Healthcare · Interoperability and integration infrastructure
You pass assurance at one trust, then start again.
You sell the connective layer: integration engines, FHIR APIs and data exchange. An NHS business case missed in December usually waits for April, and DACH tenders arrive with criteria that fit a competitor. In a 2025 survey of German hospital leaders, the largest group, 46%, expects the main KIS tender wave in 2027.
- Typical deal, DACH hospital
- €25–500k a year Illustrative
- Sales cycle, NHS trust
- 3–24 months Illustrative
- Buying panel
- 5–12 people Illustrative
Updated 5 October 2026 · Based on Panelhop research, October 2026
At an NHS trust or a German hospital5–12 people Illustrative
The short answer
How do healthcare interoperability vendors sell to NHS trusts, German hospitals and US payers?
Interoperability vendors sell integration engines, FHIR APIs and data exchange to healthcare buyers through partners and public tenders, timed to compliance deadlines. US payers buy to meet CMS-0057-F API requirements, primarily by 1 January 2027. NHS trusts and German hospitals buy through frameworks and tenders, and deals stall on DTAC, DSPT or C5 Type 2 assurance.
Interoperability and integration infrastructure · How a deal really moves
The buyer’s calendar sets your close date. Business cases, assurance, tenders and works councils decide it. The same deal, timed to funding and tenders. Funding flagged weekly, assurance contacts named before the bid.
One trust or hospital, 5–12 people plus formal approvers and an estimated 3–24 months at NHS trusts, 6–24 months in DACH.
What opens a deal
- NHS digital funding round: Funding · UK
- KIS tender wave, 2027: Technology · DE
- EPR award or go-live: Technology · UK
- C5 Type 2 and NIS2: Security · DE
- ICB mergers, 1 April 2027: Consolidation · UK
- EHDS conformity in tenders: Regulation · EU
Signal Desk · weekly: In-market accounts, scored and mapped
Your buyer and who decides
An NHS trust or hospital
Also German hospitals and HIEs
Panel Check · coverage baselined
- Digital and IT lead, can Veto: A rip-and-replace that interrupts live clinical systems.
- Integration team: A backlog that grows with every new connection.
- CCIO or medical director, can Veto: Duplicate records and extra clicks.
- Information governance, can Veto: Patient data leaving the jurisdiction.
- Clinical safety officer, can Veto: Patient harm from wrong or missing data.
- Procurement: An award challenge, or a supplier missing from the framework.
- Finance and the board, can Veto: Capital lost because it was not committed by year end.
- Works council (DACH), can Veto: Staff monitored through logs and dashboards.
How the deal moves
Funding window Typical time: 1–6 months
- Where it stalls
- Miss December, and the deal waits for April
- With Panelhop: Signal Desk
- Funding rounds, capital plan lines and KIS decisions, flagged weekly
Partner route
Market engagement Typical time: 1–3 months
Assurance Typical time: 1–4 months
- Where it stalls
- Assurance starts from zero at every trust
- With Panelhop: Leak Fix
- Safety officer, SIRO and security named, assurance pack before the bid
Tender or call-off Typical time: 3–6 months
- Where it stalls
- The tender clock isn’t in your forecast
- With Panelhop: Leak Fix
- Publication, clarification and submission dates become deal fields
Award and standstill Typical time: 1–3 months
Go-live
- Where it stalls
- Go-live waits on the works council and IT
- With Panelhop: Leak Fix
- A handoff names the IT owner, supplier contact and works agreement
Renewal
Panel Ops · monthly: Scores and plays tuned against the baseline
Illustrative Source: Stages, seats, triggers and stalls from Panelhop research, October 2026; Bundesministerium der Justiz, Gesetze im Internet; NHS England; the services as described on the Services page. Note: Durations, panel sizes and cycle lengths are Panelhop estimates from our research, not measurements.
At a glance
| Typical deal, DACH hospital | €25–500k a year Illustrative |
|---|---|
| Sales cycle, NHS trust | 3–24 months Illustrative |
| Buying panel | 5–12 people Illustrative |
| How deals start | Through partners and core-system suppliers, or a contact-sales form |
Source: Panelhop research, October 2026. Note: Values marked Illustrative are Panelhop estimates from our research, not measurements.
Tenders stall when assurance starts at the bid.
Where do vendors lose interoperability deals with NHS trusts and German hospitals?
Vendors lose interoperability deals with NHS trusts and German hospitals at the partner route, at the tender and at assurance. After award, integration owners are named late and the first connection rarely spreads. Each leak is a system problem you can see in your own CRM.
Where the pipeline leaks: 5 points across 8 stages.
Your partner and your rep work the same trust
- What you see
- A partner and your own rep work the same trust or health system, and neither knows.
- Why it happens
- Partner overlap is not recorded per account, so partner-sourced deals go unattributed and partners are never used to open executive doors.
Stage Partner route
The tender arrives written around a competitor
- What you see
- A DACH tender or NHS notice appears with criteria that fit a competitor.
- Why it happens
- KIS decisions, capital plans and market engagement are not tracked per account. In a 2025 survey of German hospital leaders, the largest group, 46%, expects the main KIS tender wave in 2027.
Stage Market engagement
You build DTAC and DSPT evidence under bid deadline
- What you see
- Bids stall while DTAC, DSPT or a C5 attestation is assembled under deadline.
- Why it happens
- DTAC, DSPT and C5 evidence is assembled for each bid rather than kept as a ready pack, so every trust or hospital review starts from scratch.
Stage Assurance
Interfaces wait months for the trust’s IT team
- What you see
- Interfaces wait months for the trust’s IT team and the core-system supplier.
- Why it happens
- The IT owner and supplier contact are not part of the tender work.
Stage Go-live
Each new connection restarts security review and funding
- What you see
- A customer runs your integration in one department or site, and every further connection restarts security review and funding.
- Why it happens
- Nobody keeps a whitespace map by site, department and connected system.
Stage Renewal
Compliance dates and core-system changes open the work.
What triggers healthcare providers and payers to buy interoperability software?
Healthcare providers and payers buy interoperability software when compliance dates, core-system replacements, cloud and cyber rules, EU data space rules or NHS restructuring force a change. Each one has a published date, so it can sit on the account record months ahead.
The 6 events that open or close the window for a deal.
Regulation
CMS-0057-F payer API deadline
- What happens
- Medicare Advantage, Medicaid, CHIP and federal exchange plans must meet CMS-0057-F’s API requirements, primarily by 1 January 2027, and older Patient Access API contracts do not cover the new scope.
- Where to spot it
- The CMS rule page, plan association vendor showcases and payer developer portals.
- Window
- By our estimate, Q4 2026 is the late-buyer window: plans still behind favour vendors with live, compliant connectivity and short go-lives.
Technology
KIS tender wave in Germany
- What happens
- In a 2025 survey of German hospital leaders, the largest group, 46%, expects the main KIS tender wave in 2027, as many hospitals face a forced change of core system.
- Where to spot it
- TED and German tender portals and the hospital IT trade press.
- Window
- Adjacent integration work is scoped around each new KIS, so engage before the tender is written.
Technology
EPR award or go-live in England
- What happens
- An NHS trust signs or goes live with a new EPR, often with national digitisation funding, and re-procures the integrations around it.
- Where to spot it
- Find a Tender and Contracts Finder award notices and trust board papers.
- Window
- By our estimate, adjacent tools are decided 12–24 months before go-live.
Security
Cloud and cyber rules in Germany
- What happens
- Cloud services processing German health data have needed C5 Type 2 since 1 July 2025, with an exception for newly launched systems, and 3,354 health-sector entities had registered under NIS2 by 30 June 2026.
- Where to spot it
- SGB V cloud rules, BSI NIS2 statistics and supplier questionnaires from German hospitals.
- Window
- Every new cloud contract and every renewal.
Consolidation
ICB mergers in England
- What happens
- Integrated care boards fell from 42 to 36 on 1 April 2026, with more mergers due on 1 April 2027, so shared care record and population health contracts consolidate.
- Where to spot it
- NHS England merger guidance and ICB board papers.
- Window
- Decisions freeze before a merger and concentrate in the larger board after it.
Regulation
EHDS conformity in EU tenders
- What happens
- The European Health Data Space phases in EU rules for exchanging health records from 2027 to 2031, and hospital tenders for core systems and integration are expected to ask for EHDS conformity.
- Where to spot it
- EU implementing acts, national eHealth agencies and tender requirements on TED.
- Window
- Implementing acts are due by March 2027; patient summaries and e-prescriptions follow by March 2029, and imaging, results and discharge reports by March 2031.
IT sponsors it; governance and safety can stop it.
Who signs off on interoperability software at an NHS trust or a German hospital?
At an NHS trust or a German hospital, the CIO or director of digital usually sponsors interoperability software, and finance or the board approves it. Information governance, clinical safety and, in Germany, the works council add approvers who can each stop the deal. At a US health plan, IT and compliance take these seats and utilisation management joins for the prior authorisation API, while CMS-0057-F sets the date.
By our estimate, 5–12 people sit on the panel, and NHS trusts and German hospitals add formal approvers who can veto.
At an NHS trust or a German hospital: 5–12 people
Digital and IT leadership
Can Veto
CIO · Director of Digital (NHS) · Leitung IT (DE)
- Cares about
- Fewer interfaces to maintain and standards-based exchange.
- Worries about
- A rip-and-replace that interrupts live clinical systems.
Integration team
Integration Team Lead · Interface Analyst
- Cares about
- Mapping effort, standards support and fit with the existing integration engine.
- Worries about
- A backlog that grows with every new connection.
Clinical informatics
Can Veto
CCIO (NHS) · Ärztliche Direktion (DE)
- Cares about
- Clinicians seeing the right data inside their own workflow.
- Worries about
- Duplicate records and extra clicks.
Information governance
Can Veto
SIRO (NHS) · Caldicott Guardian · Datenschutzbeauftragte (DE)
- Cares about
- A signed-off DPIA, DSPT status and a lawful basis for sharing data.
- Worries about
- Patient data leaving the jurisdiction.
Clinical safety (NHS)
Can Veto
Clinical Safety Officer
- Cares about
- The supplier’s DCB0129 safety case and hazard log.
- Worries about
- Patient harm from wrong or missing data.
Procurement
Head of Procurement (NHS trust) · Vergabestelle (DE)
- Cares about
- A compliant route to market: G-Cloud, an NHS framework or an EU tender.
- Worries about
- An award challenge, or a supplier missing from the framework.
Finance and the board
Can Veto
Director of Finance (NHS trust) · Trust Board · Aufsichtsrat
- Cares about
- Whole-life cost over a multi-year term within funding rules.
- Worries about
- Capital lost because it was not committed by the financial year end.
Works council (DACH)
Can Veto
Betriebsrat · Personalrat
- Cares about
- What the system logs about staff, set out in a works agreement.
- Worries about
- Monitoring of staff through logs and dashboards.
You sell the layer every other system depends on.
What do interoperability vendors sell, and to which healthcare buyers?
Interoperability vendors sell NHS trusts, German hospitals, US payers and health information exchanges the software that moves data between systems, usually without replacing what is already there. Growth runs through ecosystems: marketplaces, integration partner programmes, implementation partners and national data programmes. By our estimate, a US regional health plan deal runs €80k–1.6M a year, often priced per member per month (PMPM); like the DACH hospital range, it is sized on broader software categories.
What vendors of this type sell
- Integration engines and interface services
- HL7 FHIR APIs for payer and provider data exchange
- Connections to health information exchanges and national programmes
- Imaging and specialty data integration
Which health systems and payers buy it
- US payers meeting CMS-0057-F
- NHS trusts and integrated care boards
- German, Austrian and Swiss hospitals
- Health information exchanges and national data programmes
Assurance and the tender calendar set the pace.
How does an interoperability deal move through an NHS trust or a German hospital?
An interoperability deal at an NHS trust or German hospital moves from a funding window through a partner route, market engagement and assurance to a tender or call-off, award, go-live and renewal. A G-Cloud direct award can close in weeks, while competitive NHS tenders take an estimated 12–24 months. Durations are Panelhop estimates of the buyer’s side.
Stage by stage: what you do, what the health system does, and what changes at the 4 stages where deals stall.
| Stage | What you do | What the health system does | Today | With Panelhop |
|---|---|---|---|---|
| Funding window Typical time: 1–6 months to a funded business case | Watches capital plans, funding rounds and KIS decisions, mostly by hand. | Writes a business case from September to December, or bids for state (Land) investment or Transformationsfonds money, with KHZG penalty deadlines setting the timing of digital projects. | Capital plans and KIS decisions are spotted late, by hand. Stalls: Missing business-case season. An NHS business case not written by December usually waits for the next April to March year. | Each week, trusts and hospitals with a funding round, a capital plan line or a KIS decision arrive in your CRM, scored, with the signal that fired. Signal Desk In-market accounts, weekly |
| Partner route | Reaches the buyer through EPR or KIS suppliers, integrators and marketplaces. | Asks its core-system supplier and integrator which partners they support. | Nobody knows which partner touches which account. | A required partner field at entry and a role map per tier show which partner and which seats touch each account. Leak Fix We build the fixes |
| Market engagement Typical time: 1–3 months | Answers pre-tender questions and gives demos. | Runs market engagement and writes requirements, often with an adviser. | You meet the buyer after the tender is drafted. | Trusts and hospitals running market engagement arrive in the weekly list, scored, with the buying group mapped and the signal that fired. Signal Desk In-market accounts, weekly |
| Assurance Typical time: 1–4 months, or a few weeks with the evidence ready | Completes DTAC, DSPT and DCB0129 in the UK, or proves C5 Type 2 and EU hosting in Germany. | Clinical safety, information governance and security sign off, trust by trust. | Assurance evidence is assembled under bid deadline. Stalls: Assurance repeated trust by trust. Each NHS trust runs its own governance and cyber sign-off, so a pass at one trust carries little weight at the next. | Stage exit criteria require the clinical safety officer, SIRO and security contacts and the assurance pack request before the bid. Leak Fix We build the fixes |
| Tender or call-off Typical time: 3–6 months for an EU tender | Bids in a UK or EU tender, or a framework call-off. | Scores bids on quality and price; German and Austrian public hospitals must tender above the EU threshold, and Swiss hospitals follow their own thresholds. | Tender deals are forecast like any other deal. Stalls: Tender dates outside the forecast. Tender deals are forecast like any other deal, so close dates ignore the publication, clarification and submission timetable. | Stage exit criteria and forecast tracking carry each tender’s publication, clarification and submission dates, so close dates follow the procurement timetable. Leak Fix We build the fixes |
| Award and standstill Typical time: 1–3 months to sign | Waits through the award notice, the standstill period and board approval. | Publishes the award, observes the standstill and, for large contracts, takes it to the board or supervisory board. | Close dates ignore standstill periods and board dates. | Forecast tracking carries the award notice, standstill and board approval dates as deal fields. Leak Fix We build the fixes |
| Go-live | Builds interfaces with the trust’s or hospital’s IT team and the EPR or KIS supplier. | Tests, completes clinical safety sign-off (DCB0160) and, in Germany, signs a works agreement. | Integration owners and the works agreement are found after the award. Stalls: Works agreement before go-live. In Germany, any system that could monitor staff needs a works agreement, and the works council can hold go-live until it is signed. | A handoff document, built from the deal, names the IT owner, the core-system supplier contact, the integration scope and the works agreement status. Leak Fix We build the fixes |
| Renewal | Plans for re-procurement before the term runs out. | Re-procures when a call-off or framework term ends; G-Cloud 14 call-offs last 48 months at most, and G-Cloud 15, launched in August 2026, allows up to 60 months. | Call-off end dates live in a contracts folder. | Panel Ops checks every week that the renewal tasks tied to call-off and framework end dates have run. It re-scores accounts each quarter and reports against the baseline every month. Panel Ops We run it monthly |
Track the tender calendar and the assurance gates.
How does Panelhop help interoperability vendors sell to providers and payers?
Panelhop helps interoperability vendors by tracking each account’s tender calendar and assurance gates, then working the stages that leak. Signal Desk (in-market accounts, weekly) watches funding windows and tenders, and a Panel Check (GTM audit) sets a stage-by-stage baseline from your own CRM data. Leak Fix (we build the fixes) and Panel Ops (we run it monthly) do the rest.
What we baseline and report
- Target accounts engaged before a tender or call-off is published, against the baseline
- Days each deal spends in assurance and security review, against the baseline
- Days from award to go-live across new customers, against the baseline
Other vendor types in healthcare.
What other vendors sell to health systems and payers?
The same health systems and payers buy from these vendor types too, through different panels and pipelines.
- Vendor type
Patient access and front-office automation
Scheduling, intake, eligibility, financial clearance and AI call handling for health systems, hospitals and physician groups.
Read the pipeline - Vendor type
Revenue integrity, coding and claims software
AI coding, claim scrubbing, charge capture, risk adjustment coding and denial prevention for providers and billing companies.
Read the pipeline - Vendor type
Health system operations and care delivery platforms
Capacity, patient flow, asset tracking, care coordination, pharmacy and workforce platforms for large health systems.
Read the pipeline
The words your buyers use, defined.
What do terms like “HL7 FHIR” and “Integration engine” mean?
Plain definitions of the terms that come up when you sell interoperability and integration infrastructure to health systems and payers.
- HL7 FHIR
- Fast Healthcare Interoperability Resources, the current standard for exchanging health data through web APIs. CMS-0057-F requires Medicare Advantage, Medicaid, CHIP and federal exchange plans to use it, and NHS and German programmes use it too.
- Integration engine
- Middleware that routes and translates messages between clinical systems, so a new application connects once rather than to every system separately.
- G-Cloud
- The UK public sector framework for cloud software. NHS bodies call off from it directly, so a G-Cloud or NHS framework listing often decides which suppliers a trust can use without a full tender.
- DCB0129 and DCB0160
- The NHS clinical safety standards for health IT. DCB0129 applies to the supplier’s safety case and hazard log; DCB0160 applies to the trust that deploys the system.
- C5 Type 2
- An auditor’s report against the BSI’s Cloud Computing Compliance Criteria Catalogue (C5) showing a cloud provider’s controls worked over a period. German providers and insurers need it for cloud processing of health data.
- Health information exchange (HIE)
- A regional or national network that shares patient records between providers. HIEs and national data programmes buy connectivity, standards mapping and consent tools.
Answers before your next health system deal.
What do vendors of interoperability and integration infrastructure ask about selling to health systems and payers?
How do interoperability vendors sell software to NHS trusts?
Interoperability vendors sell to NHS trusts through frameworks such as G-Cloud or through competitive tenders. Each trust first runs its own assurance: DTAC, DSPT status, a DCB0129 safety case and a data protection impact assessment (DPIA) signed off by the SIRO or Caldicott Guardian. Business cases are written from September to December and signed from January to March, so vendors need to engage during business-case season.
Do you need a C5 Type 2 attestation to sell cloud software to German hospitals?
Yes. Cloud services that process health data for German providers and insurers have needed a current C5 Type 2 attestation since 1 July 2025, with a temporary exception for newly launched systems. German hospitals check it in audits and tenders, and they also ask for EU hosting and, where a system could monitor staff, a works agreement signed with the works council.
How does CMS-0057-F affect vendors selling to health plans?
CMS-0057-F gives vendors a dated buying window at US health plans. Medicare Advantage, Medicaid, CHIP and federal exchange plans must run new FHIR APIs, primarily by 1 January 2027, after prior authorisation provisions took effect in 2026. Older Patient Access API contracts do not cover the new scope. Time outreach to each plan’s readiness and map its compliance, IT and operations owners.
How long does it take to sell integration software through an NHS or German tender?
A G-Cloud direct award to an NHS trust can close in weeks, while competitive NHS tenders with trust, regional and sometimes national approvals take an estimated 12–24 months. A German EU tender takes about 3–6 months once published, by our estimate, after months of preparation and funding approval. Overall, interoperability deals take an estimated 6–24 months with US payers and DACH hospitals and 3–24 months with NHS trusts.
How do partner channels affect pipeline for healthcare interoperability vendors?
Partner channels shape much of the pipeline for healthcare interoperability vendors: marketplaces, integration partner programmes, implementation partners and core-system suppliers all touch the same health systems, trusts and hospitals. Record which partner touches each account, so partner-sourced and direct deals are attributed and partners can open doors to executives.
Who buys interoperability software at a US health plan?
At a US health plan, the IT or compliance leader who owns the CMS-0057-F deadline usually buys interoperability software. IT security and legal then review the deal, and utilisation management and the medical management committee join when it covers the prior authorisation API. Health plans usually buy best-of-breed tools rather than suites, and deadline-driven compliance purchases move faster than the estimated 6–24 months a typical health plan deal takes.
Where the numbers come from.
Sources
Sourced figures link to their source below. Figures marked Illustrative, and figures given as estimates, are inferred from Panelhop research. Vendors appear only as types, never by name.
- Centers for Medicare & Medicaid Services, CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) (2024)
- Roland Berger, Krankenhaus IT-Monitor 2025 (2025)
- Bundesministerium der Justiz, Gesetze im Internet, § 393 SGB V: Cloud-Einsatz im Gesundheitswesen (2025)
- BSI – Bundesamt für Sicherheit in der Informationstechnik, NIS-2 in Zahlen (2026)
- Healthcare Leader, Changes to English ICB footprints go live (2026)
- NHS England, Implementing integrated care board mergers and boundary changes to take effect in April 2026 and 2027 (2025)
- Government Commercial Agency, G-Cloud 14 (RM1557.14) (2026)
- GOV.UK (Government Commercial Agency), G-Cloud relaunches with biggest upgrade in its history (2026)
- European Commission, DG SANTE, European Health Data Space Regulation (EHDS) (2025)
- Panelhop research, October 2026: our analysis of the vendors, buying panels, pipelines and triggers for interoperability and integration infrastructure in healthcare, from public sources. Vendor names are not published.
Find where your pipeline to health systems and payers leaks.
