Vertical SaaS go-to-market playbook for healthcare in 2027

Choose the buyer before the product

Healthcare is not one market, and the public filings show vendors splitting their sales organizations by buyer. Veeva's annual report says its life sciences customers' R&D and quality and commercial functions commonly have separate technology and business decision makers, so it runs distinct R&D and quality and commercial sales teams, and further segments by large global and smaller life sciences companies. Phreesia says it has a direct sales organization with dedicated sales and marketing teams for its healthcare services clients and its Network Solutions clients.

Doximity shows a third model. Its annual report says its revenue-generating customers are primarily pharmaceutical manufacturers and health systems, who get commercial solutions that benefit from broad usage by physicians. Its fiscal 2026 release says network members include more than 85% of U.S. physicians, with over 800,000 active prescribers using its workflow tools in the fourth quarter. The users are clinicians; the payers of the invoice are other parties.

Judgment: decide first who signs, who uses and who pays. In these three filings those are three different groups, and each needs its own message, its own references and its own sales team.

Plan for a long cycle and annual contracts

The sales-cycle statements in the filings are the best public data I found. Veeva's annual report says "the sales cycle for a new customer, from the time of prospect qualification to the completion of the first sale, may span 12 months or longer." Phreesia's annual report says that for healthcare services clients sales cycles typically range from three to twelve months, and up to 18 months for financing contracts with large health systems. It adds that Network Solutions sales cycles align with annual life sciences marketing budget cycles, with contracts typically negotiated during the fourth quarter of the calendar year.

Contract shape is part of the playbook too. Phreesia says most of its healthcare services customer contracts are annual, auto-renewing agreements, while most Network Solutions campaigns have a term of one year and must be resold each year.

Judgment: build pipeline and cash plans around those windows rather than a typical software quarter, and tie any marketing-budget-driven product to the buyer's budget calendar. These are the vendors' own descriptions of their sales; your cycle will differ by buyer size and product.

Win a reference, then expand the account

Veeva says it relies on "reference selling," meaning recommendations from key customers to promote its solutions to potential customers. Phreesia says its go-to-market strategy focuses on maximizing total customer enterprise value through an integrated sales and customer success model, with incentives aligned to overall customer value rather than individual product commissions, supporting land-and-expand growth.

Integration matters to the land. Phreesia says its platform integrates with most major electronic medical record and practice management systems. Doximity's release says new partnerships with Aledade and Photon bring its Clinical AI Suite to thousands of independent practices, an example of reaching small practices through a partner. Doximity's sales and marketing expense was $163.6 million in fiscal 2026, up from $145.7 million.

Judgment: a first win in one department that a named reference will vouch for is a stronger land than a broad pilot. Then compensate the team on the whole account, which is the structure Phreesia describes.

Treat HIPAA as the entry ticket, and ask counsel early

Under 45 CFR 160.103, a business associate is a person who creates, receives, maintains, or transmits protected health information for a regulated function, and a subcontractor that does the same on behalf of a business associate is also covered. Under 45 CFR 164.502(e), a covered entity may disclose protected health information to a business associate if it obtains satisfactory assurance that the business associate will appropriately safeguard the information, and those assurances must be documented through a written contract or other written agreement.

The public vendors say it plainly. Phreesia's annual report says it is a business associate as defined under HIPAA, and Doximity's says the same for certain of its services. Veeva says that in certain cases it is regulated under HIPAA. Phreesia also lists HITRUST, PCI-DSS Level 1 Service Provider and SOC 2 as certifications it holds.

Judgment: expect the buyer's security review and contract paperwork to be part of the sales cycle, and have your answers, certifications and agreement terms ready before the first demo. Which certifications a given buyer wants is a question for that buyer.

Use the 2027 interoperability dates as a trigger

The CMS final rule fact sheet (CMS-0057-F, January 17, 2024) covers Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and Qualified Health Plan issuers on the Federally Facilitated Exchanges. It says payers must implement certain operational provisions generally beginning January 1, 2026, and the API requirements generally beginning January 1, 2027, with the Prior Authorization API required beginning January 1, 2027.

It names four APIs: Patient Access, Provider Access, Payer-to-Payer and Prior Authorization. It also sets prior authorization decision timeframes of 72 hours for expedited requests and seven calendar days for standard requests, though QHP issuers on the Federally Facilitated Exchanges are excluded from the timeframe requirement.

Separately, the ASTP/ONC FAQ (last updated September 12, 2025) lists health care providers, health IT developers of certified health IT, and health information networks or exchanges as information blocking actors. Judgment: a date-driven deadline gives a vendor that sells to or integrates with payers a reason for the buyer to act this year. I did not find a public source on how many buyers will be ready, so I make no claim about that.

Know the concentration risk

Revenue concentration shows up in all three filings. Veeva says its top 10 customers accounted for 28% of total revenues in each of fiscal 2026, 2025 and 2024, and that nearly all of its revenues come from the life sciences industry. Doximity says one customer accounted for 10% or more of total revenue in fiscal 2026 and none did in the two prior years, while its revenue is relatively concentrated in a small number of key customers. Phreesia says it historically derives a significant portion of revenues from its largest clients. Phreesia also says payment processing fees generated 24% of its total revenue in each of fiscal 2026 and 2025.

Judgment: a vertical focus makes the playbook sharper and the revenue base narrower at the same time. Track the share of revenue from your largest accounts from the start, and plan a second product or buyer segment before one customer or one regulation sets your growth rate.

A working playbook in seven steps (judgment, not data)

• Name the buyer, the user and the payer. Write down who signs, who uses and who pays, and build a separate message for each, as the filings suggest.
• Plan the calendar. Build pipeline and cash forecasts around the 3 to 12 month and 12 month-plus cycles the public vendors describe, and around annual contracts.
• Start with one department and a reference. A named reference is worth more than a broad pilot, and reference selling is a stated Veeva practice.
• Be integration-ready. Support the electronic record and practice management systems your buyers already run.
• Prepare the compliance packet. Business associate terms, security answers and certifications ready before the first demo; have counsel review.
• Compensate on the whole account. Align incentives to total customer value, which is the structure Phreesia describes.
• Watch concentration. Report the share of revenue from your top accounts every quarter.

Questions people ask

Sources

• Veeva Systems: fiscal 2026 results release (March 4, 2026) · Revenue, growth, customer counts
• Veeva Systems: Form 10-K, fiscal year ended January 31, 2026 · Sales organization, 12-month cycle, top 10 customers 28%, reference selling, HIPAA
• Doximity: fiscal 2026 results release (May 13, 2026) · Revenue, members, prescribers, sales and marketing expense, partnerships
• Doximity: Form 10-K, fiscal year ended March 31, 2026 · Customer mix, concentration, business associate statement
• Phreesia: Form 10-K, fiscal year ended January 31, 2026 · Sales cycles, contract terms, incentives, integrations, certifications, HIPAA, concentration
• CMS: Interoperability and Prior Authorization final rule fact sheet (CMS-0057-F) · Impacted payers, 2026 and 2027 dates, four APIs, decision timeframes
• 45 CFR 160.103 (Cornell Legal Information Institute) · Business associate definition
• 45 CFR 164.502 (Cornell Legal Information Institute) · Written contract for business associates
• ASTP/ONC: information blocking FAQ (last updated September 12, 2025) · Who counts as an information blocking actor
• Hero photo: Telemedicine Consult by Intel Free Press, CC BY-SA 2.0, via Wikimedia Commons (cropped, on-screen text and patient video blurred) · Cardiologist at a hospital telemedicine workstation, Sonora, Mexico, 2011

Figures were read from the linked pages in November 2026. Company figures come from each company's own releases and annual reports. This is not legal or financial advice; consult counsel on HIPAA and your own advisers on strategy.

Top photo: Intel Free Press / CC BY-SA 2.0 via Wikimedia Commons