Datavant

1.1 Identity, mission, and current positioning

Datavant now presents itself as a healthcare data collaboration platform rather than a narrow point product. The homepage describes the company as the data collaboration platform trusted for healthcare and says its mission is to make the world's health data secure, accessible, and actionable. In operating terms, the platform is built around moving and connecting patient-level data across providers, payers, life sciences companies, legal and insurance requesters, government organizations, and real-world data partners. The current identity is broader than the original 2017 Datavant startup: after the 2021 Ciox Health merger, the company inherited a much larger retrieval network, services layer, and a more complicated corporate footprint. Current official pages emphasize trusted data access, expert-governed AI workflows, and privacy-by-design controls rather than just tokenization software. Scale signals are material. Datavant says its network exchanges 1,500 terabytes of data and tokenizes 1 trillion records annually. It also says the platform reaches more than 80,000 hospitals and clinics, more than 75% of the 100 largest U.S. health systems, 100% of U.S. payers directly or through customers, and more than 350 real-world data partners. These are unusually large ecosystem claims for a private company and help explain why Datavant shows up repeatedly as infrastructure in partner announcements from Thermo Fisher, AWS, Labcorp, and other health-data players. The company also serves 120,000 legal and insurance requesters, indicating that the current product surface extends far beyond life-sciences linkage alone. There is a meaningful identity wrinkle that later diligence should keep explicit: pre-merger Datavant and the current Datavant are not the same scale entity. Current newsroom materials describe the company as founded in 2014 and headquartered in New York, while earlier Datavant materials and third-party venture databases describe the original startup as founded in 2017 and headquartered in San Francisco. The public record therefore supports treating the current company as a merger-built platform whose original startup roots sit inside a larger, post-2021 operating structure.[CO001, CO002, CO003, CO004, CO005, CO006]

1.2 Leadership, governance, and ownership

Leadership has shifted from founder-led startup execution to private-equity-backed platform scaling. The original Datavant was founded by Travis May, who was still identified as Founder and CEO in the 2020 Series B announcement. The current CEO is Kyle Armbrester, who joined in May 2024 from CVS Health's Signify Health after prior product leadership at athenahealth. Public descriptions of his mandate are revealing: the appointment was framed around interoperability, accelerating the product roadmap, and building a longitudinal patient-data fabric across plans, providers, EMRs, and life sciences. That language suggests the board wanted a scaled operator for a broad data-logistics platform, not simply an integration specialist for the 2021 merger. Supporting leadership signals are mixed but directionally positive. Earlier releases named Steven Swank as CRO and Nick Colburn as CFO, then later added Aden Fine as General Counsel and Chief Privacy Officer plus Dongting Yu as Head of Security Engineering. Datavant also assembled policy and advisory figures with meaningful healthcare credentials, including former CMS chief data officer Niall Brennan, Charles Safran of Harvard/Beth Israel Deaconess, former VA secretary David Shulkin, and former FDA commissioner Andrew von Eschenbach. Those names do not substitute for a fully disclosed org chart, but they do show that Datavant invested early in policy, compliance, security, and go-to-market depth. Ownership is concentrated. LegalClarity's 2026 ownership summary, cross-referencing official materials, identifies New Mountain Capital as the controlling owner after using Ciox Health as the anchor vehicle for the 2021 merger. Roivant remains a meaningful minority holder through the original Datavant lineage, while Sixth Street, Goldman Sachs Asset Management, Transformation Capital, and other institutional investors sit on the cap table. For diligence, that means governance is likely oriented around long-term private-equity value creation and M&A rather than near-term public-market disclosure. It also means capital allocation decisions, executive hiring, and acquisition appetite are probably highly board-driven.[CO014, CO015, CO016, CO017, CO018, CO019]

1.3 Capital base, valuation anchors, and milestone chronology

The public funding record is easier to support for the original Datavant startup than for the current combined platform. Datavant's 2020 Series B press release says the company raised $40 million in that round and $83 million cumulatively, with Transformation Capital leading and JJDC, Cigna Ventures, Roivant Sciences, and Flex Capital participating. Third-party venture databases such as Tracxn also continue to describe the original startup as a 2017-founded, San Francisco-based Series B company with $83 million raised. That is useful historical grounding, but it does not capture the capital structure of the post-merger platform. The decisive public valuation anchor is the June 2021 Ciox merger. Both the official Datavant release and multiple independent deal reports describe the transaction at $7.0 billion and say the combined entity would generate more than $700 million of revenue. The investor group listed around the transaction included New Mountain Capital, Roivant Sciences, Transformation Capital, Merck Global Health Innovation Fund, Labcorp, Cigna Ventures, Johnson & Johnson Innovation–JJDC, and Flex Capital, plus fresh investment from Sixth Street and Goldman Sachs Asset Management. That set of names matters because it shows the current Datavant is effectively a sponsor-backed consolidation story with strategic and financial backers across healthcare, not just a venture-backed software company. Post-merger milestones show continued scope expansion. In July 2025 Datavant completed the acquisition of Aetion, adding a real-world-evidence analytics platform into the life-sciences business. In August 2025 it completed the Ontellus acquisition and used it to form a dedicated legal-and-insurance vertical. In 2026, partner releases from Thermo Fisher and Labcorp show Datavant extending beyond linkage into AI-assisted data discovery and therapeutic research workflows. The milestone pattern is clear: Datavant is compounding network scale through acquisitions and partner infrastructure, but public reporting still does not provide enough current financial detail to underwrite present-day margins, ARR mix, or integration economics.[CO022, CO023, CO024, CO025, CO026, CO027]

1.4 Ecosystem proof and operating reach

Datavant's strongest public evidence is not a financial statement; it is repeated ecosystem proof from official pages and partner announcements. The core linkage page says Datavant Connect can run on-premise, in a customer cloud environment, or through CLI and desktop workflows while producing irreversible tokens that allow individual-level matching without sharing raw PII. The same page says the platform supports more than 350 real-world data partners and that all top-20 pharma companies partner with Datavant. These claims are still company-reported, but they are reinforced by partner releases that use Datavant as infrastructure rather than simply as a logo on a slide. The 2025 AWS Clean Rooms launch is especially telling. Datavant said four top-20 pharmaceutical companies and fifteen leading real-world-data sources helped test the jointly developed solution, and it named the data partners. That announcement positioned Datavant not as a single dataset owner but as the orchestration layer that helps buyers discover and evaluate fit-for-purpose data without moving underlying raw data. Similar logic appears in the 2026 Thermo Fisher collaboration, which extended real-world-data interoperability across clinical development, and in Labcorp's April 2026 Alzheimer's platform announcement, which said Datavant's privacy-preserving connectivity would help compress research workflows from months to minutes. Operational proof also shows up outside life sciences. The KLAS award release says Datavant's provider coding solutions now handle more than 4.5 million charts annually with 98% coding accuracy. The homepage separately highlights 120,000 legal and insurance requesters, and the Ontellus acquisition formalized that segment into its own vertical. In other words, Datavant's reach is not only deep in RWD connectivity; it spans retrieval, coding, release-of-information, legal-insurance request flows, and payer-provider audit workflows. That breadth is a competitive asset, but it also raises integration and execution risk because the company must maintain trust across very different buyer groups.[CO003, CO004, CO005, CO006, CO007, CO008]

1.5 Trust events, legal overhangs, and remaining diligence questions

Trust is central to Datavant's thesis, so adverse events deserve explicit treatment rather than a footnote. Datavant says it invests more than $40 million annually in security and compliance infrastructure and frames privacy, compliance, and authorization as platform-layer capabilities. Those investments are economically rational: a platform moving tens of millions of records and serving hospitals, payers, regulators, and life-sciences companies cannot afford repeated trust failures. The company also added senior privacy, legal, and security leadership well before the current AI-heavy positioning, which supports the idea that compliance is core to the model rather than a late add-on. Even so, the 2024 breach-and-settlement episode is a real diligence item. HIPAA Journal reported that a phishing attack on a company email account exposed data relating to 320,702 individuals, and the class-action settlement site plus the settlement press release show Datavant agreeing to a $900,000 settlement that offers up to $5,000 in documented-loss claims plus one year of identity-theft monitoring. Datavant denied wrongdoing, but the event illustrates the asymmetric downside of operating as a HIPAA business associate at national scale: one email-account compromise can trigger litigation, reputational damage, and questions from every enterprise buyer. The larger diligence gaps are still financial and definitional rather than product-market-fit. Public sources do not provide a clean, current revenue run rate, ARR mix, gross margin, or acquisition-integration scorecard. The public record also carries unresolved ambiguity over the company's founding year and headquarters because the current platform combines legacy Datavant and Ciox identities. For an investment memo, the correct posture is not skepticism about whether Datavant matters—public evidence clearly shows that it does—but caution about underwriting current value creation without private metrics on revenue quality, integration progress, customer concentration, and security incident remediation.[CO033, CO034, CO035, CO036, CO037, CO038]

1.6 Exhibits

2.1 Market boundary and what Datavant is actually selling

Datavant participates in a broader market than any single label captures. Its own educational and solution pages sit across three overlapping categories: healthcare interoperability, health-data logistics, and real-world-data connectivity. The interoperability guide defines the market as the ability of systems to exchange patient health information and use it immediately without special effort from the user. But Datavant’s commercial role extends beyond moving messages between systems. The company also positions itself around retrieval, release of information, privacy hub services, coding workflows, and privacy-preserving patient-level linkage for research, payer analytics, and clinical development. In practice, that means Datavant monetizes a layer of infrastructure that connects fragmented records, standardizes access, and enables downstream evidence generation and operational workflows. The correct market boundary therefore excludes a few things. Datavant is not simply an EHR vendor, an ordinary health-information exchange, or a raw dataset broker. It does not primarily sell a hospital charting system, nor does it appear to own the bulk of the underlying provider data itself. Instead, it sits in the connective tissue between holders and users of health data: hospitals, health plans, researchers, CROs, legal requesters, and data partners. The market also includes the workflow burden around obtaining records, validating consent and authorization, protecting privacy, and linking records longitudinally across claims, EHR, lab, registry, and specialty sources. This broader definition matters because it explains why Datavant can plausibly compete in several adjacent pools of spend at once. A provider may buy Datavant to automate retrieval or coding operations, while a life-sciences sponsor may buy it for tokenization, data discovery, and trial follow-up. A payer may value the same network for chart retrieval and risk adjustment, while a government or nonprofit researcher may value privacy-preserving linkage and disclosure-risk support. The market is therefore best understood as a multi-segment connectivity and evidence infrastructure market rather than a single-software category.[CM001, CM002, CM003, CM004, CM005, CM006]

2.2 Sizing lenses: interoperability, linkage, and RWE

No single public market estimate cleanly captures Datavant’s full opportunity, so sizing has to be lens-based. Third-party reports suggest the global real-world-evidence solutions market was about $4.7 billion in 2024 and could reach roughly $10.8 billion by 2030 at a 14.8% CAGR. A more specific Future Market Insights report pegs real-world-evidence linkage services at about $0.8 billion in 2026, growing to $3.6 billion by 2036 at a 16.2% CAGR. Meanwhile, another FMI report sizes healthcare interoperability solutions at $6.9 billion in 2026, growing to $26.6 billion by 2036 at a 14.5% CAGR. These are different markets with different methodologies, but together they imply that Datavant sits inside several expanding categories rather than one static niche. The linkage-services lens is especially relevant to Datavant because it focuses on identity resolution, tokenization, and cross-source matching rather than raw record ownership. FMI says tokenization holds a 39% share of that linkage-services segment in 2026, while claims data carries a 34% data-source share and biopharma accounts for 43% of end-user demand. Those figures align well with Datavant’s positioning around privacy-preserving linkage, claims/EHR combination, and life-sciences evidence use cases. The broader interoperability lens matters because Datavant also earns relevance from provider retrieval, payer chart exchange, and information-access workflows that sit outside classic RWE. For underwriting, the takeaway is not that one report provides a definitive TAM, SAM, and SOM. Instead, the public evidence supports a stacked-opportunity thesis: Datavant can draw demand from regulated interoperability, from evidence-generation infrastructure, and from retrieval / coding / release-of-information workflows. That creates a larger revenue surface than a pure tokenization vendor would have, but it also means the company must keep winning in several related submarkets that do not all grow for the same reasons or buy on the same budget cycle.[CM009, CM010, CM011, CM012, CM013, CM014]

2.3 Buyer, user, and payer segmentation

Datavant’s buyer map is unusually diverse. The company’s segment pages and market-education assets show distinct demand paths for commercial pharma, clinical R&D, health plans, government programs, and providers. In life sciences, Datavant says its customers use linked claims, EHR, lab, and other RWD to support HEOR studies, market access, brand analytics, clinical trial follow-up, and trial recruitment. Those use cases imply budget owners across clinical development, medical affairs, HEOR, market access, and commercial analytics. In payer markets, the health-plan page centers on retrieval, risk adjustment, HEDIS / Star reporting, and coding quality, implying budget ownership in quality, risk adjustment, and operations. In government and nonprofit research, the emphasis shifts to privacy-preserving linkage, IRB-compatible workflows, and evidence-backed research programs. The user base is broader than the buyer base. A life-sciences contract may be sponsored by HEOR or clinical operations, but the practical users can include epidemiologists, data managers, biostatisticians, trial planners, and market-access teams. A payer contract may be signed by operations or quality, but the users include coders, reviewers, compliance staff, and provider-facing teams. Provider-side users can include HIM, coding, revenue-cycle, and request-fulfillment personnel. This is strategically important because a single Datavant deployment can create multiple expansion paths within one account once connectivity, retrieval, or coding workflows are embedded. The implication is that Datavant is selling into budget lines where ROI often comes from avoided friction rather than simple software-seat productivity. Sponsors care about faster data discovery, better fit-for-purpose evidence, and fewer protocol amendments. Payers care about retrieval yield, audit readiness, and faster coding cycles. Providers care about reducing record-request burden and improving reimbursement accuracy. This diversity broadens demand but raises sales complexity: Datavant must prove value differently to each segment and often needs compliance and workflow credibility, not just technical interoperability claims.[CM018, CM019, CM020, CM021, CM022, CM023]

2.4 Growth drivers and adoption constraints

The strongest structural tailwinds are regulatory, operational, and economic. Datavant’s own interoperability guide says the HITECH Act put $27 billion behind EHR adoption and that the 21st Century Cures Act plus ONC’s final rule sharpened expectations around access and information blocking. ONC’s 2026 standards bulletin says USCDI remains the foundation for nationwide interoperable exchange and that draft USCDI v7 adds thirty proposed or revised elements. The same bulletin notes that CMS’s prior-authorization rule and TEFCA require the ability to exchange USCDI data elements. CMS in turn says its interoperability team is driving an HHS-wide move to FHIR APIs. Together, these signals show why interoperability remains a compliance-led market rather than a discretionary nice-to-have. Demand is also driven by the limitations of isolated datasets. Datavant’s real-world-data guide says no single source captures the full patient journey and explains why claims, EHR, labs, registries, and other sources must be linked for many research and HEOR use cases. The company’s 2026 RWE trends blog argues that linked, fit-for-purpose datasets are becoming the standard for decision-grade evidence and that queryable data networks are increasingly important upstream in trial design. Third-party market reports reinforce the same pattern: tokenization, claims linkage, and interoperability services are growing because organizations need longitudinal, privacy-preserving views of patients rather than disconnected data slices. The constraints are just as real. Datavant’s educational materials say healthcare interoperability is still far from where it needs to be. MarketsandMarkets highlights fragmentation, data-quality problems, and a lack of universally accepted RWE methodology as challenges. Datavant’s own blog emphasizes governance, documentation, and explainability around AI-assisted evidence generation. In plain English: the market is large, but adoption depends on trust, workflow change, standards compliance, and the ability to prove that linked data is fit for purpose. That is good for an established infrastructure provider, but it means growth can still be slowed by implementation friction, procurement complexity, and skepticism from regulators, payers, or providers when data provenance is weak.[CM026, CM027, CM028, CM029, CM030, CM031]

2.5 What the market structure means for Datavant

The public evidence supports a favorable market-structure verdict for Datavant. The company is not trying to create demand for a brand-new category; it is benefiting from several already-moving forces: regulation pushes data exchange, life-sciences sponsors need linked RWD, payers need chart retrieval and coding accuracy, and providers still struggle with fragmented access workflows. Datavant’s strategic advantage is that it can convert these pressures into a unified infrastructure story. A sponsor that starts with trial tokenization can later buy data discovery; a payer that starts with retrieval can expand into coding; a government program can use privacy-preserving linkage plus retrieval and disclosure-risk services. At the same time, the market does not forgive weak execution. Competitors such as HealthVerity, Komodo, Truveta, and Veradigm all claim strong data coverage or analytics depth, and vendor directories still place Datavant among a wider field of interoperability players. That means Datavant’s market position depends on proving that network reach, privacy infrastructure, and workflow integration produce better outcomes than alternatives built around proprietary datasets, EHR-native platforms, or lightweight API connectivity. The company’s opportunity is large, but the winning position is not “own the market”; it is “be the trusted connective layer where fragmented records, privacy, and workflow complexity intersect.” For investors, the main market takeaway is that Datavant participates in several durable and expanding spending pools with strong regulatory support. The open questions are not about whether this market exists, but about how much share Datavant can convert into high-quality recurring revenue, how defensible the network effects remain as competitors improve, and whether the company can keep spanning operational retrieval workflows and advanced RWE use cases without losing focus or margin quality.[CM006, CM014, CM018, CM022, CM032, CM034]

2.6 Exhibits

3.1 Competitive landscape: more than one type of rival

The buyer can solve Datavant’s job in several different ways, which is why a narrow list of tokenization peers would understate competition. Some competitors own large healthcare data ecosystems and sell analytics or evidence generation directly. Others provide interoperability rails, FHIR infrastructure, or workflow automation that let customers move data themselves. Still others are incumbents in provider workflow, chart retrieval, or payer exchange and can absorb pieces of Datavant’s value proposition without ever calling themselves data-connectivity platforms. The result is a market where direct competition varies by use case: an HEOR buyer may compare Datavant with HealthVerity, Komodo, or Truveta; a payer or provider operations buyer may compare it with Veradigm, Redox, 1upHealth, or internal integration work. Keragon’s 2026 vendor survey captures the breadth of the field. It describes interoperability vendors ranging from no-code workflow providers to FHIR hubs, enterprise engines, and API platforms, and says buyers evaluate standards support, compliance, deployment speed, pricing transparency, and production scale. Athenahealth’s interoperability explainer reinforces the same practical reality: buyers do not just ask whether a vendor “does interoperability”; they ask whether it connects to their actual EHR, supports the right standards, clears HIPAA requirements, and deploys without months of custom engineering. That means Datavant competes not only on abstract data scale, but also on implementation burden, trust posture, and workflow fit. The status quo substitute remains important. Many customers still rely on fragmented point solutions, bespoke data engineering, manual record retrieval, or internal analytics teams stitching together claims and EHR assets. Datavant therefore competes against inertia as much as against brands. In segments where data holders already have strong proprietary assets, such as Komodo or Truveta, Datavant must show why a neutral connective layer still adds value. In operational workflows, it must show why its network and privacy tooling outperform incumbent release-of-information, integration, or RCM vendors.[CP001, CP002, CP003, CP004, CP005, CP006]

3.2 Direct peers: data ecosystems and evidence platforms

The closest direct peers are the companies that already combine large data assets with healthcare-specific identity, analytics, or evidence workflows. HealthVerity positions itself as the healthcare data platform built for breakthroughs and says HealthVerity plus Symphony Health now form one ecosystem connecting pharmacy, medical claims, labs, and EHR. It also emphasizes identity resolution and a marketplace for real-world data. Komodo takes a different angle: it highlights a massive linked-data foundation of more than one trillion records and 330 million de-identified patients, then layers auditable healthcare AI on top. Truveta differentiates on direct health-system sourcing, daily refresh, full traceability to clinical source, and explicit claims of regulatory-grade provenance. These rivals are not just data pipes; they bundle data access, analytics, and narrative around decision support. Datavant’s relative position inside this group is distinctive rather than obviously dominant. It markets itself as a privacy-preserving connective layer that can link proprietary and external data and help customers discover fit-for-purpose RWD across a 300-plus partner ecosystem. That can be stronger than a proprietary data owner when the buyer wants neutrality, interoperability across many counterparties, or connectivity into trial, payer, and provider workflows. But it can be weaker when the buyer prefers an integrated data-plus-analytics environment and is willing to adopt one vendor’s ecosystem end to end. Komodo and Truveta, for example, explicitly frame their offerings around complete or traceable data foundations that reduce wrangling for research teams. This means Datavant’s direct-competition moat is conditional. It is strongest when the buyer already has proprietary data or needs to connect across organizations without exposing PHI. It is less absolute when the buyer mainly wants immediate analytic answers from one existing data estate. For investors, the important point is that Datavant is competing against both connective layers and destination platforms, which raises the bar on product integration, workflow speed, and proof that privacy-preserving linkage adds measurable value over buying a vertically integrated dataset.[CP008, CP009, CP010, CP011, CP012, CP013]

3.3 Adjacents, incumbents, and internal build alternatives

Beyond the direct data-ecosystem peers, Datavant faces a wide set of interoperability and workflow vendors that can solve adjacent jobs. Redox pitches itself as an interoperability partner for intelligent healthcare data exchange at scale and publishes broad scale indicators such as 20 billion-plus healthcare transactions, 12,200-plus connected organizations, 14,900-plus live integrations, more than 100 EHR connections, and 99.95% uptime. 1upHealth, by contrast, is more explicitly payer- and FHIR-oriented, emphasizing CMS requirements, tech-agnostic architecture, and scalable data exchange for health plans. Zus packages a single shareable patient profile and medication / event alerts into care-delivery workflows. Veradigm brings an incumbent workflow footprint spanning EHR, e-prescribing, chart retrieval, payer-path clearinghouse, revenue-cycle services, and coding services. These adjacents matter because many customers do not buy a single “data connectivity platform.” They buy the narrowest tool that removes the binding constraint. A provider organization may prioritize document exchange or retrieval speed. A digital-health builder may want an API layer or aggregated patient profile. A payer may need CMS-aligned FHIR exchange. A health-tech vendor may buy Redox to reach trading partners quickly. In those contexts, Datavant does not always have the lowest-friction starting point, especially if the customer is not yet convinced it needs a broader privacy-preserving network. Internal build is the other real alternative. Some customers can combine cloud data engineering, direct source contracts, FHIR APIs, and workflow software to create acceptable in-house solutions. That route is slower and riskier, but it may look attractive to large enterprises that already control data, have strong security teams, and want to avoid platform dependency. Datavant’s sales motion therefore has to prove that network reach, compliance, governance, and workflow depth reduce time-to-value enough to beat both point vendors and internal-build paths.[CP016, CP017, CP018, CP019, CP020, CP021]

3.4 Pricing transparency, trust posture, and distribution power

Pricing is one of the least transparent parts of this market. Public sources show that Redox offers custom pricing, while most direct peers emphasize demos or sales conversations rather than list prices. That lack of public pricing makes competitive comparison difficult, but it also signals that vendors tailor contracts around data type, workflow, scale, and compliance burden. For Datavant, this cuts both ways. The company can price to value in high-friction or high-governance use cases, but buyers may also run long multi-vendor bake-offs because the market is negotiated rather than self-serve. Trust posture is more observable. Redox discloses HITRUST coverage and SOC 2 maintenance. Truveta emphasizes source traceability, audit readiness, and FDA-aligned data quality language. HealthVerity highlights HIPAA-compliant identity resolution. Datavant stresses HIPAA standards, IRB support, FedRAMP authorization in government materials, and privacy-preserving linkage. In practice, trust is not a side feature in this market; it is part of the product. Buyers in payer, provider, and life-sciences settings often need evidence that a vendor can manage privacy, lineage, and access controls before they care about downstream analytics. Distribution power is equally important. Data-ecosystem owners such as HealthVerity, Komodo, and Truveta can sell the convenience of a large existing data foundation. Interoperability rails such as Redox or 1upHealth can sell faster connection into counterparties and standards-native deployment. Incumbent workflow vendors such as Veradigm can cross-sell from existing operational relationships. Datavant’s answer is to sell the combination: a network-of-networks, privacy layer, and workflow infrastructure that can span multiple counterparties. Whether that wins depends on how much buyers value neutrality and cross-organization reach versus owning one pre-integrated stack.[CP024, CP025, CP026, CP027, CP028, CP029]

3.5 Moat durability, multi-homing risk, and where Datavant can still lose

Datavant’s moat is real but not absolute. The strongest evidence for durability is network reach across real-world-data partners, health systems, facilities, and regulated workflows, combined with a privacy-preserving matching capability that can work across organizations that do not want to expose PHI. That is different from simply owning a large dataset or offering one API. The more counterparties, data rights, and workflows that already run through Datavant, the more valuable it can become as a neutral hub. But multi-homing risk is high. Buyers can use a data-ecosystem owner for one project, an interoperability rail for another, and an incumbent workflow vendor for operational exchange. The market is modular enough that Datavant is not automatically the system of record everywhere. Competitive pressure could also intensify if proprietary data players continue to expand linkage and interoperability, or if low-friction API and workflow vendors commoditize the exchange layer. Even Datavant’s customer wins with AWS, Labcorp, and Thermo Fisher indicate that partnerships with powerful platforms are part of the strategy, not something the company can ignore. The investment implication is that Datavant’s competitive position should be underwritten as durable in selected jobs-to-be-done, not as universally unassailable. The company looks strongest when privacy-preserving cross-party linkage, workflow reach, and partner neutrality matter at once. It looks more vulnerable when a buyer can accept one vendor’s proprietary data estate, when operational exchange alone is enough, or when internal build economics appear manageable. That is a solid but conditional moat, and it makes execution, partner access, and product breadth central to the thesis.[CP012, CP014, CP020, CP030, CP031, CP032]

3.6 Exhibits

4.1 Revenue model: a hybrid of platform and services

Datavant’s public surfaces do not describe a single clean SaaS revenue engine. Instead, the company sells across several workflow families: Datavant Connect for data discovery and privacy-preserving connectivity; trial and HEOR use cases for life sciences; health-plan retrieval and coding; government and nonprofit linkage; and retrieval or release-of-information style workflows tied to medical payment, verification, and continuity-of-care use cases. The 2021 merger release also made clear that the combined Datavant-Ciox business brought together tokenization technology with a large clinical data exchange and release-of-information network. In financial terms, that points to a hybrid model mixing software-like platform economics with services, workflow execution, and transaction or volume-linked revenue. The public evidence reinforces that view. Health-plan pages emphasize multichannel retrieval, coding support, lower acquisition fees, and retained payer customers. Government pages emphasize privacy experts and disclosure-risk support. Commercial-pharma and clinical-research pages emphasize linked RWD, cohort discovery, trial tokenization, and fit-for-purpose evidence generation. AWS and Labcorp announcements highlight data discovery, privacy-preserving collaboration, and faster analytics, which are closer to platform monetization. This breadth is strategically attractive because it gives Datavant several revenue streams, but it also means investors should not assume the gross-margin structure of a pure software company. Some revenue almost certainly carries labor, implementation, fulfillment, or data-access costs that behave differently from standard SaaS. The best public financial anchor remains the 2021 merger announcement, which said the combined company would have revenue of more than $700 million. That number confirms meaningful scale, but it does not answer the harder underwriting questions: what percentage is recurring software, what percentage is workflow or managed services, how much is pass-through third-party spend, and which segments generate the best contribution margins. Those unknowns dominate the financial analysis more than the top-line scale signal itself.[CI001, CI002, CI003, CI004, CI005, CI006]

4.2 Pricing, monetization, and GTM efficiency proxies

Datavant discloses almost no generalized list pricing, which is typical for enterprise healthcare-data vendors but still important. The health-plan page is one of the rare sources with explicit economic language: it claims 20% to 40% lower fees than other vendors’ total chart-acquisition costs. That suggests at least some of Datavant’s retrieval and coding-related offerings are sold on a hard-dollar ROI basis tied to cost-out, turnaround times, or yield. In life sciences and research workflows, however, the packaging appears more solution-led: connectivity, linked datasets, cohort discovery, trial support, or privacy-preserving collaboration. Those products likely monetize by contract scope, dataset access, usage, or a mixture of platform and service components rather than a simple seat-based subscription. The GTM implication is that Datavant probably runs several sales motions at once. Health-plan and provider workflows can be sold as operational improvement with measurable savings, while life-sciences offerings are sold against speed, evidence quality, and research productivity. AWS and Thermo Fisher announcements indicate that partner-led distribution and ecosystem co-selling matter in at least some segments. Labcorp’s Alzheimer’s platform announcement suggests Datavant can also participate as a connectivity layer inside another company’s offering rather than only as the visible prime contractor. This multi-motion GTM broadens demand but usually lengthens diligence requirements for investors because sales efficiency, payback, and contract quality may differ sharply by segment. Publicly, there is not enough information to calculate CAC, payback, or average contract value. The best proxies are indirect: the company claims high retention in health plans, broad network access, and relevance across large regulated buyers. Those are encouraging demand signals, but they are not substitutes for cohort-level commercial data.[CI009, CI010, CI011, CI012, CI013, CI014]

4.3 Cost structure and what likely drives gross margin

Datavant’s cost structure is not publicly disclosed, but the product mix implies several layers of cost. Retrieval and release-of-information operations likely carry fulfillment labor, compliance operations, document handling, and customer-service overhead. Coding-related products can add specialist labor and QA costs. Privacy and expert-determination services imply data-science and compliance headcount. Connectivity and cloud-native discovery products add infrastructure and engineering costs. That combination argues against treating Datavant like a simple high-gross-margin API or data SaaS vendor. Instead, gross margin likely varies meaningfully by workflow and by the degree of manual service delivery in each product line. Public-company comparables support the idea that healthcare data businesses often blend software and services. IQVIA’s 2024 10-K shows that the majority of revenue in its Research & Development Solutions segment relates to service contracts recognized over time using a cost-based input method, with direct labor and third-party costs shaping revenue recognition. Health Catalyst’s 2025 10-K describes a model that combines technology, interoperability, analytics, professional services, and tech-enabled managed services. Those companies are not Datavant, but they are useful analogues for why the company’s public breadth should be read as a mixed-economics model rather than a pure software margin story. The strongest financial positive is that Datavant appears able to monetize multiple workflow layers around the same underlying data-connectivity problem. The strongest financial risk is that investors cannot see the actual contribution margin of each layer. A business that combines platform revenue with labor-intensive workflows can scale very well, but it can also hide lower blended gross margins, slower margin expansion, or more working-capital complexity than headline market positioning suggests.[CI016, CI017, CI018, CI019, CI020, CI021]

4.4 Public traction and capital adequacy

The disclosed traction signals are substantial even if they are not full financial statements. The merger announcement said the combined company would have more than $700 million in revenue. Recent Datavant materials say the company enables more than 60 million healthcare records to move between thousands of organizations, covers more than 80,000 hospitals and clinics, serves 75% of the 100 largest health systems, and connects with more than 350 real-world-data partners. Health-plan materials claim access to 80,000-plus hospitals and clinics, 20,000-plus digital FHIR connections, 98% annual customer retention, and 93% penetration across leading MA, Medicaid, and ACA plans. Commercial-pharma and clinical-research materials claim 40-plus life-science customers, more than 100 brands, more than 100 clinical trials, and more than 64 million record retrievals annually. These are all meaningful throughput or distribution signals. Capital adequacy, however, remains opaque. Mercom reported the pre-merger Datavant company had raised more than $83 million by the 2020 Series B. The 2021 merger announcement said the $7.0 billion transaction was supported by an existing investor group plus significant new investment from Sixth Street and Goldman Sachs Asset Management. Those facts demonstrate sponsor access and transaction support, but they do not disclose current cash on hand, debt load, monthly burn, covenants, or runway. For a private company that has since completed large acquisitions and broadened product scope, those omissions matter. Public investors cannot tell whether Datavant is self-funding growth, relying on sponsor support, or absorbing substantial integration and restructuring costs. The financial takeaway is therefore asymmetric: public sources strongly suggest Datavant is large enough to matter and broad enough to support a durable business, but they do not support a clean view on current free-cash-flow conversion or financing dependency. Investors should treat capital adequacy as unresolved until management discloses updated leverage, liquidity, and post-acquisition integration economics.[CI023, CI024, CI025, CI026, CI027, CI028]

4.5 Financial verdict: good scale, weak visibility

Datavant’s public financial profile is better described as “evidence of scale without evidence of quality.” The scale case is straightforward: the company combines a large historical revenue base from the Ciox merger, a broad retrieval footprint, material provider and payer reach, and rising life-sciences relevance through products and partnerships. The quality case is much less proven. Public materials do not disclose revenue mix, gross margin by stream, customer concentration, cash generation, debt obligations, or post-acquisition integration costs. Pricing visibility is thin, and even the most explicit economic claims focus on savings relative to other vendors rather than on Datavant’s own realized margins. That does not make the company financially weak; it makes the company financially under-disclosed. In some ways, the breadth of revenue streams could be a strength because it diversifies demand across life sciences, payers, providers, government, and legal-insurance workflows. In other ways, the same breadth raises execution and margin questions because different product lines can carry very different delivery costs and renewal dynamics. The 2026 settlement over the 2024 breach is also a reminder that legal or security events can convert trust issues into direct financial cost. On balance, the public evidence supports a view that Datavant has meaningful monetization surface and strong market relevance, but not a view that margin path, burn profile, or capital intensity are safely underwritten. For diligence, this chapter is a “research-more” financial read, not a “high-confidence” economics case.[CI030, CI031, CI032, CI033, CI034, CI035]

4.6 Exhibits

5.1 What Datavant actually delivers in workflow terms

Datavant’s product is easiest to understand as a workflow stack rather than a single application. Public solution pages show at least six recurring modules: health-data retrieval, release of information, risk-adjustment / HCC coding, record-request automation, privacy-preserving linkage and privacy hub services, plus data discovery / collaboration workflows such as Datavant Connect. These modules are sold to different buyer groups but all sit on the same broader mission of securely connecting health data across organizations. The company also describes the Datavant Switchboard as the underlying platform for both identified and de-identified data, which suggests that several surface-level products reuse a shared internal operating model for routing, retrieval, privacy filtering, and delivery. This product definition matters because it explains why Datavant can serve providers, health plans, government agencies, life-science customers, law firms, and insurance workflows without being “just” an interoperability API or “just” a record-retrieval business. Some products are clearly workflow applications: coding operations, release of information, request automation. Others are infrastructure or platform layers: Switchboard, FHIR Worker, privacy-preserving record linkage, cloud-first data discovery. The company’s public materials repeatedly position these products as ways to reduce the friction of exchange, improve data yield, and preserve trust under HIPAA and other governance regimes. For diligence, the key takeaway is that Datavant’s product breadth is real and not merely marketing taxonomy. The breadth creates cross-sell surface and strategic resilience, but it also raises complexity: shared platform pieces must support many workflows, data types, and regulatory contexts at once.[CE001, CE002, CE003, CE004, CE005, CE006]

5.2 Architecture and operating model: Switchboard, FHIR Worker, and configurable retrieval

The most substantive public technical detail comes from Datavant’s engineering writing on the Switchboard and API retrieval. Datavant describes the Switchboard as supporting both identified and de-identified data and explains that the identified side fulfills records requests through three mechanisms: manual retrieval, third-party services, and first-party connections directly to health-system EHR APIs. The FHIR Worker is the component that facilitates direct retrieval over those first-party connections and returns requested data in layouts determined by the requester. Public technical notes also describe how the Worker identifies the patient in the EHR, retrieves the needed resource types, filters data to comply with HIPAA’s minimum-necessary concept, and adapts to highly variable FHIR and non-FHIR implementations. Datavant’s technical writeups also make the internal operating model unusually explicit. The API retrieval redesign moved from push-style scheduling to a pull-based model in which FHIR/EHR workers pull prioritized requests from a Redis sorted set. A Controller manages request lifecycle, a Dispatcher submits work, and workers return results through notification queues. Datavant says the redesign processed at-scale loads in minutes that would have taken hours in the legacy system, and that the system is horizontally scalable enough to aim for ten times chart volume while making provider APIs rather than Datavant’s own scheduling logic the bottleneck. The company also describes a configuration-first approach using JSON Resource Definitions validated with Pydantic so lay users can support new EHRs and use cases without constant new engineering builds. This is not proof of perfect reliability, but it is stronger technical evidence than generic healthcare IT marketing. It shows Datavant has built genuine data-plane and workflow-orchestration capabilities for messy, heterogeneous EHR environments. The architecture is therefore a source of differentiation, but also a source of complexity and technical debt risk if variance or customer-specific retrieval needs continue to expand faster than automation.[CE007, CE008, CE009, CE010, CE011, CE012]

5.3 Deployment, integration, and product maturity

Deployment at Datavant is constrained by real-world data fragmentation. The company’s engineering materials repeatedly note that one API connection into an EHR provider does not expose all available patient data, that different health systems configure FHIR resources differently, and that some data remains available only in proprietary formats. As a result, Datavant has had to build not just connectors, but a flexible operating model that can summarize requested information across different use cases, data models, and provider-specific configurations. The company’s health-data retrieval and record-request-automation materials also show that manual and digital retrieval coexist; Datavant’s network can accelerate digital access, but retrieval experts still manually obtain records outside the network. Public product evidence suggests several modules are mature. Retrieval workflows cite over 80,000 hospitals and clinics, over 45 years of retrieval experience, 64 million-plus annual retrievals, and 97% retention among health-plan requesters. Coding products cite KLAS leadership, 4.5 million charts coded annually, and 98% coding accuracy. Datavant Connect powered by AWS is framed as generally available after testing with top pharmaceutical companies and data partners. FedRAMP authorization also indicates a deployment posture mature enough to serve federal agencies and secure government-linked research infrastructure. At the same time, the public materials also describe current platform work such as faster API retrieval, expanding cloud-first data discovery, and evolving AI-enabled coding, which means the product is both mature in operations and still actively evolving in architecture. The practical implication is that Datavant is not a pre-product or single-feature company. It is already operating at meaningful production scale. But maturity is uneven across modules: retrieval and coding look operationally seasoned, while AI, cloud discovery, and some government-grade capabilities appear to be in active expansion.[CE016, CE017, CE018, CE019, CE020, CE021]

5.4 Differentiation, data advantage, and developer signal

Datavant’s technical differentiation is not based on one patentable algorithm visible in public documents. Instead, the company’s advantage appears to come from workflow reach, partner reach, and engineering tuned for the variance of real healthcare data exchange. The Switchboard and FHIR Worker materials show that Datavant is solving for first-party EHR connections, configuration-driven data retrieval, and minimum-necessary filtering at scale. Government and privacy materials show that the company layers privacy expertise and disclosure-risk workflows on top of those pipes. AWS and Labcorp announcements show that Datavant can then expose those capabilities in cloud-first evidence-generation products. KLAS material adds another dimension: the company’s Clinical Insights Platform and coding products combine AI with retrieval, storage, sharing, and documentation workflows. Developer-signal evidence is limited but meaningful. Datavant publishes engineering blogs on FHIR retrieval, software-engineering culture, and the engineering interview process. The API retrieval writeup explicitly names engineering teams, technologies such as Redis and Pydantic, and specific architectural tradeoffs. The open-roles page and anti-phishing careers notice indicate active recruiting processes and a sufficiently scaled organization to manage applicant-security risk. This is not the same as an open-source ecosystem or a public API community, but it is credible practitioner-facing evidence that Datavant has a real internal engineering organization building domain-specific infrastructure rather than outsourcing all innovation to vendors. The main caution is that differentiation is partly organizational and network-based rather than easy to benchmark in a lab. Buyers must trust that Datavant’s retrieval yield, compliance posture, and cross-party connectivity outperform alternatives in production, because most of the value only appears when the platform is embedded in actual workflows.[CE023, CE024, CE025, CE026, CE027, CE028]

5.5 Trust, safety, security, privacy, and quality controls

Trust controls are a major part of Datavant’s product, not an afterthought. Public security and FedRAMP materials show that the company moved from a SOC 2-style control set to FedRAMP Moderate with 326 controls, a 450-page security plan, continuous vulnerability management, and explicit use of government-grade tooling such as Datadog for Government and FIPS-compatible AWS configurations. The company says it did not separate commercial from federal deployments, meaning those security improvements also affect commercial customers. It also notes real engineering consequences from those controls, such as renaming S3 buckets to comply with FIPS endpoint and TLS-certificate constraints. Those are unusually concrete signals that the compliance story is tied to actual platform design. Datavant’s privacy controls are also productized. Privacy Hub materials emphasize disclosure-risk assessment, de-identification, and maximization of analytical utility while meeting HIPAA requirements. The FHIR Worker article explains that the platform filters retrieved information to enforce minimum-necessary logic. Government materials say the platform is FedRAMP authorized and SOC II certified while supporting IRB requirements. KLAS materials add quality signals on the coding side, including 98% coding accuracy and customer feedback around audit-defensible operations. The AIUC consortium announcement suggests Datavant is also trying to shape external standards around agentic AI safety, security, and reliability. The technology-risk takeaway is favorable but not perfect. Datavant appears to have stronger-than-average security and compliance maturity for a private healthcare-data vendor, yet that maturity also increases operating complexity and cost. The company’s trust posture is therefore a defensible differentiator, but also a dependency: if security or privacy execution weakens, the product story weakens with it.[CE030, CE031, CE032, CE033, CE034, CE035]

5.6 Exhibits

6.1 Customer segmentation and who actually pays

Datavant’s customer base is clearly multi-segment. Public pages cover commercial pharma, clinical research and development, health plans, government programs, providers, legal and insurance requesters, and broader research users. That is important because the buyer, user, and payer often differ. In life sciences, buyers can be HEOR, clinical development, or commercial analytics leaders while users include data managers, epidemiologists, and researchers. In health plans, buyers can be quality or risk-adjustment leaders while users include coders, reviewers, and operations teams. In government and nonprofit research, buyers may be program leaders or grant-backed investigators, while users include researchers and privacy/compliance teams. The company’s public segment pages make two things visible. First, Datavant is not dependent on one narrow end market. Second, the product often sits in workflows that can become mission critical once adopted: chart retrieval for payer submissions, coding accuracy for reimbursement, clinical-trial linkage for follow-up evidence, or privacy-preserving linkage for national research programs. This supports the idea of strategic rather than purely experimental adoption. At the same time, the public record says very little about revenue distribution across these segments. The customer base is clearly diversified by workflow, but investors cannot tell which segments dominate revenue, expansion, or margin. That means segmentation is easy to observe qualitatively and still hard to underwrite quantitatively.[CU001, CU002, CU003, CU004, CU005, CU006]

6.2 Adoption trajectory and breadth of deployment

Datavant’s public adoption signals are broad and unusually concrete even when they are not clean financial metrics. The company says it enables more than 60 million healthcare records to move across its ecosystem, reaches more than 80,000 hospitals and clinics, serves 75% of the 100 largest health systems, and works with 350-plus real-world-data partners. Health-plan pages cite access to 80,000-plus hospitals and clinics, 20,000-plus digital FHIR connections, 93% of leading Medicare Advantage, Medicaid, and ACA health plans, and 98% annual retention of health-plan customers. Commercial-pharma and clinical-research pages say Datavant works with 40-plus life-science customers, 100-plus brands, and more than 100 clinical trials. These claims do not answer every question about active accounts or net revenue retention, but they do indicate that Datavant’s adoption is beyond pilot scale. Several signals also imply production use rather than branding-only relationships. Datavant’s AWS-backed product was tested with four top-20 pharmaceutical companies and multiple named data partners before general availability. Labcorp’s Alzheimer’s platform uses Datavant’s connectivity layer inside a production research offering. The KLAS press release quotes provider-side customers discussing real-time feedback, staffing help, and coding workflow impact, which is stronger evidence than a logo wall alone. The best reading is that Datavant has strong deployment breadth and credible throughput. The main missing denominator is account-level visibility: public sources still do not show how many of these relationships are large recurring contracts, how many are partner-embedded, and how many are smaller or narrower workflow wins.[CU007, CU008, CU009, CU010, CU011, CU012]

6.3 Named customer proof and what counts as real production use

Named customer proof is strongest where Datavant appears inside an operational or research workflow. Labcorp’s April 2026 launch is strong proof because it explicitly describes a platform developed with AWS and Datavant, anchored in deidentified and privacy-protected data, intended to accelerate Alzheimer’s research and cohort identification. Thermo Fisher’s PPD business is another strong proof point because the public announcement frames the collaboration as advancing real-world-data interoperability across clinical development. Government-sector proof is meaningful as well: Datavant’s own government page describes the company as a key partner in PCORnet, the NIH National COVID Cohort Collaborative, and the All of Us Research Program. The FedRAMP press release adds specific context that Datavant provides privacy-preserving infrastructure for NCATS’ N3C. There is also segment-specific proof on the payer and provider side. The KLAS release includes direct customer commentary on coding workflow performance and staffing support, plus external rankings for risk-adjustment and outsourced coding. The health-plan page claims 98% customer retention and broad plan penetration, while retrieval pages cite 97% retention among health-plan requesters and 64 million annual retrievals. Those signals are not perfect named-logo references, but they point to repeat operational use rather than one-off pilots. The limitation is that public proof still skews toward successful or strategic references. We do not see failed deployments, contract durations, or explicit renewal cohorts. So the named proof is good enough to establish reality, but not good enough to settle durability questions.[CU015, CU016, CU017, CU018, CU019, CU020]

6.4 Retention, expansion, and concentration

The public record provides a few retention clues but not a full durability model. On the positive side, Datavant claims 98% annual retention among health-plan customers and 97% retention among health-plan requesters on retrieval materials. KLAS customer quotes also suggest operational embeddedness: customers describe Datavant as helping with real-time provider feedback, staffing, and workflow streamlining. That kind of language usually indicates more than a lightweight tool relationship. Datavant’s broad partner ecosystem and multiple workflow entry points also suggest land-and-expand potential, because a customer can begin with retrieval, coding, trial linkage, or cloud discovery and later add adjacent modules. But concentration and company-wide retention remain opaque. We do not know whether a few payer or life-science relationships account for a large share of revenue, whether partner channels dilute direct customer ownership, or whether one workflow category drives most expansion. Public sources also do not disclose NRR, GRR, contract length, logo churn, or cohort behavior over time. Even the strongest retention claims are segment-specific and company-authored. The balanced conclusion is that Datavant looks sticky in at least some workflows, especially payer retrieval/coding and government-grade data linkage. However, there is not enough public evidence to prove that the entire customer base behaves like a best-in-class land-and-expand software cohort.[CU023, CU024, CU025, CU026, CU027, CU028]

6.5 Expansion opportunity versus customer risk

Expansion paths at Datavant are visible: a health plan can add coding to retrieval, a pharma customer can add cloud discovery to tokenization or trial follow-up, and a government or nonprofit customer can combine linkage, retrieval, and privacy services. The company’s ecosystem also creates partner-driven reach, which can lower customer-acquisition friction in some workflows. But the same structure creates risks. Partner-embedded offerings can make Datavant strategically important while obscuring direct customer ownership. Broad network and throughput claims can also mask unequal revenue concentration if a smaller set of logos or channels generates most of the economics. There is also trust risk. Because Datavant’s value depends on secure, compliant data movement, the 2026 settlement tied to the 2024 breach matters for customer durability even in the absence of public churn data. In highly regulated workflows, security or privacy incidents can slow sales, reduce expansion, or increase procurement friction. The public source set does not show whether that happened, but it is a real customer-risk vector. Overall, the customer thesis is solid on adoption proof and strategic relevance, but incomplete on economics. Datavant appears to have real, diversified, production-grade customer relationships. What remains unproven publicly is whether those relationships produce the kind of broad-based recurring expansion and low concentration that would justify maximum confidence in the customer-quality story.[CU029, CU030, CU031, CU032, CU033, CU034]

6.6 Exhibits

7.1 Severity-ranked risk overview

Datavant’s risk profile is unusual because many of its core risks are inseparable from its core strengths. The same multi-party data connectivity, privacy-preserving linkage, and workflow reach that create differentiation also increase exposure to data-governance failures, breach costs, API variance, partner dependency, and operational complexity. Unlike a simple SaaS product, Datavant has to manage security, compliance, data quality, fulfillment operations, and customer trust simultaneously across providers, payers, life sciences, and public-sector users. The most severe current risk category is trust and legal exposure. The 2026 settlement tied to the 2024 breach shows that security incidents can become direct financial and reputational liabilities. Because Datavant sells trusted movement of sensitive data, any privacy or security weakness can spill into sales cycles, renewal behavior, and scrutiny from regulators or customers. The second major risk bucket is execution complexity: Datavant’s own engineering materials show that interoperability remains fragmented, APIs are inconsistent, and manual retrieval still coexists with digital retrieval. That means scaling the platform is partly a technical problem and partly a workflow-operations problem. The third major bucket is strategic opacity. As a private company with broad products and acquisitions, Datavant discloses little about revenue mix, margin, concentration, or capital adequacy. That does not prove weakness, but it makes it harder to know which risks are most economically material. The chapter therefore ranks risks by transmission power into customer trust, margins, and funding confidence rather than by sensationalism alone.[CR001, CR002, CR003, CR004, CR005, CR006]

7.2 Regulatory and legal risk

Regulatory and legal risk is fundamental for Datavant because healthcare data exchange lives inside overlapping privacy, security, interoperability, and public-sector control frameworks. HHS privacy and security guidance, ONC information-blocking expectations, CMS interoperability policy, and Datavant’s own privacy and FedRAMP materials all point to a business environment where compliance is not optional or static. Datavant’s privacy writing also shows the company is operating in a world of evolving state health-data and AI policy, not only federal HIPAA rules. That raises change-management risk even when the company is currently compliant. The most concrete legal signal is the 2026 settlement tied to the 2024 breach. Even without full court-record detail in the public source set, the settlement and related coverage establish that a major privacy/security event can turn into litigation cost and broader trust overhang. The risk is not limited to one historical event. Datavant’s value proposition requires customers to trust its de-identification, minimum-necessary filtering, retrieval security, and governance posture. If those claims are challenged by regulators, courts, or customers, the damage can transmit into delayed procurements, heightened contractual demands, or loss of public-sector opportunities. At the same time, public evidence also shows mitigation maturity. FedRAMP Moderate authorization, 326 controls, continuous monitoring, and N3C-related public-sector work suggest Datavant has invested heavily in the control environment. The legal/regulatory verdict is therefore not “weak controls,” but “high-stakes operating environment where any control failure matters more than average.”[CR008, CR009, CR010, CR011, CR012, CR013]

7.3 Operational, quality, and security execution risk

Operational risk at Datavant is not limited to uptime or cloud outages. The company’s engineering blogs show that record retrieval at scale depends on heterogeneous EHR APIs, configuration-driven logic, prioritization queues, provider-specific variance, and in some cases manual fallback. Public retrieval pages also make clear that digital and manual methods coexist. That means Datavant must continually manage a hard edge where product automation meets operational fulfillment. Risks include slower turnaround, lower yield, manual bottlenecks, data-quality issues, and inconsistent customer experience if a workflow falls outside the strongest digital paths. Security execution risk is equally important. Datavant’s own FedRAMP materials describe ongoing continuous-monitoring burdens, expensive government-grade tooling, and architecture changes required by FIPS and control requirements. Those are positive signs of seriousness, but they also show that security is costly and operationally intrusive. In other words, the mitigation is itself a permanent operating commitment. The company’s product breadth adds another layer of quality risk: coding accuracy, retrieval completeness, de-identification quality, and data discovery integrity all have to hold at once. The KLAS release and coding materials offer positive signals such as 98% coding accuracy and high customer-service marks, but those signals apply to selected workflows rather than the full platform. The operational verdict is that Datavant appears competent and mature, but the system it is operating is inherently complex. That makes operational slippage a medium-to-high recurring risk even if no single failure mode is currently visible in public reporting.[CR016, CR017, CR018, CR019, CR020, CR021]

7.4 Partner, platform, customer, and people dependency risk

Datavant is dependent on multiple external systems and stakeholders. Its retrieval stack depends on provider APIs and EHR configurations. Its cloud-first discovery products depend on AWS and participating data partners. Its public-sector posture depends in part on continuing to satisfy FedRAMP obligations and maintain trusted government relationships. Its coding and retrieval workflows likely depend on sustained access to experienced domain staff. Public materials also show that the company increasingly works through partners such as Labcorp, AWS, and Thermo Fisher / PPD, which can expand distribution but also create channel and ownership risk. These dependencies do not imply fragility, but they create concentration questions. If a small number of large partners or programs drive outsized value, Datavant could face pricing pressure, roadmap constraints, or customer-access issues it does not fully control. The same is true for people risk: maintaining specialized engineering, privacy, compliance, and operational talent is part of the moat. FedRAMP and high-governance workflows, in particular, are not easy to run with generic staff. Datavant’s public recruiting and engineering materials imply continued investment here, but private investors still need to know how much institutional knowledge sits with a relatively small set of technical or operational leaders. Dependency risk is therefore a classic hidden multiplier. It can convert a moderate technical or partner issue into a larger revenue or customer-retention issue if too much of the system is concentrated in one channel, vendor, dataset, or team.[CR023, CR024, CR025, CR026, CR027, CR028]

7.5 Financial/model risk, mitigations, and thesis-break triggers

Datavant’s financial risk is less about proven distress and more about under-disclosure. Public evidence does not reveal current cash, debt, burn, or product-line margins. That matters because Datavant combines platform-like products with potentially labor-intensive retrieval, coding, and compliance workflows, and because continued control and security investment can be expensive. Private-company opacity also obscures concentration, direct-vs-channel revenue mix, and the economics of integrating acquisitions or partner-led products. As a result, financial/model risk remains tightly linked to execution risk and cannot be fully separated from it. Mitigation exists in several forms: historical sponsor backing, broad segment reach, strong trust investments, and signs of operational maturity. But mitigations are not the same as resolution. The right question for investors is not whether Datavant has risks — it obviously does — but whether those risks are actively monitored, compartmentalized, and consistent with the price. The clearest thesis-break triggers would be a repeat or materially escalated security incident, evidence that trust issues are slowing sales or renewals, proof that the company cannot automate enough of its workflow-heavy products to protect margins, or discovery that a few channels or accounts dominate economics. This leaves the final risk verdict in the middle: Datavant’s risk set is serious but intelligible. It does not look like a fragile business, yet it does require much more diligence than a simple “largest network in healthcare data” narrative would suggest.[CR029, CR030, CR031, CR032, CR033, CR034]

7.6 Exhibits

8.1 Investment thesis and anti-thesis

The core long thesis is easy to understand. Datavant sits at an important intersection of healthcare interoperability, privacy-preserving linkage, retrieval workflow, and evidence-generation infrastructure. Public evidence shows broad network reach, meaningful operational throughput, strong relevance across payers, providers, life sciences, and public-sector research, plus unusually substantive security and engineering signals for a private company. It is not a concept-stage story. It appears to be a scaled infrastructure business that solves real problems in high-value, regulated workflows. The anti-thesis is just as important. Datavant is private and hybrid. Its public narrative is stronger on strategic relevance than on economic quality. Investors still cannot see current revenue mix, gross margin by product, direct-vs-channel ownership, customer concentration, or current liquidity. The company’s 2021 $7.0 billion transaction already implied a premium valuation on a disclosed revenue floor of more than $700 million, and that multiple may only be justified if today’s business looks much more software-like, durable, and margin-expansive than the public record proves. The 2026 settlement tied to the 2024 breach also shows that trust failures can become real financial and customer risks, not just abstract governance concerns. This means Datavant is a compelling company-quality story but a price-sensitive investment story. The right call from public evidence is not to dismiss the business. It is to insist on tighter evidence before treating the asset like a high-confidence buy at a premium multiple.[CV001, CV002, CV003, CV004, CV005, CV006]

8.2 Financing and valuation context

The cleanest public financing anchor remains the June 2021 Datavant-Ciox merger announcement. That release said the transaction was valued at $7.0 billion and that the combined company would have revenue of more than $700 million. On that historical revenue floor alone, the implied revenue multiple was roughly 10x. That is a high multiple for a business that included both connectivity technology and operational clinical data-exchange / retrieval infrastructure. The company also had backing from a broad investor group and significant new investment from Sixth Street and Goldman Sachs Asset Management, while Mercom reported that the original Datavant startup had raised more than $83 million by the 2020 Series B. Those facts support two conclusions. First, sophisticated investors have been willing to underwrite Datavant as a large, strategic asset for years. Second, the public record does not tell us what multiple today’s buyer would actually be underwriting because current revenue, margin, and capital structure are not public. Since 2021, Datavant has broadened products, expanded cloud-first data discovery, and deepened customer proof. That could justify continued strength. But absent updated financial disclosure, it could also mean investors are extrapolating too generously from old headline values. The company’s size and strategic role do not automatically mean the current price is attractive. So the financing context is supportive, but stale. The main valuation question is not whether Datavant can command a large price in principle. It is whether the quality and growth of the present business justify a premium multiple relative to public peers with much better disclosure.[CV008, CV009, CV010, CV011, CV012, CV013]

8.3 Bull, base, and bear scenarios

The bull case assumes Datavant increasingly behaves like the best parts of the narrative: a trusted, neutral data-collaboration layer with strong network effects, expanding cloud-first distribution, high renewal quality, and enough automation to let margin profile improve over time. In that case, the 2021 headline multiple may not have been unreasonable, especially if the business today is meaningfully larger than the disclosed >$700 million historical revenue base and if software-like discovery, linkage, and compliance products are becoming a larger share of mix. The best support for this case is the company’s breadth of customer proof, strong operational reach, and ecosystem role in high-value workflows. The base case is more conservative. It assumes Datavant is a very good business with mixed economics: some premium software-like workflows, some sticky but labor-heavy retrieval/coding operations, meaningful compliance and partner costs, and real but not fully visible retention quality. Under that framing, Datavant deserves a substantial valuation, but investors should resist maximum SaaS multiples until they see product-line margin and concentration data. The historical 10x revenue-like anchor then looks more stretched than bargain, even if it was strategically rational for sponsors. The bear case assumes public opacity is hiding weaker economics: lower blended margins, greater channel dependence, concentration in a few accounts or programs, or security/trust overhang that slows renewals. In that world, Datavant would look less like Veeva and more like a hybrid services-and-software asset that should trade closer to lower public healthcare-data multiples. Because the current public record cannot rule this out, the bear case has to remain live in any honest underwriting exercise.[CV015, CV016, CV017, CV018, CV019, CV020]

8.4 Comparable set and valuation logic

Public comparables show how wide the multiple range can be for healthcare-data and workflow businesses. As of July 2026, CompaniesMarketCap lists IQVIA at about $34.9 billion market cap, Veeva at about $30.8 billion, Health Catalyst at about $0.16 billion, and Phreesia at about $0.66 billion. Public revenue sources show Veeva generated about $2.747 billion in annual revenue for 2025, Phreesia about $420 million for 2025, Health Catalyst about $311.1 million for 2025, and IQVIA’s Research & Development Solutions segment alone about $8.527 billion for 2024. These are not perfect apples-to-apples comps, but they are useful boundary markers. Using simple market-cap-to-revenue heuristics, the public comp set spans roughly 0.5x for Health Catalyst, about 1.6x for Phreesia, about 4.1x for IQVIA using the R&D Solutions segment anchor, and about 11.2x for Veeva. Datavant’s 2021 headline of $7.0 billion against a disclosed revenue floor above $700 million implies roughly 10x — much closer to Veeva’s premium software multiple than to hybrid or services-heavy peers. That is the single most important valuation warning in the entire chapter. Publicly, Datavant has not yet earned the right to be assumed Veeva-like in economics simply because it is strategically impressive. The right comp logic is therefore not “Datavant is worth what the last sponsor-backed mark said.” It is “Datavant needs to prove why a premium multiple is still justified relative to better-disclosed public peers.” Without product-line margins, current growth, and retention data, the fair stance is stretched-to-fair depending on private evidence, not obviously attractive.[CV022, CV023, CV024, CV025, CV026, CV027]

8.5 Recommendation, diligence asks, and thesis-breakers

The recommendation from public evidence is research-more rather than buy. Datavant looks strategically valuable and operationally real, but the available evidence is still too thin on current economics to justify a high-conviction long call at a premium implied valuation. Confidence is medium because many core business-quality signals are positive, yet the valuation-sensitive inputs remain private. Risk rating is medium-high: not because the market or product thesis looks broken, but because trust, security, services mix, and capital opacity can all alter fair value materially. The most important diligence asks are straightforward. Investors need current revenue, growth, gross margin by stream, direct-vs-channel revenue mix, top-customer and top-partner concentration, NRR/GRR, current leverage and liquidity, and post-acquisition integration economics. If those data show a more automated, higher-margin, broadly retained business than the public record suggests, the valuation stance can move toward fair or even attractive at the right price. If they show a services-heavy, concentrated, or security-sensitive business with muted margin expansion, then the 2021 valuation anchor looks expensive in hindsight. The thesis-break triggers are equally clear: another material trust failure, evidence that security or legal issues are hurting customer growth, proof that hybrid operations cap margins, or disclosure showing concentration and channel dependence are much higher than expected. Until those questions are answered, the disciplined posture is to keep Datavant on a research-more track rather than force a buy decision from incomplete evidence.[CV029, CV030, CV031, CV032, CV033, CV034]

8.6 Exhibits