Funding Routes & Lender Data for Exchange Operators

Health data exchange is capital-hungry in a specific way. There is no inventory and no fit-out, but there is a long gap between signing the first participant and collecting recurring revenue from enough of them to cover a compliance-grade engineering team. That gap is what your funding section has to survive.

SBA lending against NAICS 541512

Most US exchange operators classify under NAICS 541512, Computer Systems Design Services. That code has a usable lending record. Across 9,190 approved SBA loans, the average loan size in this classification is $226K, against a national SBA average of $340K across all industries, and 791 different SBA-approved lenders have funded businesses in the category (PeerSense SBA industry data, 2025). The 7(a) programme dominates because it flexes across working capital, equipment and acquisition, while roughly 6% of loans in the code use the 504 programme for fixed assets. Loan volume in the classification has grown around 46% over recent fiscal years.

Read those numbers honestly. A $226K average tells you SBA debt covers a lean, services-led exchange or the first phase of a larger one. It does not fund a $2M platform build. Founders who try to force the whole raise through 7(a) usually end up under-capitalised at exactly the point integration work peaks.

The realistic capital stack

• SBA 7(a), up to $5M: best used for working capital and the integration engineering team, where the collateral question is answered by contracted participant revenue rather than hard assets.
• Seed venture capital: the dominant route for API-first exchange businesses. Health Gorilla raised a $50M Series C led by SignalFire, taking total funding to $80M (Fierce Healthcare), which sets the reference frame investors carry into your meeting.
• Anchor participant prepayment: a health system or payer prepaying 12 to 24 months of subscription in exchange for pricing protection. This is the most overlooked source of non-dilutive capital in the category and it doubles as commercial validation.
• State and federal programme funding: state-designated entities and public health data modernisation work still carry grant support, though the sector's own literature has treated grant dependence as the central failure mode for well over a decade.
• UK Start Up Loans, up to £25,000 at 6% fixed: useful for a founding team's first six months of DTAC and DSPT work, not for the platform itself.

Whatever the mix, the lender or investor is testing one thing: whether participant revenue arrives before the cash runs out. Build the plan so that answer is legible on a single page.

Your Investor Paragraph, Filled In

Every seed conversation in this category starts with a version of the same paragraph. Write yours before you write anything else, because it forces every downstream assumption into the open. Fill in the bracketed values from your own model:

Three details in that paragraph do most of the work. First, naming the specific data that does not move today, because a general claim about fragmentation is not a market. Second, separating base connectivity from the upsell tier, because that separation is the whole argument for durable margin. Third, giving break-even as a participant count rather than a date, because participant count is something an investor can independently sanity-check against your region.

If you would rather have this written for you against real market inputs, our market research and content package covers the narrative and the supporting evidence base.

Where the HIE Market Is Heading

The global healthcare information exchange market was valued at $2.20 billion in 2025 and is projected to reach $3.85 billion by 2030, an 11.8% CAGR (Mordor Intelligence, 2025). Grand View Research puts the base at $2.02 billion in 2023 reaching $3.86 billion by 2030 at a 9.7% CAGR (Grand View Research), while MarketsandMarkets models $2.09 billion in 2026 rising to $3.40 billion by 2031 at 10.3% (MarketsandMarkets).

A market growing at roughly 10% while the underlying data volume grows far faster tells you something useful: the growth is not in raw connectivity. Connectivity is being commoditised by the national frameworks. The value is migrating to what sits on top of the pipe.

What is actually driving demand

Three forces set the demand curve, and your plan should name all three.

• TEFCA reaching operating scale. Designated Qualified Health Information Networks now include eHealth Exchange, Health Gorilla, Epic Nexus, MedAllies, KONZA, CommonWell Health Alliance, Oracle Health Information Network and Surescripts (The Sequoia Project, TEFCA RCE). National query is no longer theoretical, which changes what a regional exchange can credibly promise.
• Information blocking enforcement moving from rule to action. ASTP began issuing notices of investigation to health IT developers in February 2026, with roughly 1,600 complaints filed through the ONC portal (ONC; HHS OIG). Enforcement converts data sharing from a virtue into a procurement requirement.
• Value-based contracting. Risk-bearing organisations cannot manage total cost of care without event-level visibility into admissions, discharges and transfers occurring outside their own walls. That need is what makes the notification tier sellable at a premium.

The consolidation you should plan around

Regional exchanges are converging. Founding health data networks in the sector include Denver-based Contexture, Baltimore-based CRISP, Omaha-based CyncHealth, the Indianapolis-based Indiana Health Information Exchange and Emeryville-based Manifest MedEx, alongside Michigan's MiHIN. In June 2026 the Florida Health Information Exchange selected CRISP Shared Services to modernise its statewide interoperability, a signal that state programmes increasingly buy shared infrastructure rather than build it (CRISP Shared Services, 2026).

The strategic read for a new entrant is straightforward. Competing head-on with a state-designated entity on general connectivity is a losing position. Building a clinically specific or population-specific exchange, and interoperating with those incumbents rather than replacing them, is a defensible one. Say which of those you are in the first two pages of the plan.

Outside the United States

The UK does not have a private HIE market in the American sense. Data sharing runs through NHS shared care records commissioned at Integrated Care System level, so the commercial opportunity is supplying software and integration into that structure rather than operating an independent network. The European Union is building the equivalent at continental scale under the European Health Data Space, which creates a genuinely new supplier market between now and the end of the decade. Both routes are covered in the compliance section below.

What It Costs to Stand One Up

Published estimates for custom HIE portal development run from $400,000 to $2,000,000 and above, with the main cost drivers being the number of data types handled, the volume of integrations and the sophistication of the capability set (ScienceSoft). That is the build-everything number. Founders who licence an interoperability engine and connect through an existing network route typically land between $180K and $1.45M (£142K to £1.15M) for total launch capital.

The line items founders forget

The platform is the number everyone budgets. These are the ones that get missed, and they all fall due before a single participant pays you.

• CommonWell certification and onboarding: a one-time fee of $10,000 for all Service Adopters to validate compliance with the specification and connectivity to the services, plus annual membership scaled to US health IT revenue (CommonWell Health Alliance).
• Carequality Implementer fees: set on a published schedule tiered by the applicant's annual revenue, and applicable only to Implementers rather than to organisations participating through one (Carequality).
• HITRUST programme costs: beyond assessor fees, MyCSF access runs roughly $3,000 to $6,000 for short-term access or $9,000 to $32,000+ annually by tier, with report credits of approximately $6,000 for e1, $7,000 for i1 and $8,000 to $9,000 for r2. Smaller healthcare startups typically spend $35,000 to $100,000+ in total depending on tier and scope (Sprinto, 2026; Thoropass).
• The r2 recertification cycle: HITRUST r2 requires an interim assessment at the one-year mark and a full reassessment every two years, so it is a recurring line in the model, not a one-off.
• Master patient index tuning: the first three months of live matching almost always exposes duplicate and overlay rates nobody forecast. Budget engineering time for it rather than treating it as a defect.

UK cost profile

A UK entrant selling into NHS Integrated Care Systems faces a different opening bill: roughly £12,000 to £45,000 for DTAC Version 2 readiness including supporting certifications, £4,000 to £20,000 for the Data Security and Protection Toolkit, £8,000 to £30,000 for DCB0129 clinical risk management with a named Clinical Safety Officer, and £3,000 to £18,000 for UK GDPR work including the data protection impact assessment. None of that is optional, and none of it generates revenue.

The Revenue Engine & Unit Economics

Sustainability has been the acknowledged weak point of this sector for as long as it has existed. The pattern is consistent: an exchange launches on grant or state funding, delivers real clinical value, and then cannot convert that value into participant willingness to pay once the grant ends. The plans that get funded today are the ones that solve the pricing question first and the technology question second.

Four revenue lines that actually work

• Participant subscription. Priced per facility, per staffed bed or per credentialed provider per month. This is your base and it should be boring, predictable and contracted for multiple years.
• Per-query and per-record transaction fees. Charged to API consumers such as digital health applications, payers and life sciences partners. Price this net of the QHIN or network pass-through cost, and show that net rate explicitly in the model.
• Interface build and maintenance. A one-time build fee per EHR connection plus an annual maintenance fee. Investors discount this revenue heavily because it is labour-linked, so separate it from recurring revenue rather than blending it.
• Value-added tiers. ADT event notification, risk stratification, quality-measure and registry reporting, and analytics. This is the margin layer and the reason net revenue retention can exceed 100%.

Gross margins at scale sit in the 62% to 78% band. Net margins land between 8% and 22%, and the single biggest swing factor is how much of your integration labour is billable to participants versus absorbed as a cost of winning them.

Who actually signs the cheque

Exchange plans routinely describe the market as "healthcare providers" and stop there. That is not a buyer, and diligence teams treat it as evidence the founder has not sold anything yet. Four distinct buyers exist in this category, and they buy for different reasons, on different cycles, at different prices.

• Health systems and hospitals. They buy visibility into what happens to their patients outside their own walls, usually justified through readmission penalties and care coordination. The decision is committee-driven and slow, but contract values are the largest and renewal is sticky once clinical workflows depend on the feed. Expect a named clinical sponsor plus IT security review plus procurement, and budget 9 to 18 months.
• Ambulatory groups and federally qualified health centres. Price-sensitive, fast to decide, and heavily influenced by peer reference. This segment fills your participant count quickly but will not carry your revenue on its own. Some regional exchanges deliberately waive or discount fees here to build network density, on the reasoning that the network is worth more to large payers when small providers are in it.
• Payers and risk-bearing organisations. The highest-value buyer and the one most likely to fund the notification tier at premium pricing, because event-level admission and discharge data feeds directly into their medical cost management. They also buy analytics, which is where margin lives. Their procurement is sophisticated and they will negotiate hard on data rights, so get the contract language reviewed properly.
• Digital health companies and API consumers. Self-serve, developer-led, fastest to revenue, and the only segment where you can grow without a salesperson. They are also the most price-elastic and the quickest to leave when a cheaper route to the same national networks appears. Treat this revenue as valuable but not defensible on its own.

The practical planning consequence: your customer acquisition cost and sales cycle assumptions have to be modelled per segment, not blended. A plan showing one CAC figure across all four buyers signals to an investor that the go-to-market has not been thought through, and it is one of the most common reasons an otherwise sound exchange plan gets a second-meeting pass rather than a term sheet.

A worked three-year example

Take a regional exchange in its third operating year. It has signed 42 participant organisations at an average subscription of $2,850 per month, giving $1.436M in annual recurring subscription revenue. Of those 42, 26 have added ADT event notification at $780 per month, adding $243K. API partners run 1.9 million record queries across the year at a blended $0.34 net of network pass-through, contributing $646K. Total gross revenue: $2.325M.

Against that, cloud infrastructure, record-locator services and network participation cost $611K, or 26.3% of revenue, leaving $1.714M in gross profit at a 73.7% gross margin. A nine-person team, external audit and the compliance programme cost $1.36M. Operating profit is $354K, a 15.2% net margin.

Notice what that model reveals. The notification tier is 10.5% of revenue but carries almost no marginal cost, so it delivers a disproportionate share of profit. Sixteen participants have not yet upgraded. Converting eight of them adds roughly $75K of near-pure margin, which is a 21% lift in operating profit from a sales motion rather than a build. That is the sentence an investor wants to find in your plan.

The metrics diligence actually probes

• Net revenue retention. Below 100% in an infrastructure business is a serious flag. Show the cohort maths, not just the headline.
• Cost per interface delivered. If this is not falling as interface count grows, you are running a consultancy rather than a platform.
• Time from signature to first data flowing. This is the operational metric that predicts churn. Anything beyond 90 days invites participant regret.
• Query volume per participant per month. The usage proxy for clinical value. Flat or falling query volume predicts non-renewal roughly two quarters ahead.
• Break-even participant count. Express break-even as a participant number, not a calendar date. Dates slip; counts are testable.

Three Ways to Build an Exchange

"Healthcare information exchange" covers three genuinely different businesses with different capital needs, buyers and exit paths. Choosing between them is the first structural decision in the plan, and being vague about it is the fastest way to lose an investor's attention.

Most failed plans in this category try to be two of these at once. The regional model requires patient relationship-building and tolerates slow sales cycles; the API model requires developer-grade documentation, self-service onboarding and volume pricing discipline. The operating cultures are close to incompatible in an early-stage team of nine people.

Pick one, name the other two as adjacent markets you may enter later, and let the financial model follow from that choice. If you want an outside read on which fits your position, our bespoke plan service starts with exactly that assessment.

Compliance, Consent & Network Rules

There is no single "HIE licence" in any major market. What exists instead is a stack of obligations, some statutory and some contractual, and lenders now expect a plan to price the whole stack rather than gesture at HIPAA and move on.

United States

• HIPAA business associate status. An exchange that creates, receives, maintains or transmits protected health information on behalf of covered entities is a business associate. That means an executed Business Associate Agreement with every participant, a documented security risk analysis, and direct liability under the Security Rule. Enforcement sits with the HHS Office for Civil Rights.
• The information blocking rule (45 CFR Part 171). Health IT developers, health information networks and health information exchanges face civil monetary penalties of up to $1 million per violation from the HHS Office of Inspector General, with repeat violations and willful neglect treated most severely (HHS OIG). Enforcement is live: ASTP began issuing notices of investigation of potential nonconformity to developers in February 2026, and roughly 1,600 complaints have been filed through the ONC portal.
• Provider-side disincentives. Separate from the penalties applying to you, CMS disincentives took effect on 31 July 2024, with ACO-participant penalties following on 1 January 2025. A hospital found to be information blocking can lose 75% of its annual market basket increase. This matters commercially: it gives your participants a compliance reason to connect, and it belongs in your sales narrative.
• Rules still in motion. The HTI-5 proposed rule would update the definitions of access and use to cover automated means including AI systems and robotic process automation, revise the Infeasibility Exception, and remove the TEFCA Manner Exception (Covington Digital Health, 2026). Write your compliance section so a rule change does not invalidate it.
• TEFCA participation. QHIN designation is administered by The Sequoia Project as Recognised Coordinating Entity on behalf of ASTP/ONC. Designation is a 12 to 24 month programme with obligations sized for large network operators. Connecting through an existing QHIN takes weeks to months and is the right answer for almost every startup.
• 42 CFR Part 2 and state consent law. Substance use disorder records carry consent requirements distinct from HIPAA, and states split between opt-in and opt-out models. Your consent architecture has to handle the strictest jurisdiction you operate in, and retrofitting it later is expensive.
• State HIE designation. Some states designate a single entity, which shapes whether you can compete at all in that market or must interoperate with the incumbent. Budget $18K to $95K in legal work across participation agreements, BAAs and consent design.

United Kingdom

• DTAC Version 2. NHS England replaced the previous DTAC form on 6 April 2026, and submissions on the old version are rejected. V2 couples to DSPT v8, DCB 0129, Cyber Essentials and ISO 27001 (Naq, 2026).
• The interoperability question got harder. Under V2, suppliers must explain why their chosen APIs and data standards are appropriate, using recognised NHS guidance. A blanket statement that interoperability does not apply is no longer accepted, and reviewers want a reasoned position tied to product type and use case. For an exchange business this is the section that will be read most closely.
• Data Security and Protection Toolkit. Mandatory for any supplier with access to NHS systems or patient data, submitted annually.
• DCB0129. Clinical risk management for the manufacture of health IT systems, requiring a named Clinical Safety Officer and a maintained hazard log.
• UK GDPR and the Data Protection Act 2018. Health data is special category data, so you need a documented lawful basis, a data protection impact assessment and ICO registration.

Practically, DTAC is the first gate before any trust, ICB or GP federation will progress a procurement conversation. Treat it as a sales prerequisite with a cost and a date in your plan, not as a compliance afterthought.

European Union

Regulation (EU) 2025/327 establishing the European Health Data Space was published in the Official Journal on 5 March 2025 and entered into force on 26 March 2025 (EUR-Lex). The phasing matters more than the entry date. Member States were required to appoint a National Digital Health Authority by June 2025. Health Data Access Bodies governing secondary use must be established by March 2027. From March 2029, primary-use exchange of the first priority data categories, patient summaries and ePrescriptions or eDispensations, applies across Member States (European Commission). EHR systems placed on the EU market must undergo a conformity process covering interoperability and security, including self-certification for certain components.

For a founder, EHDS is a dated build order for a market that does not fully exist yet. That is unusually good planning information, and a European market-entry section built on those dates reads far stronger than a generic expansion paragraph.

Canada

Provincial health information custodian legislation governs, including PHIPA in Ontario, the Health Information Act in Alberta and the E-Health Act in British Columbia. Canada Health Infoway publishes pan-Canadian interoperability specifications, and provincial privacy impact assessment sign-off is normally required before connecting to a provincial clinical data repository. Timelines are provincial, so treat each province as a separate market entry rather than one national launch.

The Interoperability Stack

Your technology section will be read by someone who has seen fifty of these. Naming the specific components, and explaining why you chose each, separates a credible plan from a wish list. These are the tools operators in this category actually run.

• HL7 FHIR R4 with US Core profiles. The baseline exchange standard. If your plan does not name a FHIR version and profile set, technical diligence will assume you have not made the decision yet.
• Mirth Connect (NextGen Connect) or Rhapsody. The integration engine that terminates legacy HL7 v2 feeds. Mirth keeps early costs down; Rhapsody is the answer when throughput and support obligations grow.
• InterSystems HealthShare. The established enterprise platform for regional and health-system exchanges. Licensing it moves cost from build to opex and shortens time to first data flow.
• AWS HealthLake or Google Cloud Healthcare API. Managed FHIR stores that remove the need to operate your own clinical data repository at launch.
• NextGate or Verato for enterprise master patient index. Identity matching is where exchanges quietly fail. Referential matching costs more and is almost always worth it once you are combining more than a handful of sources.
• Health Gorilla or Particle Health for national record retrieval. Both give access to national networks through a single API, which is how a small team offers national coverage from day one.
• Redox or 1upHealth for EHR and payer connectivity. Useful when your buyers are digital health companies that want one integration rather than many.
• Datavant for privacy-preserving record linkage. Relevant when life sciences or research revenue is part of the model and identifiable data cannot move.

One architectural warning worth putting in the plan explicitly. Every component above is replaceable except the master patient index and the consent store. Those two accumulate state that cannot be rebuilt from scratch without a data remediation project, so choose them as if you will keep them for a decade. Investors who know the category will ask, and having the answer ready is a strong signal.

Sample Business Plan Preview

This is the structure and the financial output a buyer receives. Both mockups are generated from the same assumptions used throughout this page.

What's in the Template

Every Avvale business plan template includes these sections, pre-structured for your industry:

• Executive Summary — Your business at a glance, written to hook investors in 60 seconds
• Company Overview — Legal structure, ownership, location, and founding story
• Industry Analysis — Market size, growth trends, and the regulatory picture
• Customer Analysis — Target demographics, pain points, and spending patterns
• Competitor Analysis — Competitive mapping and your differentiation strategy
• Marketing Plan — Channels, messaging, and customer acquisition strategy
• Operations Plan — Day-to-day workflows, staffing structure, and key milestones
• Management Team — Founder bios, advisory board, and key hires planned

For an exchange business specifically, we recommend expanding three of those sections well beyond the default. Industry Analysis should carry the TEFCA and information blocking position, because that is the demand argument. Operations should carry the integration delivery model, since cost per interface is the metric that determines whether the business scales. Competitor Analysis should name the state-designated entity in your region and state plainly whether you compete with it or connect to it.

The optional Financial Forecast add-on (included in our $300/£250 and $1,000/£800 packages) provides a 5-year Excel model with income statement, cash flow, balance sheet, break-even analysis, and startup capital requirements.

Related reading from our library: the healthcare IT integration business plan template covers the services-led version of this model, the healthcare IT outsourcing business plan template covers managed delivery, and our free business plan template hub collects the general-purpose structures. If you want a person rather than a document, start with our business plan writer service.

Frequently Asked Questions

Useful Links & Resources

These links were preserved from the live page so important references and partner links are not lost during the page refresh.

• Facebook
• Instagram
• LinkedIn
• YouTube