The Healthcare Middleware Market in Numbers

Five research publishers have sized this market for 2025, and they do not agree. Mordor Intelligence, 2025 puts it at $3.46 billion, heading to $5.54 billion by 2030 (9.87% CAGR). Kings Research, 2025 says $4.12 billion in 2025 and $7.87 billion by 2032 (9.58% CAGR). Research and Markets, 2025 reports $4.22 billion rising to $6.78 billion by 2029 (12.6% CAGR). Market Research Future, 2025 goes highest at $4.86 billion, reaching $10.04 billion by 2035 at 7.5%.

The spread, $3.46 billion to $4.86 billion, is a 40% gap between the lowest and highest estimate for the same year. That matters for your plan. Lenders and investors who check your market claim will find at least two of these numbers within minutes, so quote a range, name the publishers, and build your revenue case bottom-up from interface counts rather than from a top-down slice of a number nobody can reconcile. The consistent signal across all five is the growth rate: every publisher sits between 7.5% and 12.6% a year, which is steady rather than explosive.

Why the buyer list is concentrated, and why that helps a small vendor

Becker's Hospital Review, citing KLAS, 2025 reports that Epic holds 43.7% of US acute care hospitals and 56.9% of beds, with Oracle Health at 21.9% of hospitals and Meditech at 14.7%. Three vendors therefore control roughly four in five hospitals. A new middleware company cannot out-build them, and it should not try. What those three vendors leave open is everything around them: the outpatient clinics running athenahealth or NextGen, the reference labs, the imaging centres, the behavioural health groups, the remote-monitoring vendors, the digital health apps that need to write results back into a chart. Each of those connects to Epic or Oracle Health on one side and to something unrelated on the other, and each connection is a billable interface.

Fierce Healthcare's coverage of the 2026 KLAS release notes that the number of hospitals making EHR purchase decisions fell 40% in 2025 compared with 2024. When hospitals pause replacement projects, they keep their existing systems longer and need more glue between them. Middleware demand tends to rise when EHR replacement stalls, because the integration backlog grows while the budget for ripping and replacing shrinks.

The regulatory tailwind with a date on it

According to the CMS fact sheet on CMS-0057-F, Medicare Advantage organisations, state Medicaid and CHIP fee-for-service programmes, Medicaid managed care plans, CHIP managed care entities and Qualified Health Plan issuers on the federal exchanges must maintain HL7 FHIR APIs, with the Patient Access, Provider Access, Payer-to-Payer and Prior Authorization APIs due by 1 January 2027. Operational provisions, including shorter prior authorization decision timeframes, began on 1 January 2026. A payer with a mainframe claims platform and no FHIR experience has a fixed deadline and a procurement problem. That is a sales trigger you can write into a plan with a date, a named buyer type and a quantified need.

Compare that to a generic claim that "interoperability is a growing priority". The first sentence gives a lender a reason to believe a pipeline exists; the second gives them nothing to test. If you can name the payer segments you will approach, count them from public CMS lists, and attach an average contract value, your market section stops being decoration and becomes the basis for your forecast.

Where the money is made in the stack

The stack has four layers. At the bottom are source systems (EHR, LIS, RIS, PACS, practice management). Above them sit transport and transformation, which is where an interface engine such as Rhapsody, InterSystems HealthShare, Lyniate Corepoint, Infor Cloverleaf or NextGen Connect (formerly Mirth Connect) lives. Above that sits a managed network or API layer, represented by Redox, Health Gorilla, Particle Health and Metriport, which let a software vendor connect once and reach many provider systems. At the top are applications. Margin concentrates in two places: the managed service wrapped around the engine, where you charge for uptime, mapping changes and monitoring, and the network layer, where you charge per connection and per query. The raw transport layer is commoditising, which is one reason comparison guides on engine pricing now spend more space on licence terms than on features.

Questions Founders Ask Before Building Middleware

These are the questions that come up repeatedly when we scope plans for integration and health-data companies. The answers below are short; the sections that follow carry the numbers.

What does healthcare middleware actually do?

It sits between systems that were never designed to talk to each other and translates, routes and logs the messages between them. A lab analyser sends an HL7 v2 result message; the EHR expects a different segment layout; an analytics warehouse wants JSON. Middleware receives the first, maps it into the second and third, retries on failure, and records that it did so. As one practitioner source puts it, CapMinds, 2025 describes it as a communication layer that translates between formats such as HL7, FHIR and JSON so that clinical, operational and analytical systems keep a consistent data flow.

Is middleware the same thing as an integration engine?

An integration engine is one type of middleware, and the one most hospital IT teams mean when they say the word. The wider category includes API gateways, enterprise service buses, master patient index services and data-normalisation pipelines. The FHIR Community forum discussion on this question reaches a consistent answer: engines pay for themselves when you have several workflows, several partners and several message standards to normalise; for a single point-to-point connection, they can be more machinery than you need. Your plan should say which of these you sell, because the unit economics differ.

Will FHIR replace HL7 v2 and make the whole category obsolete?

No, and the plan should not assume it will. Hospitals still run a large installed base of HL7 v2 feeds for admissions, orders and results, and FHIR APIs have so far been added alongside those feeds rather than in place of them. The business implication is that your product has to speak both, and your pricing has to cover the awkward period in which a customer pays for v2 maintenance and a FHIR build simultaneously. Companies that position as "FHIR only" lose the hospital lab and radiology interfaces; companies that position as "v2 only" lose the payer mandate work.

Do I need a Business Associate Agreement with every customer?

If your service creates, receives, maintains or transmits protected health information for a covered entity, you are a business associate and you need a signed BAA. A managed integration platform that carries PHI is squarely inside that definition. The commercial consequence is that your contract template, your sub-processor list and your breach-notification process are sales documents. Buyers' security questionnaires arrive in the first or second call, and a plan that budgets for a compliance lead from month one is more credible than one that treats it as an afterthought.

Three Ways to Sell Middleware, Compared

"Healthcare middleware" is three businesses wearing one label. Each has a different customer, a different sales cycle and a different cash profile, and a plan that blends them reads as undecided. The table sets them side by side using ranges from vendor pricing disclosures, published funding rounds and Avvale's own modelling of comparable plans. Treat the margin and cycle figures as planning estimates, not audited benchmarks.

The funding figures in the network column come from public reporting. Latka, 2024 lists Redox at $146.1 million raised; Fierce Healthcare reported Health Gorilla's $50 million Series C led by SignalFire, bringing its total to $80 million; CB Insights shows Particle Health at $49.34 million across eight rounds; and Fierce Healthcare reported Metriport's $2.4 million seed round with Y Combinator among the backers. The gap between a $2.4 million seed and a $146 million total is the real lesson: network businesses need years of patient capital before the per-connection model pays back.

For a founder with $300,000 and a few hospital contacts, the managed interface service is the realistic starting point. It earns revenue in month two, it teaches you the mapping problems that a later API product will need to automate, and it does not depend on any platform owner granting you access. The danger is that the model quietly turns into a consultancy where every dollar of growth needs another engineer, which is why the revenue section below separates build-fee revenue from recurring revenue and sets a target ratio between them. If you want to see how we structure a services-to-product plan for a software company, our SaaS business plan template covers the subscription side in more depth, and our AI in healthcare business plan template covers the adjacent case of selling analytics on top of integrated data.

What It Costs to Launch a Healthcare Middleware Company

A managed interface service in the US typically needs $420,000 to $1,100,000 to reach its first twelve months of operation with a small engineering team and a compliance programme; in the UK the equivalent is £340,000 to £880,000. A leaner consultancy-first route, where the founder is the first engineer and the first customer pays for the first interfaces, can start from $60,000 to $150,000. The wide range reflects one decision more than any other: whether you pay for HITRUST or only SOC 2 in year one.

Line-item budget (US, 12 months, team of five)

• Engineering payroll (3 integration engineers, 1 lead): $380,000–$620,000 loaded. See the BLS section below for the base-salary logic.
• Interface engine licences and sandbox environments: $20,000–$90,000. NextGen Connect plug-ins alone have been quoted around $20,000 per year (Lifepoint Informatics); enterprise engines scale far higher.
• Cloud hosting with BAA-eligible services, logging and backup: $24,000–$80,000.
• SOC 2 Type II first audit: $30,000–$100,000 per Scrut, 2026, plus $20,000–$50,000 a year to maintain without automation.
• HITRUST r2 (optional in year one): $90,000–$160,000 all-in at the low end per AvantCert, 2026, with other sources putting larger scopes at $150,000–$500,000+. It is valid for two years.
• Cyber and professional liability insurance: $12,000–$45,000. Buyers will ask for certificates before signing.
• Legal (BAA template, MSA, privacy policy, entity set-up): $12,000–$35,000.
• EHR vendor programme fees and test-environment access: $5,000–$40,000. Programme terms differ and change; verify current fees directly with each vendor.
• Sales and marketing (conference presence, HIMSS-adjacent events, outbound): $25,000–$90,000.
• Working capital (3 months of payroll buffer): $90,000–$180,000.

UK budget differences

A UK launch swaps HITRUST for the NHS compliance stack described in the compliance section: a named Clinical Safety Officer, DCB0129 documentation, DTAC completion, Cyber Essentials and the Data Security and Protection Toolkit. These are cheaper than HITRUST in cash terms (budget £6,000–£25,000 in year one depending on whether you retain an external CSO) but slower, because the CSO must be a currently registered clinician. Engineering salaries run lower than in the US, though not by as much as founders expect. Budget £340,000–£880,000 for the same twelve-month scope, and add £15,000–£40,000 if you plan to bid onto NHS frameworks, where bid-writing time is the main cost.

What a build actually costs your customer

Price discipline starts with knowing what the customer would otherwise pay. Idea Usher, 2026 reports that HL7 integration projects run from $10,000 to $150,000 or more, with basic projects at $10,000–$25,000, more complex EHR integrations at $25,000–$75,000, and multi-EHR platforms at $100,000–$200,000 and above. If your build fee per interface is $6,000 and your monthly fee is $900, a customer buying four interfaces pays $24,000 up front and $43,200 a year. That compares with a $10,000–$25,000 one-off project from a freelancer who vanishes after go-live. You are selling the second and third year, not the first build. Say so in the plan.

Funding routes

Founders of a managed interface service usually fund the first year from a mix of founder capital, a bank or SBA loan against contracted revenue, and a small angel round. Network and gateway businesses need venture capital, because the $1 million-plus pre-revenue engineering cost does not fit a loan. In the UK, the Start Up Loans scheme offers up to £25,000 per founder at a fixed rate with mentoring, SEIS and EIS make angel equity cheaper for UK taxpayers, and Innovate UK grants occasionally fund health-data work. In Canada, BDC and the IRAP programme play a similar role. A plan aimed at any of these needs a five-year forecast, a use-of-funds table and a defensible customer pipeline, which is exactly what our bespoke business plan service produces.

SBA 7(a) Data for Software Founders

The SBA 7(a) programme lends up to $5 million, according to the Congressional Research Service overview, and it is the most common US bank-loan route for a founder with a signed customer contract and personal collateral. Healthcare middleware companies usually classify under NAICS 541511 (Custom Computer Programming Services) if they build for clients, or 513210 (Software Publishers) if they sell a packaged product. The SBA size standard for 541511 is $34 million in average annual receipts, so a start-up is comfortably small.

The averages mislead. As Crestmont Capital's 7(a) statistics page shows, the FY2025 mean is $477,571 but the median is $195,000, so a founder who plans around the mean is planning for a loan most applicants never receive. A realistic software ask is $150,000 to $350,000, which falls inside the two-thirds of loans that are $350,000 or under.

What lenders look for in a software application differs from what they look for in a restaurant. There is little hard collateral: your assets are code and contracts. Underwriters therefore weight three things: signed customer agreements or letters of intent, the founder's personal financial position, and a forecast that shows debt service coverage on conservative assumptions. Include a month-by-month cash plan for the first 18 months, identify which customers are contracted versus projected, and keep the loan request below the point where the first two customer losses would breach coverage. A pure pre-revenue network startup is a poor fit for 7(a); a services-led integration firm with two clinic customers already live is a good one.

Engineering Payroll and BLS Wage Data

Payroll is 60 to 75% of cash cost in a middleware company's first two years, so it deserves its own analysis. The US Bureau of Labor Statistics Occupational Outlook Handbook lists a May 2024 median pay for software developers of $133,080 a year, with the 10th percentile near $71,280 and the 90th percentile around $198,000. Employment is projected to grow 15% from 2024 to 2034, adding roughly 287,900 jobs. In plain terms, you compete for engineers in a market growing faster than the average occupation.

Integration engineers with HL7 and FHIR experience sit above the median because the skill set is narrow. Using the BLS median as a floor and a 25% loading for payroll tax, benefits and equipment, a mid-level engineer costs about $166,000 a year before any health-data premium. A lead with Epic or Oracle interface experience will often cost $190,000 to $230,000 loaded. A team of four therefore costs roughly $700,000 loaded, which is why the budget above shows $380,000 to $620,000: the lower figure assumes founders take below-market pay and one engineer is offshore.

The BLS growth figure also frames a hiring risk worth stating in your plan. At 15% growth the number of open engineering roles rises quickly, and a start-up that loses its lead interface engineer in month nine can see delivery slip by a quarter. Plans that address this through documentation standards, a second engineer trained on every customer's mappings, and equity vesting tied to a 36-month schedule read as more credible than plans that list headcount alone.

• Year 1: 1 lead, 2 integration engineers, 1 compliance and operations manager (part-funded by a founder salary).
• Year 2: add 2 engineers, 1 customer success lead, 1 salesperson with a clinic or payer background.
• Year 3: add a security engineer, a second sales hire and a product manager as you move from services toward a platform.

How Middleware Companies Earn Revenue

A healthcare middleware company earns from four streams: build fees (one-off, per interface), managed-service fees (monthly, per interface), platform or network fees (usage or per connection), and professional services such as interface audits and migration projects. In a plan, keep them in separate rows. Lenders and investors discount build fees heavily because they do not repeat, and they pay a premium for the recurring rows.

Worked example: a managed interface service, three years

This composite uses a $6,000 build fee per interface and a $900 monthly managed-service fee. It assumes 14 customers averaging four interfaces each (56 live interfaces) at the end of year one, 150 at the end of year two and 290 at the end of year three. Average live interfaces during each year are the mean of its opening and closing counts. The figures are an illustrative model, not a forecast for any named company.

Three numbers in that table drive the plan. First, recurring revenue is 47% of total in year one but 74% by year three, which is the shift an investor wants to see. Second, the year-one loss of $411,600 is the size of the funding requirement before working capital, and it tells you the $420,000 low end of the launch budget is not arbitrary. Third, operating cost grows 124% between year one and year three while revenue grows 404%, because build effort is front-loaded and maintenance is cheap per interface once mappings are stable. If your own numbers do not show costs growing far slower than revenue, your model is a consultancy and the plan should say so.

Churn, expansion and the cost of an interface

The assumption that most deserves a sensitivity test is interface lifetime. An interface survives until the customer replaces one of the two systems it connects, which in hospitals happens every five to ten years and in small clinics sometimes every two or three. Model 8% annual interface churn as a base case and 15% as a downside. At 15%, year-three recurring revenue falls by $150,000 to $190,000 against the table above, which is painful but survivable. The more dangerous case is concentration: if one customer holds 30% of interfaces and moves to Epic's own integration tooling, year-two profit disappears. Cap any single customer at 20% of recurring revenue in your plan, or explain why you cannot.

Pricing signals from the market

The Mirth Connect licence change is the clearest recent example of how pricing power moves in this sector. Mirth.support, 2026 notes that from version 4.6 in March 2025 Mirth Connect moved from a dual open-source and commercial model to a single proprietary commercial licence, with new releases available only through NextGen Healthcare and authorised resellers. Organisations that built their stack on the free engine now face either a licence fee or a migration project, and migration projects are exactly what a small integration company can sell. Put that in your plan as a named, dated demand source, and size it: count the clinics and labs in your region that run Mirth by searching public job listings and vendor directories.

Compliance: HIPAA, CMS, NHS and EHDS

Compliance in this sector is not a section at the back of the plan. It is the product. Buyers choose middleware vendors partly on the evidence they can show: a signed BAA, a SOC 2 report, a documented incident process. This section covers the United States, the United Kingdom and the European Union, because a healthcare data company with any ambition will meet all three.

United States

• HIPAA Privacy, Security and Breach Notification Rules (HHS Office for Civil Rights). A middleware vendor that handles PHI is a business associate and must sign BAAs with each covered-entity customer and with its own sub-processors, including the cloud host.
• HIPAA Security Rule update. On 6 January 2025 OCR published a notice of proposed rulemaking that would remove the "addressable" category and make all implementation specifications required, with encryption at rest and in transit, multi-factor authentication, network segmentation and a 72-hour restoration requirement. Whether or not it is finalised in the form proposed, design to it now; retrofitting later costs more than building it in.
• CMS-0057-F (Interoperability and Prior Authorization). Payer API deadline of 1 January 2027 (CMS fact sheet). This is demand-side regulation: it creates your payer customers rather than restricting you.
• Information blocking (21st Century Cures Act, enforced by ASTP/ONC and HHS-OIG). The ONC enforcement alert and subsequent coverage describe civil monetary penalties of up to $1 million per violation for health IT developers and health information exchanges. If your product restricts a customer's access to their own data for commercial reasons, you are exposed. Review your API terms and pricing with a healthcare lawyer.
• State privacy and breach laws. Many states add notification timelines and rules for sensitive categories such as behavioural health and reproductive health data. Maintain a state-by-state matrix.
• 42 CFR Part 2 for substance use disorder records, which affects any integration with addiction treatment programmes.

United Kingdom

• DCB0129 clinical risk management. As Digi-Safe's DCB0129 guide explains, manufacturers of health IT used in the NHS must run a clinical risk management system and produce a signed Clinical Safety Case Report. Whether pure middleware counts depends on whether failure could lead to patient harm; most result-routing and referral-routing integrations do.
• Clinical Safety Officer. You need a named CSO who is a currently registered UK clinician with accredited clinical safety training and authority to stop a release. Many start-ups retain an external CSO on a day-rate basis.
• DTAC (Digital Technology Assessment Criteria). NHS buyers use it to assess clinical safety, data protection, technical security, interoperability and usability.
• Data Security and Protection Toolkit and Cyber Essentials. Typical minimums for supplying NHS organisations.
• UK GDPR and Data Protection Act 2018. Health data is special-category data; you will be a processor for most customers and must have a data processing agreement with each. Register with the ICO and pay the data protection fee.

European Union

• European Health Data Space Regulation (EU) 2025/327. It entered into force on 26 March 2025. Per the Skadden summary and EY analysis, EHR systems sold in the EU must include a European interoperability software component and a logging component conforming to the European electronic health record exchange format.
• Timeline. Obligations for priority categories of health data apply from 2029, and for medical imaging data from 2031. That gives a European middleware start-up a roughly three-year window to become the supplier EHR manufacturers buy components from, rather than compete with.
• GDPR Article 9 for special-category data, and national implementations that differ on health data in Germany, France and the Netherlands.

Certifications you can buy, and in what order

The sequencing advice that recurs across the compliance-vendor sources we reviewed is SOC 2 Type II first, HITRUST second. SOC 2 takes six to twelve months and unblocks most mid-market deals; HITRUST r2 takes twelve to eighteen months and is demanded by large health systems and payers. A start-up selling to clinics does not need HITRUST in year one. A start-up selling to a Blue Cross plan probably does, and should budget accordingly. Put the choice, the date and the cost in your plan, and tie each to the customer segment that requires it.

Seven Mistakes That Sink Middleware Startups

• Pricing builds and ignoring maintenance. Interfaces break when either side upgrades. If the monthly fee does not cover an engineer-hour per interface per month at your internal cost, each new customer makes you poorer.
• Selling to the CIO instead of the person with the backlog. The buyer of a lab or imaging interface is often a department director with an unfunded request. A pitch that starts with enterprise architecture loses to one that starts with "your lab results take two days to reach the chart".
• Betting the company on one EHR vendor's programme. If 80% of your connections run through a single vendor's marketplace, a terms change is an existential event. Maintain direct HL7 v2 capability alongside every API.
• Building a proprietary data model. Customers will not adopt a canonical schema that only you understand. Use FHIR resources and published implementation guides, such as US Core, as your internal model.
• Treating compliance as a one-time project. SOC 2 is annual, HITRUST re-certification is every two years, and HIPAA risk analysis is continuous. Budget the recurring $20,000–$50,000 and name an owner.
• Underestimating test data. You cannot use real PHI for development. Synthetic data generation and a representative message corpus take weeks to build and are rarely in the first budget.
• Hiring generalist developers. HL7 v2 quirks, such as site-specific Z-segments and inconsistent use of repeating fields, take months to learn. Hire at least one engineer who has done it before, or pay for a short engagement with a consultancy that has.

Glossary of Integration Terms

Plan readers in lending and venture are rarely clinical informaticists. Define these terms once, in plain language, in your plan's industry section.

• HL7 v2: the pipe-delimited messaging standard, first published in the late 1980s, that carries most hospital admissions, orders and results traffic today.
• FHIR (Fast Healthcare Interoperability Resources): the web-API standard that exposes patient data as JSON or XML resources over REST.
• Interface engine: software that receives, transforms, routes and logs messages between systems. Rhapsody, Lyniate Corepoint, Cloverleaf and NextGen Connect are examples.
• ADT, ORU, ORM: HL7 v2 message types for admit/discharge/transfer events, observation results and orders respectively.
• Master patient index (MPI): a service that decides whether two records from different systems describe the same person.
• BAA (Business Associate Agreement): the HIPAA contract that makes you responsible for protecting PHI you handle for a customer.
• Carequality, CommonWell, eHealth Exchange: US national networks for exchanging clinical documents between provider organisations. Metriport and similar vendors connect to them.
• TEFCA: the Trusted Exchange Framework and Common Agreement, the federal framework for nationwide health information exchange.

Sample Plan Extract

This extract shows the level of specificity our healthcare technology plans reach, including the dated regulatory trigger, the interface counts and the use of funds:

What Is in the Template

The healthcare middleware template follows the standard Avvale structure, with prompts rewritten for an integration business rather than a retail or services one:

• Executive Summary — the interface problem you solve, the buyer, the pricing unit and the funding request, in under one page
• Company Overview — legal entity, ownership, BAA posture and where your engineers sit
• Industry Analysis — market range with named publishers, CMS-0057-F and EHDS timelines, EHR vendor concentration
• Customer Analysis — segments by system type and size, buyer roles, security questionnaire requirements
• Competitor Analysis — engine vendors, managed networks, regional integrators and in-house IT teams as the real incumbent
• Marketing and Sales Plan — channel partnerships with EHR resellers, HIMSS and regional events, referral programmes
• Operations and Delivery Plan — build pipeline, monitoring, on-call rota, test data and change management
• Compliance Plan — HIPAA, SOC 2, HITRUST, DCB0129 and EHDS milestones with owners and costs
• Management Team — founders, advisers (a clinician and a security lead help), and planned hires

The Financial Forecast add-on, included in the $300/£250 and $1,000/£800 packages, provides a five-year Excel model: interface count by month, build-fee and recurring revenue split, churn scenarios, payroll plan, compliance spend, income statement, cash flow, balance sheet and break-even analysis.

Frequently Asked Questions