Expense Management for Healthcare Organizations 2026

Why healthcare expense management is a different problem entirely

Concur

Expensify

Ramp

Most finance teams in healthcare inherit a generic expense tool, sign a Business Associate Agreement (BAA), and call it a day. That decision creates three parallel compliance problems that no amount of policy memos will fix: Sunshine Act reporting done in a spreadsheet, CME allowances tracked by hand, and multi-facility cost center splits that require a second approval workflow outside the system. The BAA is necessary. It is not sufficient.

Healthcare organizations face expense compliance rules that do not exist in any other industry. The Physician Payments Sunshine Act, enacted under the ACA and administered by CMS through its Open Payments database, requires pharmaceutical and medical device companies to report every meal, speaking fee, consulting payment, and gift given to a licensed physician or teaching hospital. The reporting threshold is $13.82 per instance and $138.13 in annual aggregate per recipient. Miss the March 31 CMS submission deadline and penalties start at $1,000 per unreported payment, scaling to $10,000 for knowing failures.

Then there is the CME problem. Continuing Medical Education reimbursement looks like ordinary travel and conference expense on the surface. Underneath, it is structurally different: physicians have individual annual CME budgets that must not be double-counted against departmental T&E, hotels and registration fees are often direct-booked by the physician rather than through corporate travel (roughly 45% of CME hotel bookings), and the documentation must satisfy state medical board requirements for license renewal, not just internal accounting. Generic expense software has no concept of any of this.

Finally, multi-facility health systems need expenses allocated simultaneously to a specific facility, department, service line, and payor type. A traveling nurse working three campuses in a week needs mileage reimbursed against the correct facility cost center. The CFO needs real-time budget versus actuals by service line for Medicare/Medicaid cost report preparation on CMS Form 2552. Standard two-level org hierarchies in most expense platforms break on contact with this reality.

The HIPAA and sunshine act compliance baseline every tool must clear

Before evaluating any software on features, get answers to three questions: Will the vendor sign a BAA before implementation begins? Does the platform maintain an immutable audit trail with a minimum six-year retention period? And does it support HCP (healthcare provider) recipient tagging with NPI number capture on individual expense line items?

The six-year retention requirement is not arbitrary. The HHS Office for Civil Rights saw a 264% increase in investigations following the 2024 ransomware wave against healthcare systems, and the 2025 HIPAA Security Rule updates explicitly require six-year retention of compliance documentation. If your expense platform purges records after three years for storage cost reasons, you have a gap before the first audit request arrives.

HCP tagging is where almost every generic tool fails completely. When a medical device sales rep takes a cardiologist to dinner, that expense must be tagged with the physician's NPI number, the dollar amount, the date, the location, and the business purpose. The data must roll up to an annual aggregate by recipient and export in a format that maps to CMS Open Payments submission fields. Concur's standard configuration has none of these fields. Expensify has none of them. If your sales reps are covering HCP entertainment and using standard expense software, you are almost certainly maintaining a parallel Excel tracker to prepare your CMS submission, which is exactly where unreported payments and compliance violations accumulate.

One specific risk worth flagging: staff sometimes type patient-identifiable information into expense description fields. A nurse writing 'supplies for patient room 412 diabetes case' has just created a PHI record inside your expense platform. Most platforms have no input validation that would catch or warn against this. Healthcare-specific deployments should either use custom field templates that remove free-text description fields or configure DLP (data loss prevention) rules that flag common PHI patterns before submission.

Tool-by-Tool breakdown: what each platform actually delivers

SAP Concur is the incumbent for large health systems with 500+ employees and existing SAP, Epic, or Workday infrastructure. BAA is available on enterprise contracts. The multi-entity org structure handles complex facility hierarchies. The integration library is unmatched. The problems: implementation takes four to nine months, requires dedicated IT resources, and licensing plus professional services typically runs $40,000 to $150,000 in year one for a mid-size health system. There is no native Sunshine Act HCP tagging module in standard Concur. Customers building CMS Open Payments exports use custom forms and PowerBI or a third-party connector. For a 2,000-employee hospital system with existing SAP infrastructure, Concur makes sense. For a 200-physician practice group, it is overkill by a wide margin.

Expensify is genuinely excellent at what it does: fast mobile receipt capture, simple reimbursement workflows, and a clean interface that clinical staff will actually use. For administrative T&E (office supplies, non-patient-facing staff travel, facility management expenses), it works well. The problems start when healthcare-specific requirements enter the picture. BAA negotiation is possible but not standard, and smaller organizations often struggle to get legal to prioritize it. There is no native Sunshine Act support. CME tracking requires jury-rigging custom tags in ways that break when annual budgets reset. Multi-facility allocation beyond two org levels requires workarounds. Pricing runs roughly $5 to $9 per active user per month, making it one of the more affordable options, but the compliance gaps mean it should not handle any workflow where HCP spend or PHI-adjacent data could appear.

Ramp has grown healthcare adoption quickly, driven by its real-time budget enforcement and automated receipt matching via corporate card. BAA is available. The spend controls are tighter than Expensify's, and the API is cleaner than Concur's for building custom compliance exports. There is no native Sunshine Act module, but development teams at pharma companies have built CMS Open Payments export pipelines against the Ramp API with less effort than the equivalent Concur project. Pricing starts around $0 for the core platform (revenue model is interchange on the card), with premium tiers for advanced controls. The limitation is that Ramp works best when you can migrate staff to Ramp corporate cards, which creates a change management challenge in facilities where purchasing is decentralized across department budgets.

AppZen is not a full expense platform. It is an AI audit layer that sits on top of Concur, SAP, or other ERP systems and specifically flags Sunshine Act compliance violations, duplicate receipts, policy violations, and fraudulent patterns before reimbursement is approved. For pharmaceutical and medical device companies that already have an expense platform but are losing sleep over CMS Open Payments accuracy, AppZen is the most direct solution. It reads existing expense data, identifies HCP-tagged transactions, checks aggregate spend against thresholds, and flags exceptions for human review. Pricing is not publicly listed and negotiated by contract size, but expect $8 to $15 per user per month on top of your existing platform cost. AppZen does not solve the underlying data quality problem if your reps are not tagging HCP recipients correctly at submission time. It catches errors; it does not prevent them.

Fyle is the strongest option for mid-market health systems and physician groups in the 50 to 500 employee range. BAA is available as standard. The credit card integration works with existing Visa and Mastercard business cards without requiring card migration. The custom field architecture is more flexible than Expensify's, which matters when you need to build CME budget tracking or department-level cost center allocation without native modules. Pricing runs approximately $6.99 to $11.99 per user per month. The honest limitation: Fyle does not have native Sunshine Act or CME modules. What it has is a flexible enough field configuration that a competent implementation partner can build compliant workflows, and a support team that will actually engage on healthcare-specific requirements rather than sending you to documentation. For organizations that cannot justify Concur's implementation cost but need more configurability than Expensify offers, Fyle is the practical choice.

What generic tools miss: the three workflows that always fall apart

Sunshine Act HCP spend tracking is the most dangerous gap. The compliance workflow requires that every entertainment expense involving a physician recipient be captured with NPI number, recipient name, dollar amount, date, location, and business purpose, then aggregated annually per recipient and submitted to CMS by March 31. Generic tools have no recipient tagging at the line item level. Organizations work around this by training reps to add structured text in description fields ('HCP: Dr. Jane Smith, NPI: 1234567890, Dinner, $47.50'), then manually parsing those descriptions before submission. This works until one rep uses a different format, one description field gets truncated, or one transaction gets approved without the HCP tag. The CMS submission then has a gap, and the organization either files an amended report or takes the penalty. This is not a hypothetical. CMS Open Payments has identified reporting failures at dozens of major pharma companies, with aggregate penalties exceeding $50 million since the program launched.

CME reimbursement tracking fails because generic tools have no concept of individual physician CME budgets. When a cardiologist attends a conference and submits a $2,200 hotel bill plus $850 registration fee, the expense platform needs to verify that this spend does not exceed the physician's annual CME allowance, that it does not double-count against the department's T&E budget, and that the documentation includes the accreditation body, credit hours earned, and activity type (which the state medical board requires for license renewal). Standard expense platforms just see a hotel charge and a registration fee. Finance teams reconcile CME manually against a spreadsheet that someone updates once a quarter, which means physicians routinely exceed their CME budgets without knowing until year-end.

Multi-facility cost center allocation hits the structural limits of standard two-level org hierarchies. A large health system might need an expense allocated to: facility (Memorial North), department (Cardiology), service line (Cardiac Surgery), payor type (Medicare), and cost center (CC-4412). That is five simultaneous dimensions. Most expense platforms allow two or three custom fields that can approximate this, but approval routing, budget enforcement, and reporting all break when the allocation requires more than two levels. The result is that cost center allocation happens offline, in the ERP after import, by someone manually splitting transactions. That person is usually a staff accountant doing this for hundreds of transactions per month.

Red flags to watch for during vendor evaluation

The BAA is offered only on enterprise tiers or after legal negotiation. This signals that the vendor has not designed HIPAA compliance into the product architecture. A BAA is a contractual commitment that the vendor will protect PHI and notify you of breaches. If they treat it as a negotiating point rather than a standard offering, the underlying data handling practices may not support healthcare use cases regardless of what the contract says.

The vendor cannot explain what happens to PHI if an employee accidentally enters it into a free-text field. This question exposes whether the platform has any input validation, DLP integration capability, or audit trail for field-level access. 'We recommend training users not to enter PHI' is not an answer. Healthcare deployments need either field-level access controls, automated PHI detection, or both.

The implementation team has no healthcare references. Configuring expense software for healthcare requires understanding of cost center hierarchy design for CMS cost reports, CME allowance structures, and Sunshine Act reporting timelines. A vendor whose implementation team's closest reference is a regional law firm is going to learn on your organization's dime. Ask specifically for references at health systems of similar size and complexity, and call them.

The pricing model charges per submitted expense report rather than per active user. This creates a perverse incentive for clinical staff to batch expenses and submit infrequently, which means managers are approving 30-day-old receipts with faded thermal paper and no context. Healthcare staff already resist administrative tasks. A pricing model that punishes frequent submission makes the adoption problem worse.

The vendor claims 'full HIPAA compliance' without specifying which safeguards. HIPAA compliance is not a certification. It is a set of administrative, physical, and technical safeguards that must be implemented and documented. A vendor claiming compliance without being able to specify encryption standards (AES-256 at rest, TLS 1.2+ in transit), access control architecture, and breach notification procedures is using 'HIPAA compliant' as a marketing term rather than a technical description.

Recommendations by organization type

Large health systems (1,000+ employees, multiple facilities, Epic or Workday integration): SAP Concur is the practical choice despite its cost and complexity. The multi-entity org structure, ERP integration library, and enterprise BAA availability make it the only platform that can handle the full scope of requirements without major custom development. Budget $60,000 to $120,000 for year-one implementation including professional services. Add AppZen if your organization has significant pharma or device manufacturer relationships and HCP entertainment spend, since Concur's native Sunshine Act support requires custom configuration that AppZen handles more reliably.

Mid-size hospitals and regional health systems (200 to 1,000 employees): Fyle is the strongest current option at this tier. The BAA is standard, the custom field architecture can support multi-facility cost center allocation with proper implementation, and the per-user pricing is predictable. Expect a 60 to 90 day implementation. You will need to build CME budget tracking and any Sunshine Act workflows using custom fields rather than native modules, which requires either internal configuration effort or a partner who knows healthcare finance. Ramp is worth evaluating alongside Fyle if you can commit to centralized corporate card issuance.

Physician groups and small practices (under 200 employees): Expensify works for administrative T&E that has no PHI-adjacent risk and no Sunshine Act exposure. If your practice has employed physicians receiving CME benefits or any staff with HCP entertainment responsibility, Expensify's limitations will surface within the first year. Fyle at the lower user count is affordable enough to justify the additional capability. Either way, keep CME budget tracking in a dedicated HR or credentialing system rather than trying to bolt it onto an expense platform that was not designed for it.

Pharmaceutical and medical device manufacturers: Your expense platform choice matters less than your HCP tagging and CMS Open Payments reporting workflow. If your reps are on Concur, add AppZen as the compliance enforcement layer. If you are evaluating a platform change, Ramp's API makes building a custom Open Payments export pipeline more straightforward than Concur's. In either case, the most important investment is in training and field-level controls that prevent HCP transactions from being submitted without complete recipient data. Retroactively fixing Open Payments submissions after CMS flags them is significantly more expensive than preventing the gaps at submission time.

The one universal recommendation: do not let expense software selection be driven by IT procurement or general finance without healthcare compliance and legal at the table from the start. The BAA question, the audit trail requirements, and the Sunshine Act workflow design are not features to add after go-live. They need to be in the vendor evaluation criteria before the demo.

Outside the healthcare-specific compliance requirements above, our best expense management software roundup covers how these same platforms compare for general use.

Frequently asked questions

Does Expensify or Ramp sign a BAA for HIPAA compliance? Both offer a Business Associate Agreement, but availability differs by tier. Ramp's BAA is generally available; Expensify's BAA is possible to negotiate but is not standard, and smaller organizations often struggle to get it prioritized by legal. Ask for the BAA in writing before signing, not after implementation begins [vendor comparison sources, 2025].

Why doesn't Concur or Expensify handle Sunshine Act reporting out of the box? Neither platform has native recipient-level NPI tagging built into standard configuration. The Physician Payments Sunshine Act requires every meal, speaking fee, or gift to a licensed physician to be tracked with the recipient's NPI number, aggregated annually, and submitted to CMS Open Payments by March 31, with penalties starting at $1,000 per unreported payment. Pharma and device companies typically layer AppZen on top of Concur or build custom exports via Ramp's API to close this gap.

What does Fyle cost compared to Concur for a mid-size hospital? Fyle runs approximately $6.99 to $11.99 per user per month with a standard BAA included. SAP Concur's licensing plus professional services for a mid-size health system typically runs $40,000 to $150,000 in year one, with implementation stretching four to nine months, versus 60-90 days for Fyle [Fylehq, industry implementation estimates, 2025].

How long does HIPAA-related audit documentation need to be retained? A minimum of six years, per the 2025 HIPAA Security Rule updates. If your expense platform purges records after two or three years for storage-cost reasons, that is a real gap, confirm retention policy explicitly during vendor evaluation rather than assuming it matches other industries.

Is SAP Concur worth it for a 200-physician practice group? Usually not. Concur's advantages, deep SAP/Epic/Workday integration and enterprise BAA terms, mostly justify their cost at 1,000+ employee health systems with multiple facilities. For a 200-physician group, Fyle's lower implementation burden and standard BAA typically deliver comparable practical coverage at a fraction of the cost.

What is the single most common compliance mistake in healthcare expense management? Letting staff type patient-identifiable details into free-text expense description fields, for example noting a patient's room number or condition. Most platforms have no input validation to catch this, so it silently creates a PHI record inside a system that was never designed to store it. If your organization also has to satisfy grant restrictions and board-level fund reporting, see our expense management for nonprofits guide for that layer specifically.