Vendor & Contract Disposition Matrix — ACME Health / Cumberland Valley Integration

The vendor twin of the Application Disposition Matrix. Twenty-one material agreements across both entities, each with its disposition, change-of-control status, Business Associate Agreement requirement, TSA dependency and synergy value. This document carries the program's fastest synergy source and its most immediate Day 1 legal exposure, which is an unusual combination and the reason it is governed as a decision record rather than a procurement schedule. Approved by the Integration Steering Committee on July 17, 2023, before closing.

Vendor consolidation is the fastest synergy on the program and the one a CFO watches first. Retiring a platform takes twelve months of migration; terminating a duplicate clearinghouse contract takes a review, a consent and a notice period. Vendor savings therefore land in months while the technical tracks are still writing plans — which matters enormously on a program whose largest synergy source is also its slowest. Early vendor capture is what keeps the synergy curve credible through Year 1.

Part I — Why This Is Not Routine Procurement

Change of Control — Mechanics and Leverage
Disposition Taxonomy

Part II — The Matrix

Contract Disposition Register
Synergy Reconciliation

Part III — The Three Exposures

The Three Termination Rights
Business Associate Agreements — the Day 1 Gate
Sequencing Vendor Exits Against System Migrations

1. Change of Control — Mechanics and Leverage

Consolidating vendors after a merger looks like ordinary category management and is not. Four things make it different, and each of them is a column in the register.

1.1 The clause

A change-of-control provision gives the counterparty rights that activate when ownership of its customer changes. Depending on drafting, those rights range from a notification requirement, through a consent right, to a right to terminate. Twelve of Cumberland Valley's material agreements carry such a provision. Three of the twelve confer a termination right.

1.2 Assignment, novation and consent

Mechanism	What it does	Consent required?
Assignment	Transfers the benefit of a contract. The original party remains liable for the obligations.	Often not, unless the contract restricts it
Novation	Replaces one party with another entirely, extinguishing the original party's obligations and creating them afresh in the new party.	Yes — always. It changes who the counterparty must look to for performance.
Operation of law	In a statutory merger, contracts of the merging entity may pass to the survivor automatically, subject to the contract's own terms.	Depends on the clause — which is why the sweep reads them individually

The distinction is not academic and it decides whether Day 1 works. An assignment that leaves Cumberland Valley liable for obligations after Cumberland Valley has ceased to exist is not a functioning arrangement. A novation that has not obtained consent is not a novation. And a contract that passes by operation of law but whose change-of-control clause gives the vendor a termination right has passed to you along with the vendor's ability to walk away from it.

1.3 The leverage problem

A vendor that knows an acquisition is underway has a negotiating opportunity it did not have last month, and the vendor you are about to terminate has the most leverage of all. That is the counterintuitive part. A vendor being consolidated away might be expected to have none — but if you need their service through a twelve-month migration, their consent to novate is worth exactly as much as the disruption of not having it. Leverage during the transition period is inversely related to how long you still need them, not to how long the relationship will last. This is why the contract sweep began in March, months before it was needed: the consent you negotiate calmly in April costs materially less than the one you negotiate in September because Day 1 depends on it.

1.4 The BAA problem

Every vendor handling protected health information must have a Business Associate Agreement with the covered entity. At closing, the covered entity changes. Existing BAAs naming Cumberland Valley do not automatically cover ACME Health, and a vendor processing PHI for an entity it has no agreement with is a privacy exposure from the first business day. Section 6 treats this as a gate rather than a task.

2. Disposition Taxonomy

Disposition	Meaning	Typical trigger
Consolidate	Volume moves to one agreement; the duplicate is terminated at its notice date.	Both entities buy the same service. The synergy case.
Retain	Agreement continues, transferred to the surviving entity. No commercial change.	Regulatory requirement, or the service has no duplicate.
Renegotiate	Vendor kept, terms repriced on combined volume.	Single supplier whose pricing tiers respond to scale.
Terminate	Agreement ends. No successor needed, or the successor is already in place.	The function ceases, or the surviving system displaces it.
New	A new agreement for the combined entity.	Capability neither party had.

3. Contract Disposition Register

CoC = change-of-control provision present. TR = confers a termination right. BAA = handles protected health information. TSA = a Transition Services Agreement depends on this vendor.

Ref	Agreement	Disposition	CoC	TR	BAA	TSA	Synergy	Note
VC-01	Pharmacy benefit management	Consolidate	Y	—	Y	Y	$5,200,000	Largest single vendor synergy. Consent obtained; migration timed to a plan-year boundary.
VC-02	Clearinghouse (target)	Consolidate	Y	Y	Y	Y	$1,800,000	⚠ Termination right. Critical path — see §5.1.
VC-03	Print, mail & member communications	Consolidate	Y	—	Y	Y	$2,400,000	Cannot terminate before ID card reissue completes.
VC-04	Care management platform (target)	Renegotiate	Y	—	Y	—	—	⭐ This is the survivor per AD-07. Repriced upward for 2,220,000 members; the saving is on the other row.
VC-05	Care management platform (ACME)	Terminate	—	—	Y	—	$1,600,000	⭐ The acquirer's own tool retires. Unusual, and it follows directly from the disposition decision.
VC-06	Provider network rental / wrap network	Consolidate	Y	Y	—	—	$2,100,000	⚠ Termination right — see §5.2. Affects member out-of-area access.
VC-07	Fraud, waste & abuse analytics	Consolidate	Y	—	Y	—	$1,100,000	Consolidation improves model performance on the larger claim history.
VC-08	Actuarial consulting	Consolidate	—	—	—	—	$900,000	Single methodology required for combined statutory filing.
VC-09	External audit	Consolidate	—	—	—	—	$700,000	One audited entity, one auditor. Transitions at fiscal year end.
VC-10	Telehealth	Consolidate	Y	—	Y	—	$800,000	Member-facing; sequenced to avoid a benefit change mid-plan-year.
VC-11	Member ID card production	Consolidate	—	—	Y	Y	$600,000	Consolidates only after the Day 1 reissue is complete.
VC-12	Benefits administration (employee)	Consolidate	Y	—	Y	Y	$500,000	Constrained by the employee continuation period in the merger agreement.
VC-13	Language services / translation	Consolidate	—	—	Y	—	$300,000	Small, and a regulatory access requirement — consolidated, never dropped.
VC-14	Data center colocation (target)	Terminate	Y	—	—	Y	—	Terminates at lease expiry after the final migration wave. Saving sits in the facilities source.
VC-15	Core administration platform vendor (target)	Terminate	Y	Y	Y	Y	—	⚠ Termination right, and we need them throughout — see §5.3. Saving sits in the platform source.
VC-16	Utilization management clinical criteria	Retain both	Y	—	—	—	—	Follows the best-of-both disposition at AD-08. Decision deferred with a date.
VC-17	Payroll processing (target)	Terminate	—	—	—	Y	—	Ends at HRIS migration. Saving sits in the corporate function source.
VC-18	Quality / HEDIS certified vendor	Retain	Y	—	Y	Y	—	Retained to measurement year end. A certified vendor cannot be switched mid-year without invalidating the rates.
VC-19	Appeals external review organization	Retain	—	—	Y	Y	—	Independence is a regulatory requirement. Not a consolidation candidate at any price.
VC-20	Microsoft Azure enterprise agreement	New	—	—	Y	—	—	⚠ Existing agreement expanded. BAA scope must be confirmed for the enlarged member population.
VC-21	Rutherford Cloud Operations — co-managed cloud operations	New	—	—	Y	—	—	⚠ New capability neither party had. Holds administrative access to systems processing PHI, so a BAA is required. ⭐ Contract must carry the step-down schedule and transition-out terms as exhibits — a co-managed arrangement without a contracted step-down becomes fully managed by default, and ACME would have exited a TSA dependency into an unplanned vendor dependency.

Three rows carry no synergy and are here anyway, which is the point of a register rather than a savings list. VC-18 and VC-19 are retained because a regulator requires them; VC-16 is deferred because the underlying application decision is. A vendor matrix built only from consolidation candidates would omit exactly the agreements most likely to cause a Day 1 problem — the ones nobody is planning to touch, and therefore nobody is checking.

4. Synergy Reconciliation

Source	Run-rate	Lands
Pharmacy benefit management	$5,200,000	Plan-year boundary
Print, mail & member comms	$2,400,000	After ID card reissue
Provider network rental	$2,100,000	At renewal
Clearinghouse	$1,800,000	After core admin migration
Care management tooling	$1,600,000	On ACME tool retirement
Fraud, waste & abuse analytics	$1,100,000	Year 1
Actuarial consulting	$900,000	Year 1
Telehealth	$800,000	Plan-year boundary
External audit	$700,000	Fiscal year end
Member ID card production	$600,000	Post Day 100
Benefits administration	$500,000	After continuation period
Language services	$300,000	Year 1
Vendor & contract consolidation	$18,000,000	Reconciles to the Deal Summary source

This table ties exactly to the vendor line in the Deal Summary, and that is deliberate rather than tidy. A synergy source stated at $18,000,000 in one document and decomposed to something else in another is the single most common way integration reporting loses credibility — because the first person to add up the detail is usually the CFO. The decomposition and the source figure are held in the same place and asserted to agree.

5. The Three Termination Rights

Of the twelve change-of-control provisions, three confer a right to terminate. Each is tracked individually, with an owner and a resolution date, because a single unresolved one is a Day 1 failure rather than a commercial inconvenience.

5.1 VC-02 Clearinghouse — the one that would stop claims

The target's clearinghouse routes its X12 claim and remittance traffic. If the vendor exercised its termination right at closing, the target's providers would lose electronic claim submission on the first business day of the combined entity.

Resolution: consent negotiated in advance, with a committed run-out period extending past the core administration migration. The commercial term was worse than the one we would have obtained without an acquisition in progress, and it was accepted knowingly. Paying a premium for certainty on the one contract that can stop claims from being submitted is not a negotiation failure — it is the correct use of the Charter's constraint priority order, spending rank 4 to protect rank 2.

5.2 VC-06 Provider network rental — the one that changes member access

A rented wrap network provides out-of-area coverage. Termination would not stop operations, but it would narrow the network a member can use, which is a benefit change and therefore a filing and notification matter as well as a service one.

Resolution: consent obtained conditional on a volume commitment through the current term. Consolidation to ACME's arrangement proceeds at renewal rather than at closing — slower than the synergy model assumed, and the timing is reflected in the realization curve rather than hidden in it.

5.3 VC-15 Core administration vendor — the one being terminated anyway

This is the row that teaches the leverage lesson, because the intuition is backwards. This vendor's product is being retired; the relationship ends at migration regardless. It would be reasonable to assume they have no leverage at all. In fact they hold the most, because the program depends on them continuously for the entire twelve months between closing and cutover — support, environment access, extract assistance, defect response during parallel running. A termination right exercised at closing would leave the program migrating away from a platform whose vendor has stopped answering.

Resolution: a run-out and migration support agreement executed before closing, priced above the standing rate, specifying support levels, environment availability and named technical contacts through cutover. In effect the program paid for an orderly exit rather than assuming one.

The general rule worth carrying out of this section: leverage during a transition is set by how long you still need someone, not by how long the relationship will last. The vendor you are keeping for a decade will negotiate reasonably because they want the decade. The vendor you are leaving in twelve months has exactly twelve months of leverage and no reason at all to preserve goodwill. Sweep those contracts first.

6. Business Associate Agreements — the Day 1 Gate

Fifteen of the twenty-one agreements involve protected health information and therefore require a Business Associate Agreement with the surviving entity — and a sixteenth is required with Cheatham Mutual Holdings, the divesting parent, which continues to host the target’s systems under the TSA. Every one must be executed before the entity changes. Each is tracked individually in the BAA Register.

This is clerical work with a catastrophic failure mode, and it is treated as a gate condition for exactly that reason. Each BAA is a document, a signature and a tracking row — there is no analysis, no negotiation of substance, and no technical difficulty. Miss one, and on the first business day a vendor is processing member health information for a covered entity it has no agreement with. That is a reportable privacy exposure discovered by an auditor rather than by you, and no amount of good integration work anywhere else offsets it. The only defensible position is that all sixteen are complete before closing, evidenced, and checked by someone other than the person who did them.

Control	Implementation
Register	All sixteen tracked individually with vendor, executing party, date and countersignature
Owner	L. Braithwaite, Chief Privacy Officer — not Procurement, because the exposure is a privacy one
Independent check	Reconciled against the PHI vendor inventory by a second reviewer before Day 1 go/no-go
Gate	Day 1 Go/No-Go criterion. Not a Day 100 item, and not waivable.
⚠ Scope confirmation	Existing BAAs are checked for scope, not merely existence — an agreement written for 420,000 members and one data center may not cover the combined population or a new cloud region.

The last row is the one that looks finished and is not. ACME's own Azure BAA already existed, so the platform relationship appeared settled. But a BAA is scoped to the protected health information it covers, and the combined entity's population is materially larger than the one contemplated when it was signed. An inherited agreement that exists is not the same as an inherited agreement that covers what you are about to do with it.

7. Sequencing Vendor Exits Against System Migrations

Every termination in the register is dated by a dependency rather than by a notice period. Terminating on the earliest commercially available date is how a program books a saving in month three and creates an outage in month four.

Vendor exit	Cannot happen until	Consequence of getting it wrong
VC-02 Clearinghouse	Core administration migration complete and trading partners re-registered	Providers lose electronic claim submission
VC-03 Print & mail	ID card reissue complete	Members without cards at the point of care
VC-11 ID card production	After Day 100	A second card reissue — the most visible possible integration defect
VC-14 Data center	Final migration wave complete	Workloads with nowhere to run
VC-15 Core admin vendor	Platform cutover and parallel run complete	Migrating from a platform with no vendor support
VC-17 Payroll	HRIS migration complete and one full cycle run in parallel	People do not get paid
VC-18 HEDIS vendor	Measurement year closed and submitted	Quality rates invalidated for the year

Read the consequence column as a single argument: every one of these is a Day 1 or Day 100 failure, and every one is caused by acting early rather than late. That is an unusual risk profile and it is specific to the vendor workstream. Everywhere else on this program, the danger is being slow. Here, the danger is that vendor consolidation is the fastest synergy available and therefore attracts pressure to accelerate — from people reading a synergy dashboard rather than a dependency map. A vendor exit date is an output of the migration plan, not an input to it.

Table of Contents

1. Change of Control — Mechanics and Leverage

1.1 The clause

1.2 Assignment, novation and consent

1.3 The leverage problem

1.4 The BAA problem

2. Disposition Taxonomy

3. Contract Disposition Register

4. Synergy Reconciliation

5. The Three Termination Rights

5.1 VC-02 Clearinghouse — the one that would stop claims

5.2 VC-06 Provider network rental — the one that changes member access

5.3 VC-15 Core administration vendor — the one being terminated anyway

6. Business Associate Agreements — the Day 1 Gate

7. Sequencing Vendor Exits Against System Migrations