How 25m Health Built a Cybersecurity Program That Scales Across Its Digital Health Portfolio
25m Health is a healthcare-focused startup studio, formed in partnership with LifePoint Health, that builds and scales emerging digital health companies from the ground up. Its portfolio spans a wide range of missions — from Ladder Health, which supports children with speech and developmental delays, to Basalt, which uses AI to help hospitals streamline clinical chart preparation. Because every company in the portfolio is ultimately built to sell into hospitals, health systems, and payers, 25m Health needed a way to give each one a mature security and compliance posture from day one — without asking founders to become compliance experts or slowing down the pace of building.
Working in partnership with Clearwater, 25m Health developed a repeatable playbook for cybersecurity and compliance that now travels with every company the studio creates.
Ryan Macy, Chief Technology Officer at 25m Health, shares how the studio approached building a scalable security program across its digital health portfolio.
The Portfolio-Wide Security Decision
Why did cybersecurity and compliance become a studio-wide priority for 25m Health, rather than something each portfolio company addressed on its own?
“We built the studio in partnership with LifePoint — an incredible operator with a nationwide footprint and a very sophisticated buyer. Their CIO and CISO are on it, and so are their teams. So the question for us was: how are we going to help our companies get through those security review processes? The worst thing we could do is a one-off. Since we have such deep DNA in these businesses — our own engineering team works directly inside the companies — we needed a repeatable, scalable model that subscribed to that same level of sophistication.”
When 25m Health first began building this approach, what was the studio’s understanding of what a scalable security program would require?
“The first thing I knew was that I couldn’t do it alone. Getting through these technical review boards is like a three-part story: your compliance posture, your infrastructure and use case, and how you’ve actually built the product — is it secure, how are you testing it, what’s your roadmap. We needed a partner who could help us build a playbook for that first piece and connect it to the roadmap for the third.”
Building the Partnership and the Playbook
What was 25m Health’s primary reason for partnering with Clearwater rather than building this capability entirely in-house?
“You have fixed budget, fixed finances, fixed attention. The best thing you can do is have an elastic partner that can meet you in the moment and bring capabilities to bear when you need them — that’s a CISO talking to a CISO, a compliance officer talking to a compliance officer. Most early-stage companies can’t hire out all of those people themselves. That’s what we get from Clearwater — those fractional resources. I’d encourage any early-stage company to find that kind of model.”
What did building that playbook actually look like in practice?
“It meant we weren’t starting from a blank sheet of paper with every single company. We know, for instance, that we don’t put PHI in email — that’s just not allowed. A lot of our companies use Slack, so no PHI in Slack either. We have a data-destruction policy for computers, an encryption policy, and different tiers of data and sensitivity in how you handle them. It’s a lot easier to work through those decisions once, in a really robust way, than to redo them company by company.”
Was the security bar the same for every company in the portfolio, even ones handling less sensitive data?
“Yes — and that was intentional. We have companies that are, for all intents and purposes, low risk. They’re not accessing PHI. But the number one thing, despite that split, is that we treat all of our data like it’s PHI. It’s just good practice. A lot of these organizations get compromised through a partner, so you have to build the confidence that even in a low-risk scenario, you’re not any less sophisticated. You didn’t opt out of investing in your security program just because you feel like you’re not a risk — because the truth is, you’re still an endpoint into someone who might carry a lot more risk.”
Starting the Program Early
How early should a digital health company begin investing in security and compliance, in 25m Health’s experience?
“It’s a day-one thing — almost a day-zero thing. You should be thinking about it before you start the business. It’s a cost item that belongs in your pro forma. It’s a lot easier to build from compliance than to retroactively apply it. If you’ve already built your product, it’s really hard to go back and change your architecture to be compliant.”
How did 25m Health sequence certifications like SOC 2 and HITRUST across the portfolio?
“Generally, I’d do a SOC 2 Type 1 as soon as you can, and then move into a Type 2 around the end of year two. That level of sophistication growth — your partner sees it, and it creates confidence and trust in the relationship. For them, it’s not just about a HIPAA breach; it’s reputational risk, it’s how you treat their patients. Showing that you care as much about their data and their reputation as you do your own is what starts the relationship off on the right foot.”
Health-system security leaders increasingly describe SOC 2 and HITRUST as point-in-time snapshots rather than proof of an ongoing program. How did that shape 25m Health’s approach?
“That perception is true, and I think the business still wants to see the certification, so you should prepare to do it. But what matters more is being able to show active monitoring — tools that can report on how you’re doing this month, not just once a year. And the thing that really speeds up the review process is sovereignty: telling a hospital, ‘What’s your policy? We’ll just adopt it,’ or ‘You already administer identities today — we’ll link into your IDP through SSO or SAML, whatever you use.’ That removes friction and shows you have nothing to hide.”
Certification & Program Results
What has this shared, portfolio-wide model delivered in practice?
“For us, the value is significant. We can basically found, fund, and get a company compliant in sub-45 days — and I’m talking about companies that touch a lot of PHI. That’s because the playbook has been vetted many times over, our partners understand it, and our people understand it. We had a founder new to healthcare who’s doing a phenomenal job with their company. The last thing they want to do is go to college on compliance and security. Now they have someone they can call and say, ‘How does this work?’ — and that person already knows the context, the history, the pushback we’ve gotten before, and how we dealt with it. Everyone benefits from that shared investment.”
How does 25m Health think about tools like Vanta or Drata, which offer self-service compliance automation?
“They’re incredibly valuable tools — their valuation speaks for itself. But they’re self-service, and I tell our founders that because they have no interest in doing all of this themselves. None of our companies choose not to use our program. Having started companies myself, I would never rely on self-service alone — the risk surface area is too large, and people aren’t seeing the expertise they need in that trust-building exercise.”
How does 25m Health handle findings from security assessments or vendor questionnaires?
“There are two responses: build an incredibly complicated fix for that one specific thing, or figure out what the reviewer is really after. If they’re complaining they don’t have insight into how we’re creating users, what they probably actually want is automated onboarding and offboarding. We go back to the playbook and ask if we need to make an improvement — and if we do, can every company benefit from it? That way you’re never having just one review conversation.”
Extending the Model to AI Governance
How has 25m Health approached AI governance across its portfolio companies?
“I’d push back a little on the idea that AI slows procurement down — health systems have become incredibly sophisticated, fast-moving adopters of AI. What they care about most is what you’re going to do with their data. Do you have a BAA or an enterprise agreement with a frontier provider? Are you self-hosting? We create a data-tier list so people know what’s appropriate to put into an AI interface versus what needs to stay private and confidential. If you give people a clear, sanctioned path, they’ll follow it.”
What is 25m Health’s view on “shadow AI” inside a growing organization?
“People are like water — they find the path of least resistance to get value. When employees use shadow AI, it’s not necessarily a bad sign; it’s a desire path. It means they see real value and they’re not getting it through an approved channel. We need to solve those internal desire paths before an auditor sees them and gets concerned — not just shut the behavior down.”
Advice for Digital Health Leaders and Investors
If you had one piece of advice for other digital health leaders and investors building security and compliance programs, what would it be?
“Find a really great partner. You’ll get the best return on your investment if the founder isn’t doing this themselves — they need to focus on the startup they created, not become a compliance expert. And think about it from day one. I’d also encourage teams to work on their story around AI early, and make sure it’s crisp and shows real respect for a partner’s data sovereignty. But if I had to pick one thing: find a partner, and don’t go the self-service route alone.”
To hear more of Ryan’s perspective, access the on-demand webinar Building Cybersecurity to Scale: Lessons from 25m Health’s Digital Health Portfolio.
