Last week, CareTria announced its acquisition of CaryHealth, bringing together two companies to build one of the leading direct to patient pharmacy platforms in the country. For Areo Nazari and the entire CaryHealth team, it's the culmination of years of hard work in one of the toughest verticals to build in: healthcare.
For Com-Sec, it's personal.
CaryHealth was our first client. Before Com-Sec was a real company, before we had full time employees, before we had an office, there was CaryHealth. It started the way it does with most startups: a business need for SOC 2, a growing pile of security questionnaires and SIGs from customers and partners, and no one in-house to own it.
I came on to advise Areo on a fractional basis, helping them work through the compliance demands that come with selling into pharma and health systems. Back then it was just me, doing vCISO work on the side, figuring things out alongside a team that was figuring things out too.
As CaryHealth grew, so did we. What started as fractional advisory turned into deeper involvement. More systems to secure. More compliance requirements to meet. More customers asking harder questions about how their data was being protected. Healthcare does that to you. The regulatory bar is high, the stakes are real, and there's no room to fake it.
The early days — building Com-Sec alongside CaryHealth's team.
Areo and the CaryHealth team gave us something you can't buy: a chance to grow alongside them. They let us use their office as a workspace. One summer, we had our entire team, interns included, packed into their conference room.
It was crowded and it was exactly what we needed. We were building Com-Sec in real time, inside a company that was building something meaningful in healthcare.
When I look at where Com-Sec is today compared to where we were when CaryHealth brought us on, the difference is stark. We went from a handful of 1099 contractors and a side project to a team of 10 full time employees, a growing roster of project based contractors, and a company with real structure, real clients, and real delivery capability. CaryHealth didn't cause all of that, but they were the starting point. A lot of the discipline, the processes, and the standards we operate by today were shaped by what we learned working with their team.
Building in healthcare is hard. Scaling in healthcare is harder. Doing it while meeting the security and compliance demands of pharma manufacturers, health systems, and enterprise buyers is a challenge that most companies underestimate. CaryHealth did it right. They invested in security early, they treated compliance as a business enabler, and they built a platform that could withstand serious diligence. That matters when you're heading toward an exit.
Congratulations to Areo, to the CaryHealth team, and to everyone who contributed to getting here. This is well deserved. 🎊
And to anyone building a health tech company wondering whether investing in security and compliance early actually pays off: it does. We watched it happen.
Farbod Fakhrai is the founder of Com-Sec, a cybersecurity and compliance consulting firm supporting startups and growth stage companies.