Executives love a good vendor-selection framework. Scorecards, weighted criteria, reference calls, the machinery of due diligence gets more sophisticated every year. And yet the most instructive vendor-selection case study of 2026 is unfolding in an industry most executives never think to study: American healthcare, where a wave of federal audits and nine-figure settlements has quietly rewritten what “good vendor” means, in a way every leader choosing technology partners should understand.
The setup: a market built on the wrong scorecard
The vendors in question sell software to American health insurers, specifically the systems that read medical records and extract the diagnosis codes determining how much the government pays those insurers to cover more than thirty million older Americans. For years, the buying criteria in this market were simple and, in retrospect, dangerously incomplete: which vendor finds the most billable diagnoses, and at what price per chart. Growth-stage logic, applied to healthcare data.
Then the audits arrived. Federal reviewers, scaled from roughly forty staff to nearly two thousand certified coders, began checking the industry’s output on a quarterly cycle. This spring they found that at three insurance plans, 81 to 91 percent of certain sampled high-risk diagnosis codes lacked adequate supporting documentation. A major insurer settled federal claims for 117.7 million dollars over technology-assisted review programs that added diagnoses aggressively while almost never removing unsupported ones. Congressional advisers now estimate the industry-wide excess payments in the tens of billions of dollars annually.
The buying scorecard that had ruled the market for over a decade collapsed almost overnight. The vendor who finds the most is now, potentially, the vendor who creates the most liability.
What replaced it, and why every executive should recognize the pattern
What emerged in its place is a genuinely useful case study in how buyers now rank the top risk adjustment vendors 2026, and the new criteria generalize far beyond this one industry. Buyers now evaluate technology partners on four questions that any executive selecting a critical vendor should be asking already.
Can the vendor show its work, per output, not just in aggregate. An accuracy percentage on a sales deck is marketing. What matters is whether any single conclusion, chosen at random by the buyer, can be traced to the specific evidence behind it. Vendors that could not answer this question when regulators asked it are the ones now facing settlements.
Does the vendor correct itself in both directions? The clearest warning sign uncovered in this year’s enforcement actions was one-directional correction: systems that only ever found errors benefiting the customer’s revenue, never errors against it. Any vendor relationship where the partner’s output conveniently always favors the partner’s own interests deserves the same scrutiny federal investigators just applied here.
What happens when a hostile third party examines the output. Not whether the vendor holds the right certifications, though that matters too, but whether the vendor has actually been tested by an adversarial reviewer, a regulator, an auditor, opposing counsel, and how that went. Vendors seasoned by real scrutiny describe the process. Vendors who have never faced it describe adjectives.
Who owns the evidence when the relationship ends. If a critical technology partnership were terminated tomorrow, could the organization reconstruct every consequential decision the vendor’s system made, using its own retained records? Data portability sounds like procurement boilerplate until the day it is the only thing standing between an organization and an unanswerable audit request.
The broader principle for any boardroom
The healthcare technology market’s rapid rewrite offers a lesson that belongs in any vendor-selection framework, in any industry: buyers eventually stop purchasing capability and start purchasing defensibility, and the transition usually happens fast once it starts. Finance made this shift after the 2008 crisis. Data-driven industries made it after major privacy regulations arrived. Healthcare technology just made it in roughly eighteen months, forced by audits with real financial teeth.
The vendors who survived the transition were, tellingly, not the ones who scrambled to add compliance features after the enforcement wave hit. They were the ones who had built for accountability years earlier, evidence trails, bidirectional correction, human oversight, without knowing exactly when it would matter. That is not luck. That is the difference between a vendor who treats governance as a checkbox and one who treats it as an architecture decision, and the difference is usually visible well before any regulator gets involved, to anyone who knows to look for it.
The takeaway worth stealing
For any executive currently evaluating a technology partner whose output will carry real financial or legal weight, healthcare’s audit wave offers a shortcut that took one industry over a decade and hundreds of millions of dollars to learn the hard way. Before signing, ask the four questions above. Ask for the evidence trail behind a specific, cherry-picked example. Ask what the vendor does when its own output is wrong, and listen closely for whether the answer only ever moves in one financial direction.
The healthcare organizations now paying nine-figure settlements did not lack sophisticated vendor-selection processes. They simply optimized those processes for the wrong scorecard, for years, until an auditor with subpoena power provided the correction free of charge. The lesson is available to everyone else at a considerably lower price: read the audit reports, then rewrite the scorecard, before the auditor arrives at your door instead.
