Healthcare's Biggest Financial Leak Is Hiding in Purchased Services

Ask a chief financial officer where margin is going and the answer usually involves labor costs, denials, or payer mix. Ask a chief supply chain officer the same question and supplies come up first. Almost nobody leads with purchased services. That is exactly why it remains the leak nobody has closed.

Purchased services is the catch-all category covering everything from biomedical equipment maintenance and environmental services to locum tenens staffing, courier contracts, and IT support. It is one of the largest cost blocks in a hospital. Vizient estimates that indirect expenses, the non-clinical goods and services required to run a hospital, account for nearly a quarter of total healthcare spending.[1] Premier's analysis of more than $49 billion in purchased services spend across 102 healthcare organizations found that purchased services made up 34.8 percent of non-direct-labor spend between January 2020 and July 2021, which put the industry total over $200 billion a year on third-party vendor services even then.[2]

The difference between purchased services and supplies is not size. It is infrastructure. Healthcare's biggest financial leak is not hiding because it is small. It is hiding because the control mechanisms that would expose it was never built for this category.

A Category Too Large for Its Controls

The financial backdrop makes the gap harder to excuse. The American Hospital Association reported that total hospital expenses grew 7.5 percent in 2025, more than twice the growth rate of hospital prices.[3] Kaufman Hall describes hospital performance settling into a fragile new normal, with a persistent gap between gross and net operating revenue driven by an eroding payer mix.[4] In that environment, every non-employee related dollar is supposed to be under scrutiny.

A med-surg item carries a SKU, lives in an item master, flows through an EDI purchase order, and gets matched against receiving data before payment. Purchased services follow a different path entirely. Invoices arrive as PDFs written in service-specific language, coded against cost center budgets instead of line item prices, and reviewed, if reviewed at all, by whichever department requested the service. Note that nowhere in that process is the invoice compared to the contracted rates prior to payment.

The exposure is also broad. According to Vizient, more than 90 percent of health systems and hospitals outsource between one and ten services per department.[1] Every one of those relationships produces recurring invoices governed by a contract that AP almost never sees.

Why Supplies Got Infrastructure and Services Did Not

Supply chain teams have spent three decades building control infrastructure around tangible goods: item masters, GPO tiers, contract management systems, and three-way matching against purchase orders and receiving documents. That investment paid off, and it is why supply spend is the best-governed non-labor category in most health systems.

None of that infrastructure was designed for a category where the thing being purchased is a technician's hourly rate, a percentage-of-uptime service level, or a tiered staffing rate that changes by shift and credentials. There is no SKU for an emergency generator inspection. There is no receiving dock or box to scan into an inventory management system for a courier delivery.

Vizient's own assessment of indirect spend points to the structural consequences: contracts negotiated in silos without visibility into existing agreements, departments buying outside the system's purchasing process, and agreements that renew once every three to five years, which makes dedicated category expertise hard to justify and easy to lose.[1] Because purchased services are managed department by department rather than through a unified procurement function, pricing drift goes unnoticed until budgets are blown and someone (typically a paid consultant) compares invoiced amounts to the actual contract and realizes  rates have crept up. The result is a familiar pattern: negotiated savings that never reached the bottom line.

The Quiet Mechanics of the Leak

What makes purchased services dangerous is not the size of any single invoice. It is the volume of small, individually unremarkable line items that never get scrutinized because no one invoice looks worth the fight.

Consider a few illustrative situations that any purchased services leader will recognize. A biomedical maintenance agreement is amended mid-term, but the vendor's billing system keeps the old rate. A locum tenens invoice applies the night or weekend rate to weekday shifts across three facilities. An environmental services contract prices each site differently, and the highest site rate quietly becomes the default. A software vendor bills the list price on seats the enterprise agreement already covers. Each error is modest. All of them recur monthly until someone stops them.

SpendRule's initial deployment data shows how structural this is: rate drift and catalog mismatch account for roughly 70 percent of verifiable overcharges across vendor types and health system sizes.[5] The same data illustrates why manual review cannot absorb the problem. A single multi-facility services invoice with eight line items, prorated billing periods, and amendment credits takes a trained AP analyst 20 to 30 minutes to validate, and a large health system processes more than 200,000 purchased services invoices each month.[5]

Run the Math Your Supply Chain Already Ran

The economics of contract discipline are not speculative; the supply side proved them. The Healthcare Supply Chain Association cites research finding that GPO contracting reduces supply-related purchasing costs by 13.1 percent on average when purchases actually run through negotiated contracts.[6]

Purchased services rarely receive equivalent discipline. As an illustration only: a health system spending $500 million a year on purchased services that brought the category under the same level of contract enforcement as supplies would be targeting an annualized savings opportunity of roughly $65 million. That figure is directional, not a promise; the benchmark was measured on supply purchasing, and results vary with contract coverage and baseline discipline. But the order of magnitude explains why the category deserves the same rigor.

Now compare the back end. SpendMend reports that a healthcare recovery audit typically returns about $1 million to the bottom line for every $1 billion of annual spend at the industry average, with top-performing audits reaching $1.4 million.[7] That is roughly $0.14 for every dollar of overcharge, recovered after the fact. The distance between those two numbers, what enforcement could protect versus what recovery claws back, is the cost of treating purchased services as an audit problem instead of a control problem.

Why “We Will Catch It on the Back End” Falls Short

The audit instinct is understandable, and recovery audits do recover real dollars. They remain useful as a periodic check and as a way to surface control gaps.[7]

But audits are inherently backward-looking. They find money that has already left the building and try to get some portion of it back, usually quarters or years later, and for a hefty contingency fee. Purchased services leakage is not a one-time event an organization can audit its way out of. It’s a structural gap between what was negotiated and what gets paid, recurring invoice after invoice, vendor after vendor, for as long as nobody validates payment against contract terms at the moment it happens.

The Question That Reveals the Gap

The Question That Reveals the Gap

The first diagnostic question is not how much the organization spends on purchased services. Most systems can answer that. The question that matters is this: how much of that spend is validated against the actual contracted rate before payment?

For most organizations, the honest answer is close to zero. Purchased services contracts live in a CLM system, a shared drive, or someone's inbox. Invoices live in AP. The two rarely talk to each other, and nothing in the existing tech stack is built to make them. We described this contract-to-payment gap in our work on spend entropy; purchased services is the category where it does the most damage.[5]

Framed correctly, this is a payment integrity issue, not a procurement compliance issue. The same discipline finance applies to duplicate payment detection should extend to rate validation on contracted services.

What Closing the Leak Requires

Getting purchased services under control is achievable, but it requires five things working together, in sequence.

1. Inventory every service contract. Agreements, exhibits, rate tables, and amendments need to exist in one governed source. An amendment that lives in an inbox is a rate error waiting to recur.

2. Resolve vendor identity. The name on the invoice, the name in the contract, and the name in the ERP vendor master are often three different strings for the same company. Until they reconcile, nothing downstream works.

3. Convert contract terms into computable rate logic. Tiered rates, shift differentials, location-specific pricing, and service levels have to become rules a system can evaluate, not prose a reviewer has to remember.

4. Validate invoice lines before payment. Every eligible line is checked against the governing terms and the expected charge is calculated, at a scale manual review cannot reach.

5. Route evidence-backed exceptions. A flagged variance should cite the exact clause and page behind the finding, so AP can hold payment and vendors can correct billing without a dispute cycle.

Notice what is absent from that list: another dashboard. Visibility tells you a problem exists. Control stops it from recurring on the next invoice.

Where SpendRule Fits

This is the gap SpendRule was built to close. SpendRule's mission is to eliminate billions in waste from health systems by bringing precision, transparency, and automation to the estimated $300+ billion spent annually on purchased services. In practice, that means a control layer that checks purchased services invoices against the contracts that govern them before payment goes out, and backs every exception with the specific contract language that supports it.

SpendRule does not replace the ERP, the CLM, or the AP team. It connects what they each hold - contracts, invoices, and vendor records, and enforces the terms the organization already negotiated.

The Leak Is Optional

Purchased services leakage differs from most margin pressure in one important way. A denial trend or a payer rate cut is partly outside the organization's control. Paying more than the contracted rate is not. It persists only as long as nobody checks.

If you have not sized your purchased services exposure with the same rigor you apply to supply spend, that is the place to start. The number is usually bigger than people expect, and unlike almost everything else compressing hospital margins right now, it is entirely yours to fix.

See what your purchased services spend looks like against contract

Give SpendRule 10 contracts and 10 invoices. We analyze them to show you real savings opportunities, all in under 10 minutes. Visit spendrule.com/10-10-10.

References

1. Vizient (Blaine Douglas). “Strategic Spend: As healthcare costs climb, focusing on non-clinical expenses is a strategic imperative.” August 26, 2025. https://www.vizient.com/insights/articles/as-healthcare-costs-climb-focusing-on-non-clinical-expenses-is-a-strategic-imperative

2. Premier, Inc. “Report: The Top 5 Areas of Purchased Services Spend, and How Providers Can Improve Margin.” September 22, 2021. Data cover January 2020 through July 2021. https://premierinc.com/newsroom/blog/report-the-top-5-areas-of-purchased-services-spend-and-how-providers-can-improve-margin

3. American Hospital Association. “Report: Hospitals face increased challenges and financial pressures as they care for patients” (Costs of Caring report). March 11, 2026. Data year 2025. https://www.aha.org/news/headline/2026-03-11-report-hospitals-face-increased-challenges-and-financial-pressures-they-care-patients

4. Kaufman Hall. “National Hospital Flash Report: December 2025 Data.” February 10, 2026. https://www.kaufmanhall.com/insights/research-report/national-hospital-flash-report-december-2025-data

5. SpendRule. “The Law of Spend Entropy: Why Business Expenditure Decays Without Active Control.” May 26, 2026. SpendRule internal deployment data. https://spendrule.com/blog/the-law-of-spend-entropy-why-business-expenditure-decays-without-active-control

6. Healthcare Supply Chain Association. “Supply Chain 101: How Group Purchasing Organizations (GPOs) Support America's Healthcare Providers,” 2025 Congressional Education Packet, citing Dobson DaVanzo & Associates, “A 2018 Update of Cost Savings and Marketplace Analysis of the Health Care Group Purchasing Industry” (April 2019). https://supplychainassociation.org/wp-content/uploads/2025/01/2025-Congressional-Education-Packet.pdf

7. SpendMend (Kylee Savage). “The Essential Role of Recovery Audits in Healthcare.” October 4, 2024. https://spendmend.com/the-essential-role-of-recovery-audits-in-healthcare/