The Harper Bet

A master services agreement gets read closely exactly once. During negotiation, clause by clause, by a lawyer who will have left the company inside of three years. Then it goes into a repository. Every word of it stays binding, and almost none of it gets checked again.

That is not anyone's failure. It's arithmetic. The average hospital carries more than 1,300 vendors, and a single agreement can hold several hundred separate promises: coverage to maintain, notification windows to hit, subcontractors to disclose, records to retain, screenings to run on a schedule. Ponemon found that 27% of healthcare organizations assess all of their vendors even once a year. The other 73% aren't being negligent. They're outnumbered.

We started Harper on a bet that this is about to change, and that what follows from it is much bigger than a line item in a compliance budget.

The bet, plainly

The document that binds a health system or plan to its vendors is the contract. Nothing in the stack reads it.

A decade of compliance software went somewhere else, into the framework. SOC 2, HITRUST, ISO, HIPAA control mappings. Standards written by someone else, general by design, converging on a common control set a little more every year. That was the right problem to solve first because it was the tractable one: evidence collection is mostly plumbing into cloud and HR systems, and one control answers for every customer at once.

But a certification is a proxy. When a vendor hands over a report, a health system learns that the vendor met a general standard. It learns nothing about the agreement between the two of them: the limits that were negotiated, the windows that were agreed to, the flow-downs that were promised. No report has ever stopped an OCR finding, a missed service credit, or an indemnity claim, because none of those live in the framework. They live in the contract.

Why nobody built the other layer

Because it required reading, at a volume that only makes sense if reading is close to free.

Look at what a health system already owns. The CLM - Icertis, Gatekeeper, Ironclad - holds the executed file and does that job well. The GRC platform tracks the framework. Between them sits work that neither one does: turning a hundred pages of prose into a few hundred discrete commitments, each with an owner, a trigger and a clock, and then keeping every one of them true for years. Priced at a person reading a document, that work costs more than the risk it prevents. So it doesn't happen. It gets deferred to audit prep, where a fraction of it happens under pressure.

That constraint held for as long as reading was expensive. It isn't anymore.

The failure mode has a name

We call it compliance drift: the distance between what a health system signed and what is actually happening. It opens the day of signature and widens every quarter, because the promise is static while everything it depends on moves. Vendors get acquired. Subprocessors change. The policy that satisfied a clause gets rewritten by someone who never saw the clause.

Drift never announces itself. It surfaces adversarially and late, in an audit, a breach, a renewal fight, or diligence on the health system itself. Which is to say it surfaces at the exact moment someone else is looking for it and you aren't.

What the manual version costs

Ponemon and Censinet put the cost of third-party risk management in healthcare at $23.7 billion a year, around$3.8 million per provider. That number is worth sitting with, because almost none of it is software. It's people, reading documents, on salary. The entire global market for third-party risk software is a fraction of it.

Over half of healthcare organizations have had a breach introduced by a vendor. So the budget already exists and the loss already happens. What's missing is anything that reads the agreement the loss violates.

What changes when reading gets cheap

The unit of compliance stops being the document and becomes the obligation. A contract is prose. You can store it, search it, and not much else. An obligation has a party, a trigger, a piece of evidence that would satisfy it, and a date. Expressed that way, compliance can be worked instead of filed.

Verification stops being periodic. Annual assessment exists because assessment is expensive, not because risk arrives on an annual schedule. As the cost of checking falls toward zero, checking becomes continuous, and a health system goes from preparing an answer once a year to holding a live one.

And the cost curve inverts. The same obligation shows up across dozens of agreements in slightly different words. Store it once, canonically, reference it everywhere it appears, and the hundredth contract costs less to process than the first. That is the opposite of how compliance labor has ever worked, and it's the part that makes the whole thing possible.

The ten-year version

Compliance is a tax on ambition, and the tax is regressive.

The cost of proving you're allowed to operate is close to fixed, which means it falls hardest on the smallest party. A five-person company with a real improvement to patient care can't carry a compliance function, so it never clears diligence at a large health system, so health systems buy from the handful of vendors big enough to answer the questionnaire. The tax doesn't only cost money. It quietly decides who gets to participate in healthcare, and it decides it in conversations that never happen.

We'd like that constraint to go away. Not the obligations themselves, which exist for good reasons and mostly trace back to patients. The overhead of proving they're met.

If a health system can verify a small vendor as cheaply as a large one, it can choose the best vendor instead of the safest-looking one. If a plan knows its exposure the day it changes, oversight stops being an annual scramble and starts looking like operations. And if the cost of entry drops, more people build things in healthcare, which puts the constraint back where it belongs: on what's actually possible, not on who can afford to prove it.

That's the bet. Ten years out, we want a compliance officer at a health system to answer "are we covered?" the way a CFO answers "what's our cash position?" - immediately, from a system, with the receipts sitting underneath. Everything we build points at that sentence.