The clinical due diligence was thorough. Payer mix, coding patterns, provider productivity, malpractice history, lease terms. Somebody read every one of those.
Nobody opened the server closet.
Practice acquisitions are one of the few transactions where the buyer takes on an entire second technology estate and often does not look at it until after close. The result is predictable: two EHRs that will not talk to each other, a billing service nobody has a contract for, a former office manager who still has administrative access, and a risk analysis that was last done by a consultant in 2019.
What you actually inherited
The record system and everything welded to it. The acquired practice has an EHR, and it has a decade of records inside it that you are legally required to retain. Migration is expensive; running it in parallel is expensive; archiving it read-only has licensing implications the vendor will explain only after you have signed. All three options cost money, and the cheapest one is still not free.
Contracts you did not negotiate. Clearinghouse, transcription, billing service, imaging, answering service, phone system. Each has a term, an auto-renewal, and a termination clause. Several have data in them that belongs to you now.
Business associate agreements, or the absence of them. Every vendor touching protected health information needs one. Small practices routinely have vendors with no agreement on file. After close, that gap is yours.
Accounts belonging to people who no longer work there. Departures at small practices are handled by taking back a badge. Logins survive. So do the ones belonging to the vendor who set the system up, the accountant, and the son-in-law who built the website.
Whatever the risk analysis would have found. If one exists at all, it likely predates the systems currently in use.
The first ninety days that matter
Order matters here, because the exposure is not evenly distributed.
Start with access. Every account, every system, every person, and specifically every account that belongs to somebody who has left or to an outside party. This costs nothing and closes the fastest-moving risk.
Then the contract inventory. What exists, what it costs, when it renews, who signed it, and whether a business associate agreement accompanies it. Renewal dates are the leverage points and they arrive whether or not you are ready.
Then the records decision. Not the migration itself, which takes as long as it takes, but the decision about what happens to the historical record and what it will cost. That decision drives the budget for the following year.
Then a single risk analysis that covers the combined organisation, not two documents describing two practices that no longer exist separately.
Why this is worth doing properly
Roll-ups compound their technology problems faster than they compound their revenue. Three practices with three EHRs and three vendor stacks is not a platform, it is three practices with shared ownership. The organisations that get real leverage out of acquisitions are the ones that decide, early and deliberately, what the target state looks like and hold each acquisition to it.
That decision is easier to make before the third acquisition than after the sixth.