Your forecast sits in security review and next year’s budget.

Selling clinical or EHR-integrated software to a large US health system takes an estimated 6–24 months, typically about 12 months, and scope sets the pace. By our estimate, non-clinical tools without EHR integration close in 4–6 months, academic medical centres take about 18 months and physician practices 1–9 months. Payers and DACH public hospitals also take an estimated 6–24 months, and NHS trusts 3–24 months.

A health system’s buying committee usually has 5–12 people, by our estimate. A clinical or operational champion starts the deal and finance signs it off, while IT, information security, privacy and legal, the AI governance committee and the board can each stop it. In a HIMSS Media survey of 211 respondents, 95% said their organisation involves IT in technology purchasing, 76% executive leadership and 73% finance.

A matched reference is the most reliable route to a health system CIO or CFO: a peer system of similar size and EHR that already uses your product. Associations such as CHIME and HFMA, KLAS visibility and advisers also open doors. Time the approach to a dated trigger, such as a merger, an EHR go-live or a new executive, because health system executives rarely answer cold email.

A health system security review takes an estimated 1–4 months, or a few weeks with the evidence ready, and vendors often start it after the verbal yes. The review asks for SOC 2 Type II or HITRUST evidence, a recent pen test, a subprocessor list and a BAA. NHS trusts add DTAC and DSPT, and German buyers need C5 Type 2 for cloud services. Bringing the CISO, privacy and legal in at discovery shortens the wait.

A hospital pilot becomes a paid contract when it runs as a phased first scope with success criteria. That means an operational budget owner, a success threshold in the hospital’s own metrics and a date that forces a decision. Trials run by innovation teams without those terms often succeed and still never convert. Many health systems now prefer this paid, phased route to an open-ended trial.

Software vendors sell to US health plans through a matrixed buying group with several champions. A business owner such as the VP of care management, utilisation management or quality usually starts the deal, and compliance, actuarial, IT security, legal and the medical management committee then review it. Health plans usually buy best-of-breed tools, time go-lives to the plan year and take an estimated 6–24 months to decide.

Hospitals set IT budgets before their fiscal year starts, so larger purchases must be in the plan. US academic medical centres start department budget planning in Q3 of the prior fiscal year. NHS trusts write business cases from September to December and sign from January to March, because capital not committed by year end is lost. German hospitals fix budgets for the calendar year, with investment money from the federal states (Länder) and the Transformationsfonds, and Hospital Future Act (KHZG) penalty deadlines set the timing of digital projects.

Generic intent data works poorly on its own for vendors selling to health systems. It misses the triggers that open healthcare buying windows: EHR go-lives, mergers, new CIOs and CFOs, CMS-0057-F deadlines, KIS tenders and NHS award notices. Track those as dated fields on each account, with an owner who acts that week. In Panelhop’s analysis of healthcare vendor websites, 3 of 20 run an account-identification or intent tool, and none of those vendors shows sales development or account-based marketing hiring to act on it.