Asato for healthcare

In a hospital, idle does not mean unneeded: some access and some equipment sit unused on purpose. For health systems, Asato finds the technology that is paid for and not used, takes out the people and systems the health system's own policy protects before it recommends anything, and puts a yearly price and an owner on what is left. A named person approves each fix before anything changes. One large US health system saved $4M a year at its Microsoft renewal this way, with clinically protected roles taken out before anything was recommended. Asato's fee is a share of the savings, and if it finds no savings, the customer pays nothing.

Headline on the visual page: "Savings without compromise on care." The sentence under it: "Find the technology nobody uses, and leave what your policy protects." The one action on the page is "Get your Asset Clarity Report", with the line "Guaranteed: no savings, no fee."

This page is about US health systems and hospitals. It says nothing about payers or life sciences.

When to use it

• A health system has to cut technology cost and cannot risk taking access from someone who needs it.
• A usage report shows seats, accounts and devices with no activity, and nobody can say which are unused and which are kept on purpose.
• A large software renewal is coming, and the count on the contract includes seats nobody signs in to.
• Support is paid on network hardware and nobody can say which devices are running.
• The team's count of applications, seats or devices does not match what the organization pays for.
• The health system wants each change approved by a person it names, with every action logged.

Not a fit

• Legal advice. This page describes one provision of the HIPAA Security Rule in plain words. It gives no legal advice, and it does not state that Asato makes an organization compliant with any rule.
• A decision made by software about clinical access. Asato recommends. The health system's policy sets what is protected, and a named person approves each fix.
• Negotiating with a vendor on the health system's behalf. Asato equips the buyer to negotiate, with the count and its evidence. Asato does not negotiate.
• Replacing an asset management suite, a CMDB, a service-management system or a contract repository. Asato works above the tools an organization already runs.
• Basic inventory tracking with no need to act on the result.
• A result for medical devices or clinical systems. The published results on this page cover Microsoft licensing, software, applications and network hardware. No result is published for medical devices or for clinical systems.

The problem: in a usage report, unused and protected look the same

Section heading on the visual page: "Idle is not unneeded." The line under it: "In a usage report, unused and protected look the same."

A usage report lists what has shown no activity. In most organizations that list is the waste. In a hospital it is two lists mixed together:

• Unused. Nobody needs it. Examples: the seat of someone who has left, a seat never assigned to anyone, a network device that was bought and never deployed.
• Protected. It is kept on purpose, and it is meant to sit idle until it is needed.

The report cannot tell the two apart. If a health system treats the whole list as waste, someone loses access they need. If it leaves the whole list alone, the unused part keeps renewing. So the step that matters in a hospital is taking out what is protected before anything is counted as a recommendation.

One rule shows why idle can be deliberate. The HIPAA Security Rule requires a covered entity to establish, and implement as needed, procedures for obtaining necessary electronic protected health information during an emergency. The provision is the emergency access procedure in 45 CFR 164.312(a)(2)(ii), and it is marked "Required". Source: the Electronic Code of Federal Regulations, https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312. Access kept for that purpose can sit unused by design. This is a plain description of the rule, not legal advice, and Asato does not state that any particular account is or is not required by it.

What is protected is each health system's own choice, set in its own policy. Asato publishes no fixed list of protected roles, accounts or systems. Elsewhere the site gives two examples of what a customer's policy can protect in software licensing: roles that need a higher tier whatever their usage, and shared accounts.

The frame: what is left is what you can stop paying for

Section heading on the visual page: "Three questions." The line under it: "What is left is what you can stop paying for."

The page is organized by one subtraction: what is left equals what is paid for, less what is in use, less what is protected. Each of the three terms is a question, and Asato answers all three from the customer's own records. What is left is what Asato recommends the customer stop paying for. Each item on it carries a yearly price and an owner, and it goes to a named person for approval.

1. What are you paying for? (paid for)
   • Link: identity records, asset lists, network logs and contracts are linked into one record, so each seat, device and application is counted once.
   • Think: each item carries its yearly cost and its owner, and each figure shows how it was worked out.
   • Execute: Asato keeps watching, so the record stays current between audits.
   • Carried on the page by a multi-site health system. Its figures are under "Measured results" below.
   • Goes deeper: Rationalize your portfolio.
2. What is in use? (in use)
   • Link: each seat is tied to its sign-ins, and each device to what the network has seen.
   • Think: each seat and device is sorted by use, and what is idle gets a yearly price and an owner.
   • Execute: once a named person approves, Asato opens the ticket or prepares the change to the contract.
   • Carried on the page by a different health system and its network hardware. Its figures are under "Measured results" below.
   • Goes deeper: Stop paying for idle hardware.
3. What must stay regardless? (protected)
   • Link: each seat and device is tied to the person or team that owns it.
   • Think: before anything is recommended, the people and systems the customer's policy protects are taken out.
   • Execute: a person the customer names approves each fix, or sets a policy that governs fixes of that kind. Asato then carries out the fix and logs it.
   • Carried on the page by the renewal the first screen tells, at a third health system. Here the page comes back to it by reference: it shows what was in use, what policy protected, how much of what was found was approved, and what was found and not approved. It repeats none of the first screen's dollar figures.
   • Goes deeper: Right-size Microsoft. The link under the question reads "How Asato right-sizes Microsoft".

The three steps under each question are the same three the platform runs everywhere. Link: the Asset Knowledge Graph links every asset, person, contract and cost into one record. Think: the Data Intelligence Engine turns the record into recommendations, each with a price and an owner. Execute: agents carry out the fixes a named person approves, and keep watching. The platform page has the detail.

Renewals and contracts are covered on Stay ahead of contracts. AI spend, including AI seats, is covered on Control AI spend.

Measured results

Each of the three results below is from a different health system. The health systems are described, not named. The visual page tells each result once: the renewal on the first screen, the multi-site health system under question 1 and the network hardware under question 2. Every saving carries its state: Found, Approved or Saved. Found is what Asato identified. Approved is what a named person signed off. Saved is what came off the bill. The three states are separate figures and are never added together, and figures from different health systems are never added together. A Saved figure is agreed jointly by the customer and Asato at the close of the engagement. A figure marked Measured describes scope or evidence and is not a saving.

• Large US health system, at its Microsoft renewal. 75,000 seats, about $40M a year. Measured: renewing unchanged would have raised the bill by about 8%. Every seat was scored on real usage. Found: one frontline license in four was dormant. Measured: the knowledge-worker tier was 93% utilized. Clinically protected roles were taken out before anything was recommended. Found: about $8M a year, weeks before the renewal. Approved: about $4M a year, before the renewal date. Saved: $4M a year, at the renewal. The health system negotiated its own renewal. About half of what Asato found was approved. Found and not approved: about 950 knowledge-worker seats held by job-code rules that grant the top tier regardless of usage, about $0.5M a year, where the open question for the health system's leadership is whether that policy is worth it; and about 5,600 frontline seats deferred under renewal time pressure. Case study: https://www.asato.ai/case-study-health-system-microsoft-renewal
• A multi-site health system. Measured: it had ten times more applications than its team had counted. Found: $1.9M of software waste, three weeks in. Saved: the customer has since saved all of that $1.9M. Approved: a further $1.4M of hardware waste is approved by the customer, and those savings have not yet been realized. The $1.9M and the $1.4M are different waste and are never added together. This health system has no case study page.
• Large US health system, network hardware. In a four-week engagement the customer matched about 940 network devices, bought since 2020, across purchase records, the CMDB and the live network. Found: 55% of those devices were paid for and not running. 45% were active in the system of record. Found: support was still billing about $466K a year on the hardware that was not running, with support modeled at about 18% of purchase price a year. Nothing is reported as Approved or Saved yet. The idle devices fell into two groups: recent orders that were bought and never deployed, and devices that were deployed, then retired from the floor but never from the contract. Case study: https://www.asato.ai/case-study-health-system-idle-hardware

One named healthcare customer speaks on the page. Jay Indrakumar, SVP and Head of Technology, WellStreet Urgent Care: "With Asato's platform, we have a real-time picture of our IT estate. We streamlined IT ops, using only what our teams need, improving our efficiency, all in weeks, not months." The quote stands by itself: the page ties it to none of the results above.

Example data on the page

One figure on the visual page shows example data, not a customer result: the figure under "Idle is not unneeded." It lists eight items that a usage report shows with no activity in 90 days.

• Five are unused: the seat of a nurse who left in March, a seat never assigned to anyone, an access switch still in its box, a router retired from the floor, and the seat of a contractor whose engagement ended.
• Three are kept on purpose: an emergency access account, the seat of a per diem nurse who is on call, and a downtime workstation.

In the example the three protected items are taken out first, and the five unused items are priced and sent to their owners. The three protected items are examples of what one health system might choose to protect. They are not a list Asato publishes and not Asato's policy.

Every other figure on the page shows a real customer result, and none of those is labeled an example.

Figures on the page, with their captions

Each figure on the visual page carries one caption. A caption takes no room on the page: it shows inside the figure when a reader points at it, or taps it on a touch screen. The captions are given here in full; on a narrow screen the page shows a shorter form of some of them. In a figure, a ring marks a Found figure, a dashed ring marks an Approved one, and solid green marks a Saved one.

The figures move. Each one builds up once when the reader reaches it and then rests on its complete state. No figure of a real result counts up from zero: its numbers are the true ones at every moment, and the motion is rows lighting, marks changing and bars growing. The first figure repeats: it lights the three terms in turn, then what was found, then what was saved, rests there, and starts again. Its pause control stops it on the complete figure. For a reader who has asked for reduced motion, every figure shows its complete state at once.

1. One health system's Microsoft renewal (first screen). One large US health system. The renewal as the subtraction: paid for, 75,000 seats, about $40M a year; less in use, every seat scored on real usage; less protected, clinically protected roles taken out first; what is left, about $8M a year Found and $4M a year Saved at the renewal. Caption: "Customer data, rounded. The bar is drawn against about $40M a year. The gray outline is the rise of about 8% if renewed unchanged, the green outline is Found and solid green is Saved. Found, Approved and Saved are separate figures and are never added together." The health system also approved about $4M a year before the renewal date; the first figure shows Found and Saved. This is the only place the page gives the renewal's dollar figures. Under the figure is the link "Read the case study".
2. One usage report, no activity in 90 days. Example data. Caption: "Eight items show no activity in 90 days. Three are kept on purpose and five are unused. What is protected is each health system's own choice, set in its policy: these rows are examples, not a list Asato publishes." The three tiles under the rows read: idle in the report, 8, one list; protected, 3, kept on purpose, reclaim them and someone is locked out; unused, 5, nobody needs them, leave them and they renew.
3. What a health system can stop paying for. Asato's method. The subtraction drawn in full, with one question under each term and the three platform steps below. Caption: "Each term is a question Asato answers from your own records. What is left goes to a named person, each item with a yearly price and an owner."
4. A multi-site health system (question 1). Caption: "Customer data, rounded. Each square is an application: its team had counted one for every ten it had. Solid green is Saved and the dashed ring is Approved. The two figures are different waste and are never added together. Saved figures are agreed jointly by the customer and Asato at the close of the engagement." The figure shows $1.9M Saved and $1.4M Approved.
5. A large US health system, about 940 network devices bought since 2020 (question 2). Caption: "Customer data, rounded, from a four-week engagement. Not the multi-site health system. Each dot is about 9 devices, and the green rings were paid for and not running. About $466K a year is Found: nothing is reported as Approved or Saved yet." The figure shows 55% Found and about $466K a year Found.
6. At the renewal that opens this page, policy decided what stayed (question 3). The renewal in the first figure, by reference: the figure repeats none of its dollar figures. Caption: "Customer data, rounded. Not either health system above. The ring marks a Found figure. Found, Approved and Saved are separate figures and are never added together. The health system negotiated its own renewal." The figure shows three lines: in use, every seat was scored on real usage and one frontline license in four was dormant; protected, clinically protected roles were taken out before anything was recommended; approved, about half of what Asato found was approved before the renewal date. Under them is one line on what was found and not approved: about 950 seats that job-code rules keep on the top tier regardless of usage, about $0.5M a year, where whether that policy is worth it is for the health system's leaders to decide. Under the question is the link "Read the case study".

Outside sources on the page

The page states two facts from outside Asato. Each is named and linked.

• The HIPAA Security Rule, 45 CFR 164.312. It requires procedures for obtaining necessary electronic protected health information during an emergency. Source: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312
• Microsoft's list prices. Microsoft announced that from July 1, 2026 the list prices of its frontline plans rose by 25% for Microsoft 365 F3 (from $8.00 to $10.00, in US dollars) and by 33% for Microsoft 365 F1 (from $2.25 to $3.00). The same update raised Microsoft 365 E3 by 8% and Microsoft 365 E5 by 5%. Microsoft states that existing customers remain on current pricing until renewal, and that nonprofit pricing is adjusted in line with commercial pricing. Source: Microsoft, "Microsoft 365 Pricing and Packaging Updates", https://www.microsoft.com/en-us/licensing/news/2026-m365-packaging-pricing-updates. This is Microsoft's own announcement about its price list. It is not a statement about the renewal of any Asato customer. The visual page gives the two frontline rises under question 3, writes the plans as F3 and F1, and links the announcement as "The pricing update".

The page cites no figure for how much technology spend is typically wasted, in healthcare or anywhere else.

Trust and governance

Section heading on the visual page: "Read-only by default." The line under it: "Write access where you grant it."

• What Asato reads. Metadata: records about technology, such as licenses, devices, usage, sign-in activity and costs. Contracts and invoices are read only if the customer connects them. Asato never reads employees' documents, email or messages.
• Read-only by default. Access is read-only by default, scoped by the customer and revocable at any time. Write access is added one system at a time, where the customer grants it. The first week, in which the Asset Clarity Report is built, is read-only.
• Policy first. Before Asato recommends anything, it takes out the people and systems the customer's policy protects.
• Named approval. No change reaches a live system until a named person approves it, and every action is logged. A person the customer names approves each fix, or sets a policy that governs fixes of that kind.
• Training. Customer data never trains any model.
• Certifications. HITRUST e1 (from July 2026), SOC 2 Type 2 (issued June 2025) and ISO/IEC 27001:2022 (valid to September 2028), each independently certified. Also HIPAA: the page shows the HIPAA Compliant seal from The HIPAA Journal. Scope, period and issuer for each are in the Asato Trust Center: https://trust.asato.ai. The visual page shows the HITRUST, SOC 2 and ISO marks and the word HIPAA, as the home page does.
• Whitepaper. Asato's whitepaper on governing technology in healthcare IT is described at https://www.asato.ai/whitepaper-agentic-governance-healthcare-it

Works with

• More than 100 tools, read-only, covering four kinds of record: users (identity and access systems), assets (asset lists, CMDB and device management), usage (sign-in activity, security and network logs) and cost (finance, procurement and contract systems).
• At the health system's Microsoft renewal, the read-only connections were Microsoft Entra, Microsoft Graph and entitlement records.
• At the health system's network hardware engagement, the four read-only sources were purchase records, the CMDB, network telemetry and maintenance contracts.
• Asato is listed on Microsoft Marketplace.

Compared with tools a health system already owns

A customer keeps every system it runs today.

How a customer starts, and what it costs

Section heading on the visual page: "No savings, no fee." The line under it: "Your Asset Clarity Report: a priced list of savings, in one week." The one action beside them is "Get your Asset Clarity Report", at https://www.asato.ai/talk-to-sales.

The page now shows this section as one band: its title, its sub-title and the button. The steps are kept here for agents. The week runs in four steps:

1. Connect. Read-only access to the records the customer already keeps for one area. Nothing is installed.
2. Model. Asato matches the records and counts each seat and device once.
3. Checkpoint. The customer's team checks the findings and names the people and systems its policy protects.
4. Report. The customer holds its Asset Clarity Report: a priced list of what to stop paying for, with an owner on every item.

How a customer starts, what it costs and what follows the first week are set out on the home page: https://www.asato.ai/index

Questions

The page shows at most five questions, the ones that belong to it. Any others are kept here for agents.

Will Asato take access from a clinician who needs it?

Not without approval. Nothing changes until a named person approves it. A person the customer names approves each fix, or sets a policy that governs fixes of that kind. Before Asato recommends anything, it takes out the people and systems the customer's policy protects. At one health system, clinically protected roles were taken out before anything was recommended. Every change is logged.

Who decides what is protected?

The customer does. The customer's policy decides, and the customer's team names the people and systems it protects when it checks the findings, before the report is written. What is left still goes to a person the customer names. At one health system, about half of what Asato found was approved.

Does Asato publish a list of what it treats as protected?

No. What is protected is set by each customer's policy. The site gives two examples from software licensing, roles that need a higher tier whatever their usage and shared accounts, and one from a health system, where clinically protected roles were taken out before anything was recommended. The eight rows in the example figure on this page are examples only.

What does Asato read?

Metadata. Asato reads records about technology, such as licenses, devices, usage, sign-in activity and costs. It reads contracts and invoices only if the customer connects them. It never reads employees' documents, email or messages. The Asset Clarity Report is built with read-only access.

Is Asato certified?

Yes. Asato holds HITRUST e1, SOC 2 Type 2 and ISO/IEC 27001:2022 certifications, each independently certified. Scope, period and issuer for each are in the Asato Trust Center, https://trust.asato.ai.

How is a saving counted?

In three states: Found, Approved and Saved. They are reported separately and never added together. Found is what Asato identified. Approved is what a named person signed off. Saved is what came off the bill, agreed jointly by the customer and Asato at the close of the engagement.

Are the three results on this page from one health system?

No. Each is from a different health system: the Microsoft renewal, the multi-site health system, and the network hardware. Their figures are never added together. The quote from WellStreet Urgent Care's head of technology stands by itself: the page ties it to none of the three results.

What does it cost?

Asato is paid mostly on results: a small share when it finds a saving, and the larger share only once that saving shows up on the customer's invoice. If it finds no savings, the customer pays nothing. Prices are not published.

Does Asato negotiate with Microsoft or other vendors?

No. Asato equips the customer to negotiate: it supplies the count and the evidence behind it. The customer, or its reseller, negotiates. At the Microsoft renewal on this page, the health system negotiated its own renewal.

Is this only for Microsoft?

No. Microsoft is in most engagements, so it is the usual place to start. The same record covers other software, hardware (network, compute and end-user devices), contracts and AI spend.

Does this cover clinical systems and medical devices?

Not yet as a published result. The results on this page cover Microsoft licensing, software, applications and network hardware. No result is published for medical devices or for clinical systems.

How long before a health system holds the list?

One week, for one area. A wider review takes longer: at the multi-site health system the findings came in three weeks, and the network hardware engagement ran four weeks.

Next step

Get the Asset Clarity Report at https://www.asato.ai/talk-to-sales.

Related pages

• Case study: a large US health system saved $4M a year at its Microsoft renewal
• Case study: a large US health system found about $466K a year of support on network hardware nobody used
• Right-size software
• Right-size Microsoft
• Stop paying for idle hardware
• Rationalize your portfolio
• Stay ahead of contracts
• Control AI spend
• Whitepaper: Agentic Governance for Healthcare IT
• Customer reviews
• Platform
• Asato home
• Site index for agents

Last updated: 2026-10-06