Commercial Agency (formerly Crown Commercial Service), NHS Shared Business Services and regional NHS procurement hubs, and NHS Supply Chain, better known for devices and consumables, runs some too, such as its Digital Diagnostic Solutions framework.

Trusts also check each digital product against the Digital Technology Assessment Criteria (DTAC), which cover clinical safety, data protection, technical security, interoperability, and usability and accessibility. In February 2026, NHS England introduced a revised DTAC form with 25% fewer questions and less duplication with the Data Security and Protection Toolkit (DSPT) and the pre-acquisition questionnaire, and the old form could not be used from April 6, 2026.

England is also changing how value is scored. The Department of Health and Social Care's value-based procurement guidance of June 11, 2026 caps whole-life cost at 40% of the evaluation weighting and sets value domains at 60% or more, including at least 10% for social value. A capacity case built for a US budget holder converts almost directly into that format, and puts the vendor in a stronger position than one competing on price.

The assurance standards a vendor meets in England, and who completes each:

Germany, Spain and the smaller markets

Germany's hospital digitization fund, the Krankenhauszukunftsgesetz (KHZG), made up to €4.3 billion available, €3 billion of it from the federal government and the rest from the Länder or hospital operators, and required at least 15% of funding to go to IT security. Since January 1, 2025, hospitals that do not offer the digital services the law specifies face a deduction of up to 2% of the invoice for each inpatient and day-patient case, first assessed at the end of 2025, which gives German buyers a deadline of their own.

In Spain, payment timing is a gate of its own. Fenin, the Spanish medtech association, reported in its April 2025 debt analysis that public health services took an average of 66 days to pay medical technology suppliers at the end of 2024, measured as supplier-side days outstanding, down from 88 days at the end of 2023. A company entering Spain needs the working capital to carry that.

In many ways, smaller markets reward the first reference site even more than the US does, because the physicians there trained together and still talk. Treat each country as its own market expansion decision, with its own procurement route, assurance standard and reference customer, rather than as one "European" launch.

What changes when you sell software or medical devices to hospitals?

Software and devices pass the same six gates with different weights. Software spends longest at the security and integration gate and goes to IT or AI governance instead of value analysis, while devices spend longest at value analysis and contracting and bring credentialing with them. The business case and the champion work the same way for both.

Where the time goes at each gate:

Selling software to hospitals

Selling software to hospitals is mostly a Gate 3 problem. The security pack, the BAA and the integration route decide the timeline more than the demo does, and software as a service usually lands in the operating budget, with agreements that come back for renewal within two years. Start the security review early, ship a standalone mode first and instrument usage from day one, because renewal will ask for it.

Selling medical devices to hospitals

Selling medical devices to hospitals is mostly a Gate 4 and Gate 5 problem. A vital signs monitor or a surgical device goes through the value analysis committee, often competes in an existing GPO contract category, draws on the capital budget if it is equipment, and needs credentialed reps in clinical areas. The regulated claims a device can make, and the evidence behind them, are covered in our guide to medical device marketing, and they shape every document in the value analysis submission.

Where this breaks down

The gate map describes how US health systems and European public hospitals buy, and it assumes a product that returns capacity to a department with a budget. Pharma, payers and employers are different healthcare industries with gates of their own. Within hospitals, the map fits less well in six situations:

What to do next

The path forward starts with finding the gate where your deals wait longest, then building the asset that answers that gate's question before the next deal reaches it. Most companies already know which gate that is; the list below maps each stall to the first asset to build, in the order deals hit them.

• If you have no champion yet, pick one department type and one EHR, and build peer evidence and a pitch kit for that buying center before contacting a single prospect.
• If champions like you but nothing moves, find each prospect's fiscal year-end and budget request date, and time the business case to land before it.
• If security review is the queue, assemble the eight-document security pack and send it with the first follow-up.
• If value analysis keeps deferring you, give the committee's staff a submission in their format, with capacity and cost on the first page and a physician sponsor in the room.
• If you are stuck off-contract, ask your current customers which GPOs they use, and open a GPO conversation once two or three ask.
• If pilots never convert, write the conversion price, signer and budget date into the pilot agreement before it starts.
• If you are entering Europe, map the tender and framework route country by country, and get into market consultation before the tender publishes.

Frequently asked questions

Who makes purchasing decisions in a hospital?

No single person does. A hospital purchase needs a clinical or operational champion, a budget holder, IT and security approval, a value analysis or governance committee, and supply chain or system contracting. In most US hospitals the final signature sits with the health system, while the need and the day-to-day use sit with one department.

Should you sell to the hospital or the health system?

Both, in sequence. Start with one department in one hospital, where the problem and the champion are, and win a reference there. Then take that result to the health system, which usually owns the security review, contracting and standardization, and expand to the same department in its other hospitals.

How does a GPO make money?

A GPO earns administrative fees from vendors, set as a percentage of what member hospitals buy under its contracts. A federal safe harbor allows these fees when the member agreement is written and caps the fee at 3% of the purchase price or states the amount, and the GPO discloses what it receives. GAO found 2008 weighted averages of 1.22% to 2.25%.

How many people sit on a value analysis committee?

There is no published benchmark. Committees commonly include physicians, nurses, supply chain, finance, clinical engineering, IT and risk management, and a past co-chair of a Northwestern Medicine committee recommends a maximum of 20 voting members plus nonvoting members. Large systems often add service-line teams below a system steering committee, so a single request can pass through more than one group.

Does a health tech vendor need a business associate agreement?

Yes, if the product creates, receives, maintains or transmits protected health information on a hospital's behalf. HIPAA then treats the vendor as a business associate and requires a signed agreement covering how the data is protected, used and reported if breached. Vendors with no access to patient data usually do not need one.

What is the biggest problem facing hospitals today?

Staff time and cost. About 60% of US hospital expenses go to the workforce, expenses grew 7.5% in 2025, and the median operating margin was 1.4% for 2026 through July, according to Kaufman Hall. That is why hospitals favor products that return clinician hours, beds or throughput over products that promise better outcomes without a capacity number.

Why are doctors selling their practices to hospitals?

Among physicians whose practice was acquired in the past decade, the AMA found the top reasons were to negotiate higher payment rates with payers (70.8%), gain access to costly resources (64.9%) and better manage payers' regulatory and administrative requirements (63.6%). By 2024 only 42.2% of US physicians worked in private practice, down from 60.1% in 2012.

What is the NHS DTAC?

The Digital Technology Assessment Criteria (DTAC) are NHS England's baseline standard for digital health products, covering clinical safety, data protection, technical security, interoperability, and usability and accessibility. A revised form introduced in February 2026 has 25% fewer questions and less overlap with the Data Security and Protection Toolkit.

How much does hospital vendor credentialing cost?

Costs vary by platform and by how many hospitals a vendor serves, because each system can use a different credentialing service with its own fee. AdvaMed has estimated the total annual cost of vendor credentialing, borne by suppliers and providers, at more than $800 million, a burden the ANSI/NEMA SC 1-2020 standard aims to reduce.