Case Study: How a Multi-Location Dental Platform Closed a Compliance Gap Before It Became an Exit Problem
8/4/20264 min read
A private equity-backed dental services organization operating twelve locations across three states engaged Sigma Technology Consulting roughly eighteen months before a planned exit, at the recommendation of the fund's operating partner, who wanted a clean technology and compliance picture well ahead of any buyer's diligence process rather than assembling one under deal pressure.
The operating partner's instinct came from experience on a prior exit at a different platform, where a compliance gap surfaced mid-diligence and cost several weeks of delay and an uncomfortable renegotiation. This time, the fund wanted to know the answer before a buyer ever asked the question.
Twelve Locations, Twelve Different Levels of Compliance Maturity
Each location had joined the platform through acquisition over a four-year period, and each had arrived with its own practice management system, its own approach to patient data security, and its own, often informal, understanding of HIPAA compliance requirements. Some locations had reasonably current security practices. Others were running patient record systems on outdated software with no documented access controls, no formal risk assessment on file, and no clear record of who at the practice had administrative access to protected health information.
None of this had surfaced as an active problem, since no location had experienced a breach or a complaint that triggered regulatory attention. But the absence of an incident isn't the same as the absence of risk, and a platform-wide compliance review had never been conducted across all twelve locations as a single exercise.
What the Audit Found
Sigma's audit assessed every location against a single, standardized HIPAA security rule checklist, covering access controls, encryption standards, audit logging, business associate agreements with third-party vendors, and documented risk assessments. Four of the twelve locations had no current, documented risk assessment on file at all, a specific, required element of HIPAA compliance that's also one of the first things a sophisticated buyer's diligence team requests by name. Three locations were still using practice management software versions no longer receiving security patches from the vendor. Business associate agreements with several third-party vendors, required whenever a vendor handles protected health information on the practice's behalf, were missing entirely for two of the locations' billing service providers.
Fixing It Well Ahead of the Exit Process
With eighteen months of runway before the anticipated sale process, Sigma worked with the platform to bring every location onto a common practice management platform version, implement standardized access controls and audit logging across all twelve locations, complete documented risk assessments where they were missing, and execute business associate agreements with every third-party vendor handling patient data. None of this required disrupting patient care at any location, and the standardization work also consolidated several redundant software licenses across locations, delivering a modest direct cost saving on top of the compliance benefit.
What This Meant When the Exit Process Began
When the fund began its sale process roughly a year later, the buyer's diligence team requested exactly the documentation Sigma had helped the platform assemble: current risk assessments for every location, evidence of consistent access controls, and a complete set of business associate agreements. The platform was able to produce a complete, current data room within days rather than scrambling to reconstruct missing documentation under deal timeline pressure, and the diligence process moved through the technology and compliance workstream without a single follow-up request for missing materials, a notably faster path than the buyer's team indicated was typical for platforms of this size and structure.
The Broader Lesson for Healthcare Services Platforms
Compliance gaps in a multi-location healthcare platform tend to be invisible precisely because they rarely cause a visible problem until a regulator, a breach, or a buyer's diligence team specifically goes looking for them. Waiting for one of those three triggers to discover a gap is considerably more expensive, and considerably more disruptive to a pending transaction, than finding and closing the same gap proactively, on a timeline the platform controls rather than one dictated by a deal clock or a regulatory inquiry.
Why This Kind of Gap Survives So Long Unnoticed
Individual location managers and practice owners, even conscientious ones, rarely have the specialized compliance background to recognize exactly which HIPAA requirements apply to their specific systems and vendor relationships, and platform leadership overseeing a dozen locations from a corporate level rarely has the bandwidth to audit each one individually without a dedicated, structured process for doing so. The result is a gap that exists quietly for years, not because anyone was negligent, but because no single person in the organization had both the technical knowledge and the mandate to check every location against a consistent standard.
This is precisely the kind of gap that a portfolio-wide, rather than location-by-location, review is uniquely positioned to catch, since it applies one consistent standard everywhere at once rather than relying on each location's own, inevitably varying, level of compliance awareness.
What the Fund Changed Going Forward
Following the engagement, the fund built a standardized compliance checklist into its onboarding process for any future dental platform acquisitions, ensuring every new location is assessed against the same standard within the first weeks of ownership rather than discovered as a gap years later during pre-exit preparation. The operating partner has since applied a similar structured review to two other healthcare-adjacent platforms in the fund's broader portfolio, treating this as a standard part of the fund's healthcare services playbook rather than a one-time fix specific to the dental platform.
Sigma Technology Consulting, Inc.
25 Years of Experience, Vetting & Procuring Technology Vendors
Contact Us
Support
© 2026. All rights reserved.
