Healthcare software engagement models in 2026: which one to sign
TL;DR
Healthcare software engagement models in 2026 come down to four structures: fixed price; time and materials; a dedicated team; and a paid discovery phase that makes the other three honest. The choice is not about rates. It is about how much of your requirement is written down, and how much is a guess about a regulator, a workflow and an EHR you do not control.
- Firm fixed price puts maximum cost risk on the vendor, so the vendor prices your unknowns in. Cubix puts that premium at 15% to 30%.
- T&M gives a vendor no profit incentive to work efficiently, so it needs a ceiling price and a weekly review.
- A dedicated team is the model where knowledge of your clinical workflow compounds. It needs months of roadmap to repay the ramp-up.
- In our healthcare records, the first contract a buyer signs is a phase, not a platform. The largest engagements grew out of those phases.
The model decides more than the rate
Most vendor comparisons argue about hourly rates. The rate is the smaller number. The model decides who pays when the requirement moves, and in healthcare the requirement moves.
PMI's 2026 Pulse of the Profession reports that around a third of complex projects fail, nearly twice the 13% failure rate for projects overall. PMI does not break that out by industry. Our reading is that clinical software lands on the complex side by default, because of regulated interfaces, clinical sign-off and data nobody has profiled.
Demand also moves faster than specifications. The American Medical Association put professional AI use at 81% in its 2026 survey of nearly 1,700 physicians, more than double the rate when it first asked in 2023. A scope written for a 2023 documentation workflow is not the scope a clinic asks for now.
Vendors price that volatility. Cubix states that fixed-price quotes carry a risk premium, often 15% to 30%. Acquaint Softtech reports the mirror image: without weekly hour reviews and active client direction, T&M engagements run 30% to 60% past the estimate. Neither firm publishes the underlying data, so read both as vendor experience rather than research.
The payer API deadline lands on January 1, 2027
If you are a payer, or you sell software to one, the calendar is already written. The CMS Interoperability and Prior Authorization final rule requires impacted payers to implement a Provider Access API, a Payer-to-Payer API and a Prior Authorization API, and to add prior authorization information to the Patient Access API they already run under the 2020 rule. Those compliance dates generally begin January 1, 2027, and CMS says the exact date varies by payer type. Operational provisions came earlier, generally from January 1, 2026, including a specific reason on every prior authorization denial, with the first public metrics due by March 31, 2026.
The rule also names the stack: FHIR Release 4.0.1, US Core implementation guide STU 3.1.1, SMART App Launch 1.0.0, Bulk Data, OpenID Connect and USCDI data classes. Which standard applies to which API is set out in Table H3 of the rule rather than applied uniformly, so read it per API. Decision windows, for most impacted payers, are 72 hours for expedited requests and seven calendar days for standard ones.
Read that as a contracting problem. The date cannot move, the standards are published, and the edge cases inside your own claims data stay unknown until someone opens it. That is where a single fixed-price signature does the most damage: the vendor meets the date by narrowing the scope, and you find out in December.
How we compared the four models
Four criteria, applied to each model.
- Who carries the cost of a requirement nobody wrote down.
- What the model does to the vendor's incentives, not to its promises.
- How much of your own week the model consumes.
- What happens to compliance work that only becomes visible mid-build.
Contract definitions come from the Federal Acquisition Regulation, the closest thing to a neutral rulebook on contract types. Market claims come from vendors ranking for this query, each quoted with a link. Our own figures come from healthcare contract and estimate records, aggregated, with no client named, and any group with fewer than three data points is not published. Mercury Development sells healthcare software development, so we scored our default model on the same criteria and left its weak spots in.
Healthcare engagement models at a glance
| Dimension | Fixed price | Time and materials | Dedicated team | Paid discovery |
|---|---|---|---|---|
| Best for | A written spec that will not move | Stabilization and unknown scope | A roadmap longer than six months | Anything you cannot price yet |
| What you buy | A deliverable | Capacity by the hour | A team by the month | A decision and its artifacts |
| Cost risk sits with | The vendor | You | Shared | You, and it is capped |
| Change handling | Change order | Next sprint | Next sprint | It is the point |
| Your management load | Low | High | High | Medium |
| Typical length | 8 to 16 weeks | Open, with a ceiling | 6 months and up | 2 to 8 weeks |
| Healthcare failure mode | Compliance work is out of scope | Burn with no parity date | Idle capacity you still pay for | A report nobody builds from |
Fixed price
Fixed price is a real answer when the specification is real. The Federal Acquisition Regulation describes firm fixed price as the type that places maximum risk and full responsibility for all costs on the contractor, while imposing a minimum administrative burden on both parties. That is why buyers like it, and why it is the default in public procurement.
The same rulebook names the precondition: it fits when fair and reasonable prices can be set at the outset, from reasonably definite functional or detailed specifications, and where risk is minimal or predictable with acceptable certainty.
Best for: a bounded piece of work with a written contract of behavior. A read-only FHIR connection, a store release, a defined admin module, an accessibility fix with a published standard to hit.
Where it breaks in healthcare: the vendor owns the risk, so the vendor owns the interpretation. Every clinical exception you did not write down becomes a change order, negotiated after you have paid a deposit and lost your alternatives.
Time and materials
Time and materials is what the federal rulebook reaches for when the work cannot be described yet. Subpart 16.6 permits it only when it is not possible to estimate accurately the extent or duration of the work, or to anticipate costs with any reasonable degree of confidence. The same section is blunt about the cost: T&M gives the contractor no positive profit incentive for cost control or labor efficiency, so it requires surveillance and a ceiling price that the contractor exceeds at its own risk. The permission is generous. The conditions are not optional.
Best for: rescue work, stabilization, integration against a system you cannot see yet, and the first weeks after a failed vendor, when the honest answer to "how long" is "let us open it."
Where it breaks in healthcare: an open meter with no parity date. GAO found federal agencies obligated $139 billion on T&M contracts across five fiscal years, and pushed several of them to price all or part of that work firm fixed price instead, by spotting repetitive tasks and tasks with stable labor hours. Most private T&M contracts never adopt that discipline.
Dedicated team
A dedicated team is a monthly retainer for named people who work only on your product. You set sprint priorities, the vendor manages the team. Acquaint Softtech prices two developers plus a tech lead at $9,500 to $14,000 a month and argues the model runs 15% to 25% below fixed price past the six-month mark, because a retainer carries no scope contingency.
In healthcare the stronger argument is not cost. The expensive knowledge is knowing which rejection code routes to which team and what your data actually looks like. Our longest running healthcare engagement began with interviews with subject matter experts and a written map of Precision Practice Management's claims workflow, before any specification. That system has run since 2006 and is on its fourth major release.
Best for: more than six months of roadmap, a product with real users, and someone on your side who can prioritize weekly.
Where it breaks in healthcare: a thin backlog. You pay for capacity whether or not you fill it, and a team that rotates members every quarter is T&M with a nicer invoice. Ask what happens when someone leaves, before you sign.
Paid discovery, the phase most buyers skip
Discovery is the phase the other three models depend on, and the one buyers try hardest to get for free. The UK Government Digital Service sets the shape: around four to eight weeks is typical, you do not start building during it, and stopping at the end of discovery is not a failure, it is money saved.
A paid discovery ends with artifacts you own and can hand to any vendor: a workflow map by user role, a compliance boundary, an integration inventory naming the systems, a prioritized scope, an estimate your finance team can read. What the phase costs tracks how many systems and user roles have to be opened before anyone can estimate honestly, and the figures from our own records sit further down this page.
Best for: any healthcare build whose brief says "HIPAA compliant" without naming a control, a workflow or a system of record.
Where it breaks: a discovery that produces a slide deck instead of a specification and an estimate. If the output cannot be handed to a competing vendor for a comparable bid, you bought a sales document.
What protected health information does to each model
Compliance scope is discovered, not specified. A brief says the product must be HIPAA compliant. It does not say how many roles touch protected health information, whether audit logs must reconstruct a record view, whether the client already holds a business associate agreement with its cloud provider, or which state adds requirements on top.
Under fixed price, each of those answers arrives as a change order, because none of them sat in the written scope. Under T&M they arrive as hours against no ceiling. Under a dedicated team they arrive as sprint work, which is the only one of the three that behaves like reality.
This is also where the compliance premium gets decided. Controls designed in at architecture cost a fraction of the same controls retrofitted after a security review, and our healthcare app development cost analysis breaks those numbers down. The engagement model decides which of the two you buy.
Which model fits your healthcare project
If you have a signed-off specification, a locked feature set and a date, take a fixed price and invest in the requirements document. It is the cheapest artifact in the project.
If you are rescuing a live product from a vendor who stopped answering, start on T&M with a two-week timebox on the worst bugs, then convert what has become predictable to fixed price. Run the continuity checklist before you take the code.
If you are building against the January 2027 API dates, run a paid discovery first, then a dedicated team, and keep discrete integrations as fixed-price add-ons inside the retainer.
If nobody on your side can answer a product question within a day, fix that before choosing a model. Our guide to managing an outsourced team without a CTO covers the minimum version of that role, and the questions to ask a development agency cover the rest of the conversation.
What our healthcare contract records show
Three patterns come out of our healthcare contract and estimate records, aggregated with no client named.
Healthcare engagements are entered, not bought. The first document a buyer signs is a phase rather than a product, and the platform contract follows with the same client once that phase has answered something. None of our largest healthcare engagements started as a single signature for the whole build.
The phase is priced on its own, and it is not a token. Separately priced analysis and design phases in our records carry a median of $27,000, and the ones below that median covered a single workflow or a single screen. Around 20% of the healthcare accounts we hold records for were offered a priced first phase before any build estimate was issued.
The requests that stall invert the order. In around 10% of our healthcare accounts, the buyer asked for a firm fixed price before answering the requirements questions. We issued no implementation estimate in those cases, because there was no defensible way to produce one.
The model you sign is a bet on who absorbs the unknowns
Opinion, stated plainly. Most healthcare engagement disputes we see are not about delivery quality. They are about a scope that was never knowable at signature, priced as though it were.
The federal rulebook already solved this and private buyers ignore it. Where the entire contract cannot be firm fixed price, it says, consider whether a portion of it can be. Avoid protracted use of T&M once experience provides a basis for firmer pricing. GAO pressed agencies on the same point: price the stable, repetitive parts firm fixed as you learn, and keep the rest flexible.
Applied to a healthcare build, that is one sequence. Buy the knowledge first, in a small capped phase. Fix-price what discovery made definite, such as a named integration or a defined module. Run the moving parts, clinical workflow and compliance controls, on a dedicated team with priorities you set. Then check each quarter for anything predictable enough to move into the fixed column.
Any vendor can quote all four models. The question worth asking is which parts of your scope they will fix-price after discovery, and which they will not. That answer tells you where the risk lives, and it is worth more than the rate card.
Written by Rob Devereaux, Chief Operating Officer at Mercury Development. Rob has run the firm's operations from Hudson, Ohio since 2019 and has over 20 years of operational and financial experience. The healthcare contract and estimate records behind this article's phase and model figures sit in the operations he oversees.
Scoping a healthcare build this quarter? Price the first phase first
You know which model you are being sold. What you probably do not have is a first phase small enough to approve and specific enough to build from. Tell us what the product does, who touches patient data, and which systems it has to reach. We come back with a phased structure you can hold us to.