Founder, Imprivata

Tech Darling

"What's the thing that allows a startup to succeed? It’s your instincts to survive. You prioritize really quickly. If you're a small company you say, 'I only have this much time and I only have this much money and resources.' The need to prioritize what you need to do next is really crystal clear or it should be or you're going to be out on the street."

by Heidi Legg

In a digital age of healthcare, the security of patient files seems obvious. But in 2002? Not so much.

Entrepreneurs are often said to be soothsayers and in 2002, David Ting founded Imprivata, a healthcare IT security company focused on keeping medical files private and locked online, allowing doctor’s offices and hospital physicians to more easily sign in to secure networks, whether text messaging platforms, electronic medical records, or prescribing databases. In June 2014, a decade later, Ting took his Lexington-based startup public, raising $66.3 million through its IPO. This July, Imprivata announced they were being taken private again, having been acquired by private equity firm Thoma Bravo in a deal valued at about $544 million.

Along with Ting, local VC firms made up Imprivata’s largest investors to date including Wellington, Highland and Polaris Partners. Many would deem it the dream exit for a founder and his or her investors. I sat down with Ting before the summer talk with him about entrepreneurship, being nimble, and understanding what it takes to enter a large market where the players seems well established and change the course.

When did you see that the digital ID would be so transformative?

Fifteen years ago, before I started Imprivata, I was building safe systems for managing ID records for driver licenses. They had the same issue. Associated with the driver licenses were usually the history of where you lived, your violations, any kind of warrants, all your criminal past were linked through these driver's license systems. We recognized even in the mid '90s that privacy in the digital world of critical information was going to be important, and increasingly harder to maintain.

Now, some can say that the twenty-something really doesn't care about privacy because they share everything online. It'll be interesting to see how that changes when it comes to personal finance information and personal health information.

In tech today, wildly successful overnight unicorns like Uber seem to garner all the attention. That can’t be the path for most. You’ve started many technology companies, can you talk to us about the dark days?

Let me give you a little context. Our company was funded in 2002, which was post-9/11. We were the largest East Coast venture raise from three tier one VCs. We raised $14 million in the IP security space. It was a cash-rich environment where security was going to be really important. We shipped our first product and it was competitive in 2003. We had twenty-plus customers who bought it, and then we found out that even though they accepted the product really well, it didn't meet all our expectations. It didn't meet all our needs.

We made a really hard decision. We went back to our board and said 'our product is not ready. We'd like to pull it off the market.' We actually offered a refund to our customers to basically say, 'we're not ready for prime time. Give us another nine months.' And you know what? Not a single customer at that time wanted their money back. They said, “Just fix it. Send it back to us.'

You know what our board said? “Every startup goes through a hiccup. Every one of these companies that we funded will usually go through a hiccup around two plus years and at that point, they're out of money. So, you're lucky that you're at one and a half years. You found this issue and you have lots of cash and you've had lots of time. Go fix it. You've got one more shot. Don't screw it up.”

At that point, in the middle of the fall, we basically camped out at our offices. We went in when it was dark, came out when it was dark, and everybody stayed hunkered down. We cut back our sales team to one sales rep, and then to keep us going, our VP of finance at the time took his car to the Costco and loaded up with the cheapest junk food he could find with the highest sugar content, highest fat content, highest salt content and filled our counters with all this stuff. We engineers would go by and take a whole load full. Nine months later, at the end of the winter, everybody had put on at least ten pounds of unnecessary weight but we did put Version 2 and we went from $1 million, $5 million, ten, eighteen, and that's the exponential growth you want in a product.

What was the early stage product?

When we were funded, our notion was that IP security was going to be an issue for enterprise companies. I had been building systems for state governments, and security was an important aspect of maintaining the privacy of the records. As corporations embrace new technologies like digital records, there was going to be an increased emphasis on security. We needed to improve the experience. Logging onto a computer and logging it off, doing multiple applications and passwords were not part of anybody's job. It's an evil that we as technology geeks have imposed on end users. We thought, if you could humanize and make that security easier and take into account how you actually want to secure the system, there should be a business. That was the vision for Imprivata.

Why the name?

One of the guys said, 'look, it's about privacy. It's about security. It's about identity management. It's saying, 'in a digital world, I'm private.' and he said, 'and since you're Canadian, you'd say, 'I'm private-eh.'' We decided, 'let's just take the E and stick an A in it and we ended up with a name everybody liked, Imprivata.

How did you refine your idea?

When you start out, you worry about authentication. You worry about how people can be identified in a digital world. We looked at all the modalities: fingerprints, cards, tokens, passwords, secret questions. We asked ourselves, 'how do we make that easier for users?' and we did it for every vertical you could think of: manufacturing, government, utilities, finance, and then along the way healthcare came into play.

In 2003, HIPA passed. It was all about digital privacy and hospitals all of a sudden started to face the same problems that every other vertical was dealing with which is, ‘how do we ensure the security of all these patient records?’ Gradually we saw an uptick in health care sales until they were about 35% - 40% of our sales.

You set out to supply a security product for every business vertical in your early stage?

Every vertical. Then 2008 came along and guess what? Financial services stopped buying, and we said, 'gee, we need to pivot.’ I remember sitting in the room with the rest of the management team and we said, 'how will we bet on health care? As health care changes and paper becomes replaced by electronic records, security and privacy are going to be really important.' We decided to focus on health care and take that bet.

Were you whittling it down or was it more strategic than that?

We basically doubled down, kept on growing, focusing on health care. We had to understand that workflows in a health care setting are totally different than what a banker or somebody in manufacturing or a utility would go through, and we focused on it. In 2014, we took the company public on the New York Stock Exchange, basically the culmination of a lot of pivots and a lot of dark times. I mean, we've had every kind of crisis you could imagine, but in a mission critical environment, you can't screw up.

What felt ‘mission critical?’

Mission critical to me means the solution you build for your customers can't fail. You can't stop a hospital from functioning. You can't stop a doctor from getting into their systems, prescribing meds, accessing their records. It's really, really important.

You have to address three needs: understanding the problem from the business side, understanding who the stakeholders are in the organization who will deploy it and making sure that they're successful, and then having the end user, the people who touch the solution say, 'you know, I saw your solution across the street. We don't have it here yet but I'm going to go tell the CIO we want to buy the same solution here.' You have to make your solutions so cool that you have that viral effect at the end user’s level. But don't forget the guy who writes the check and the person who has to live with the solution. They're part of the equation.

Every CIO worries that they'll buy software and it'll sit on the shelf and won't get deployed. You want to make sure that the business owner understands the real value of your product and this goes for all entrepreneurs. When you're designing your product, make sure you have that message. Make sure you know how to tell that story so that when you have that five minutes with the CIO, very succinctly you can tell them why they’d be a fool if they didn't use this solution and then you back it up with the reference customers. All the top hospitals use it. All the large academics use it. We have the highest score customer surveys.

Pivoting doesn't only happen in B to B. Would you share how you pivot?

How do startups win and how do they take on large legacy established players? In reality, the only reason startups can succeed is that they have better vision and insight into a problem.

The startup says, “If I took this approach, I could be disruptive in this market. I could take out a large legacy player.' I love the challenge of saying, ‘there are these large players who've been in the market using a technology or approach or business model that's kind of old and I'm going to find a way to disrupt them and knock them off balance.’ It's not karate. It's more judo. It's finding the leverage point to make your opponents fall on their own.

It strikes me that this is all a game for you?

It is a game. It's chess. You have to figure out who the large legacy companies are with ten times the resources, a hundred times the reach of you – a single startup with three to five people. The challenge for you is getting the presence to make yourself look bigger. Create the disruption in your market and understand why you can succeed. And guess what? It has happened to all these large companies. Disruption in the technology, in the workflow, in the business/economics causes larger companies to fold.

And you say, 'what are you talking about? Larger companies don't fold.' Yeah. Blackberry didn't respond quickly enough. Kodak couldn't see the film business dying. The digital industry took over completely.

How do you remember it's only a game?

What makes a startup successful is your ability to turn quickly, use your gut instinct. You're constantly navigating. Bigger companies take one trajectory. They empower a hundred people or a huge group or a whole division and they move along. They chug along and they are unable to change. I see that in our own company as we get to 500 employees. The ability for me to say, 'gee, let's take this little tack over here' doesn't exist in the same way that we were able to with thirty people.

Is it more perseverance than agility?

Perseverance is your desire to take pain, because in any startup you'll make mistakes. It’s your ability to take that mistake and move on. But at the same time you have a finite amount of runway. You only have so much fuel. You quickly understand a lot of things that you don't need to do. When we went back to redesigning our product, we knew if we added these five different and new capabilities, we could take the market.

You have to be all in. If you're not a big company, if you fail, you have to be all in. It's not like you have a second parachute. Big companies will be cautious because they can't afford to make these mistakes. Smaller companies pivot and they go.

Someone I once interviewed said it's all about commitment. Do you agree?

It is. It's all about that. And in your early years, it's all about the survival instinct. You hone that. People who've been in startups say, ‘let’s prioritize these things and get these things done.' People who come from the larger companies will go, 'well, we should understand and analyze and go.' I don't have time! I don't have the resources. Use your gut instinct. That's the essence of what a startup is all about. The only advantage you have is your insight into a problem that nobody else, hopefully, has addressed because the moment you identify the problem, if it's a large enough market, you're going to have hundreds of competitors. It's like a honeypot. Bears will come to you if they smell it.

How do you account for competitors in your space?

Before you make a pivot, do your homework. Understand why company A succeeded, or hasn't succeeded. Understand why your strengths are going to be enough to offset them and really talk to a lot of customers or prospects. One of the things I find with a lot of startups is their reluctance to call people and talk. A mentor that I've had for years basically said, 'entrepreneurs like you - and especially technical ones - are afraid of the one word that will block them' and he said, 'you know what that is?' 'No.' He said, 'well, you just said it. You're afraid of the 'no' response.'

Don't be afraid of the 'no' word. Call somebody else and find the people that will talk to you. Find the people that will resonate with your idea and deal with the rejections, but don't be afraid. This same mentor said, 'pick up the phone. Call the VC and ask them why they didn't fund you and why they weren’t interested in your business plan. He said, 'they'll talk to you. They're people.'

It's about feeling confident enough in your own ideas, in your homework that you've done that you can deal with no. He said it really bluntly, ‘if you can't convince yourself that you've got the right idea, how are you going to sell the idea to somebody who's going to give X millions of dollars?’

Did you have a prototype in the beginning when you asked for money?

Yes. I did. I also had several customers that were lined up. The customers had actually tested it in a pre-release phase. You do that based on your own beliefs that this is going to be viable. And in that pre-funding phase, it was all funded out of my own banking account.

How much did you ramp up partnership versus sales?

It's not equal but it's focused. It was really tactically saying, 'sales will execute like this, but we need to own different parts of the stack to create barriers to entry.' That deters your competitors from coming into your space.

Did you have to give up some ownership?

No. We picked the larger players, again, using leverage. If you pick one or two of the larger players, the other ones will come.

I think it’s hard for entrepreneurs to go into partnerships because they tend to be people who aren’t team players and pretty focused on their vision and getting the vision in place. Any tips for entrepreneurs on timing, when it is time to go into partnerships?

I think you said it, correctly. No company necessarily wants to partner with you, because it's disruptive for them. But if you can have a mutual customer – and all of our partnerships were driven by customers – use that as your focal point.

Give us an example?

Sure. Medical records. EMR vendors are large record companies that sit inside of hospitals and manage all the digital records. They own that account. Their solution is measured in the hundreds of millions of dollars to install. We come along and we say, 'gee, you know, we're the ideal solution to front end your application' and they tell us to go away. You're tiny. You're part of the solution but you're not. We're too busy for you.'

Did they actually tell you that you were too tiny or could you tell tell they're not interested?

‘Go away.’ But if you get a customer that basically sees the value in your solution, they will go to bat for you. They will say, 'I really believe you two companies (startup and giant) should work together on the customer's behalf.' The customer rules and after I pay a couple hundred million dollars for your solution, I want these two systems integrated. We have other customers that will tell their vendors, 'we will not buy your solution unless it's integrated,' because our solution's built into the infrastructure. We're the point where every user touches our solution to get access to the systems, whether it's a printer or a medical record system; now it's their medical device. You become critical to all these workflows, and it is the customer who will bring you into the meetings and ask nicely that their vendors cooperate with you.

Many people have ideas. How do you isolate an idea that you knew would be transformative?

Every startup starts out with the germ of an idea. You see something that is critical and what you really want is to say, 'how does this idea become transformational for a business or a market or how can it change how people do things?' We as engineers, we build tools and say, 'I have a small germ of an idea but I think it's much larger. I'd like to encourage all the entrepreneurs to think about how you become transformational? Not just how you get yourself to that first point of getting funded. That's the first step, but think more broadly. Think more how you can be transformational. Startups succeed when they build value, when they create jobs, and when they transform and create new markets.

How does one think bigger?

I think the first thing to believe in is that you can be bigger and you can take down larger organizations.

My first startup, years ago, was the number one vendor in a hardware space building display systems. Out of left field, literally, a one-man-show-grad student who had used our product in his lab came out with a product at half the price with twice the speed.

We’re going, 'oh, this one guy and his three friends with a new building up on 495 is eating our lunch.’ Can it be done? Absolutely. We did it to IBM. When we were a startup, we took out the product that IBM built. Now, this grad student starts eating our lunch. It's a competitive game and you need to think of it that way. If you have an idea that's valuable, there'll be competitors out there. There'll be people who'll be right on your heels and you need to know how to play the defensive game and how to play an offensive game. It's really hockey. I tell people, I'd rather be fore-checking in the opponent's zone than being on my heels guarding my goalie.

Do you care more about the game than the IPO?

That's the score count.

You have to think in those game terms because it is a competitive world. There are lots of players out there and if you can't thread your needle through the space and figure out how you win… It goes back to those questions: what does 'win' mean to you? Is it just getting my company up and running, or is it really becoming the big dog in the space, or is it transforming that space? You have to look deep inside and say, 'this is what I want to do and this is how I'm going to get there.' and pivoting is part of your strategy to react to forces that you can't control. There are lots of forces. You have to respond. You have to quickly figure out - is this a threat? Or is this an advantage? And sometimes your worst opponents can turn into advantages for you. We've done that with several of our partners now that used to treat us as competitors. We just basically displaced them from their space and said, 'partner with us and we can do better together.'

Studies on gender show that men have an easier time 'going for it’ and thinking big. How do we, women entrepreneurs, push ourselves?

If you don't have that attitude, somewhere along the line, even if you're moderately successful, somebody's going to take you down. You might as well get used to being a predator. Go out and figure out how you're going to take down your competitors. I'd rather be scoring rather than defending.

What do you see as the new opportunities in healthcare?

Healthcare is undergoing a transformation. Patients are now responsible for increasingly paying attention to how they deal with the maintenance of their own health. How do you, as a consumer, deal with managing your health? This is going to be the next challenge because now we have medical records that are online. We have the ability to interact with the scheduling and multiple provider systems.

Think back to airlines when we used to get these little paper tickets and we had to call our travel agent to schedule flights. Now we do everything online. We used to have lines of people in the airport waiting at the desk to check in. Now we do it by a kiosk. You go to a hospital and that same transformation has not yet occurred. The whole patient experience of dealing with very expensive care, certainly in the US, needs to undergo that transformation.

Do you believe that digital ID empowers patients?

Yes because nobody's going to allow their medical records to be accessed unless they feel comfortable that the system is maintaining the privacy safeguards for those records. I don't want people to know which specialist I need to see. I don't want them to know what medications I'm on. That is at the essence of modern digital health. If you don't have that security, nobody's going to trust it. We'll go back to calling in and doing it the old fashioned way.

This interview was conducted in front of a live audience at 48 Hours at the Microsoft Nerd Center in Cambridge in May, 2016. Here are some audience questions:

Audience Question:

When you pivoted in 2008 into healthcare, did you intend to go back to the other verticals?

No. We felt startups only succeed if they have focus. A big company can say, 'I'll take multiple bets.' When you're a startup and you want to succeed, you basically put it all in and say, 'that's the direction I'm going.’ We still have some of the largest banks that you can imagine but our focus is 100% healthcare.

Audience Question:

What is some late-stage advice you received that you didn't act on quickly enough?

There are two stages of mentoring. There's the pre-funding mentoring that I received from a friend who was an ex-VC. That was critical in getting us into the first stages of getting funded. Post-funding, most of the advice comes from our board members who are all investors and it's their operational expertise as well as their long-term vision that allowed us to move. We happen to have three really good VCs. The advice that they gave was caution around picking too many verticals. They said, 'you're trying to spread yourself one molecule thick' basically and geographically we said, 'oh, we should look at spreading ourselves into Asia Pack,' and they said, 'well have you addressed all the US requirements or North American requirements? Have you taken all the hospitals in the UK or Western Europe?' The answer was no. A lot of it was caution around making yourself too spread out to win.