Infrastructure transformation for a regulated healthtech platform.
How Covalent Health achieved 99.99% uptime and reduced incident response time by 93% through proactive infrastructure management.
- Client
- Covalent Health
- Sector
- HealthTech (HIPAA-compliant)
- Scale
- 350 employees · 2,000+ provider clients
- Engagement
- Digital Operations
For this platform, availability is the product.
Covalent Health operates a patient data platform serving more than 2,000 healthcare providers, with 350 employees behind it. In its industry, system availability is a regulatory obligation and a contractual requirement at once: downtime directly impacts patient care coordination and erodes provider trust.
Necsen was engaged to move the platform's infrastructure from a reactive support model to managed digital operations. The engagement ran in sequence — a full assessment of the cloud and on-premise estate, a transformation across observability, incident response, and security, and then the transition to a fully managed 24/7 operations model.
The result is best measured by what stopped happening: unplanned outages, slow acknowledgements, and the operational firefighting that had consumed an internal team.
A reactive model at a regulated scale.
Covalent's existing managed service provider took a reactive approach — responding to outages after they occurred rather than preventing them. For a growing company operating under HIPAA, that model produced a specific and compounding set of problems.
A reactive service model
The incumbent managed service provider responded to outages after they occurred rather than preventing them — incidents set the agenda, not operations.
Slow acknowledgement
Average incident response times exceeded 45 minutes, and some critical events took over two hours simply to be acknowledged.
Downtime as routine
The platform ran at 99.4% uptime — more than two hours of unplanned downtime each month, felt directly in patient care coordination.
Unaddressed vulnerabilities
Security vulnerabilities sat unremediated, a growing organizational risk for a platform operating under HIPAA obligations.
No documented recovery
There were no documented recovery procedures, which meant a serious failure would have been handled by improvisation.
A model outgrown
Leadership recognized that the infrastructure management model was no longer adequate for the company's scale and regulatory requirements.
From assessment to managed operations, in sequence.
The engagement was designed to give leadership confidence in their infrastructure without requiring internal operational overhead.
A full accounting of the estate
Necsen conducted a full infrastructure assessment across Covalent's cloud and on-premise environments, identifying monitoring gaps, security vulnerabilities, and operational risks.
Findings · Risk inventory · Priorities
The transformation, fixed in writing
The work was scoped around three pillars — observability, automated incident response, and security hardening — with defined deliverables and acceptance criteria agreed before it began.
Fixed scope · Three pillars · Acceptance criteria
Building the proactive layer
Observability was extended across all critical services, the most common failure scenarios were automated, and a structured security hardening program was aligned with HIPAA compliance requirements.
Observability · Automated response · Hardening program
The steady state
Covalent transitioned to a fully managed operations model: 24/7 coverage, proactive maintenance schedules, and regular disaster recovery validation, with no internal operational overhead required.
24/7 coverage · Maintenance schedules · DR validation
Three pillars and an operating model.
The transformation built the proactive layer; the managed operations model is what keeps it proactive.
Comprehensive observability
Full visibility across every critical service, closing the monitoring gaps the assessment identified so that degradation is seen before providers feel it.
Automated incident response
The most common failure scenarios are handled automatically, without waiting on a human to acknowledge and act.
Security hardening
A structured program aligned with HIPAA compliance requirements, working down the accumulated backlog of unaddressed vulnerabilities.
Managed operations model
24/7 coverage, proactive maintenance schedules, and regular disaster recovery validation — run by Necsen rather than an internal team.
Reliability became the default state.
The transformation replaced a model that reacted to failure with one that assumes it — monitors for it, automates around it, and rehearses recovery from it.
The reactive model
- Outages addressed after they occurred
- Critical events waiting on human acknowledgement
- Recovery procedures undocumented
- Security findings accumulating without remediation
- An internal team dedicated to firefighting
The managed model
- Monitoring across all critical services
- Common failure scenarios resolved automatically
- Disaster recovery validated on a regular schedule
- Hardening aligned with HIPAA compliance requirements
- Engineering focused entirely on product
The distinction matters most in a regulated business: an infrastructure posture that depends on individual heroics cannot be documented, audited, or promised to a provider. A managed model can.
Measured before, measured after.
Every figure below compares the six months following the transition against the reactive model it replaced.
Incident response times dropped from 45 minutes to under 3 minutes. Platform uptime improved from 99.4% to 99.99% — effectively eliminating unplanned downtime from Covalent's operations. In the six months following the transition, there were zero unplanned outages.
The shift from reactive to managed operations also delivered $420K in annual savings through infrastructure optimization, reduced incident-related costs, and the elimination of an internal team previously dedicated to firefighting.
Engineering reclaimed
Covalent's engineering team now focuses entirely on product development rather than operational concerns — the firefighting function no longer exists.
Compliance posture
Documented, regularly validated recovery procedures and a hardening program aligned with HIPAA requirements replaced open, unmeasured risk.
Provider confidence
Downtime no longer erodes provider trust; the improvement in reliability has been visible to the 2,000+ providers who depend on the platform.
Why the engagement worked.
Infrastructure transformations fail more often on engagement structure than on technology. Three structural choices held this one together.
Assessment before commitment
The engagement began with a full technical assessment, not a contract — the scope was built from findings, and the team that assessed the estate is the team that now operates it.
A fixed scope with defined pillars
Three pillars, defined deliverables, and acceptance criteria were agreed before the transformation began, giving leadership a measurable definition of done.
Operations as an ongoing discipline
Monitoring, proactive maintenance, and disaster recovery validation are the engagement's steady state, not an afterthought — reliability is maintained, not just achieved.
The difference has been night and day. We went from managing infrastructure crises to not thinking about infrastructure at all. Our engineering team is fully focused on product again, and our providers have noticed the improvement in reliability.
The practices behind this engagement.
Two of Necsen's service lines carried this work. Each page describes the practice in full.
Start with an assessment, not a contract.
Tell us about your infrastructure challenges. We assess your current state and provide a fixed-scope proposal within 48 hours. No commitment. No pitch deck. Just a technical conversation.