Headway is a healthcare technology company that builds software to connect patients with therapists who accept insurance. The platform operates across all 50 US states, linking over 60,000 mental healthcare providers with a patient base exceeding one million. Founded in 2019, the company has raised over $325 million through Series D funding.
The core product is a therapy network platform that handles insurance integration for providers running their practices. For security teams, the threat model centers on protecting highly sensitive personal health information (PHI) at scale - patient data, insurance credentials, and provider records flowing through a system that touches real clinical workflows. The attack surface spans provider-facing practice management tools, patient discovery and booking interfaces, and the insurance claims pipeline.
Security work here means defending a regulated healthcare platform where compliance isn't optional - HIPAA obligations shape architecture decisions, access controls, and data handling from the ground up. The technical domains of healthcare technology and insurance integration mean engineers and security practitioners must understand both the clinical workflow and the payer ecosystem, not just one or the other. At this scale, even minor configuration drift or access policy gaps carry outsized risk.
