MediStreams Replaced Fortra’s Globalscape EFT Arcus and Turned Delivery Disputes Into a Lookup

MediStreams is a healthcare revenue cycle management company that automates payment posting and reconciliation for healthcare providers. Payment data reaches a provider in fragments: bank deposits, electronic remittances, paper EOBs, and payer correspondence, each arriving at different times in different formats. MediStreams matches deposit information to remittance data across all of it and delivers posting-ready files into the provider's EHR or practice management system, so only funded payments get posted.

Every step of that service is a file crossing a boundary between organizations. Remittance, payment, and claims files come in from practices, hospitals, and banks. Processed files go back out. All of it is PHI, PII, and financial data handled under HIPAA. MediStreams provisions SFTP credentials for roughly 300 counterparties, who push and pull files around the clock, almost entirely machine to machine. For a business like this, moving the files is half the job. The other half is being able to prove, at any moment, exactly what arrived, when, and from whom. That was the half MediStreams could no longer do.

Reporting Too Broken to Settle a Dispute

The counterparty estate ran on Fortra’s Globalscape EFT Arcus, first on-premises and later on Globalscape's managed cloud service. The transfers themselves worked. The record of the transfers did not.

“It's only worked a few times because they have issues with their ARM database.”

Under MediStreams' transaction load, the reporting layer failed so often it was effectively unusable. It could not reliably produce even a clean list of the platform's own users.

The cost landed in a workload MediStreams handles constantly: delivery disputes.

“We have different instances where we have SLAs that they may say were missed, or where they're just not seeing a file, or they say they sent something and we don't have it.”

Every one of those conversations needed evidence, and with reporting down, evidence meant manual log digging with no way to predict how long it would take. On regulated traffic, the same gap was an audit exposure. HIPAA expects a record of what happened to protected health information, and the platform could not dependably supply one.

The load was also climbing. Monthly transactions roughly doubled inside a quarter, from about 1.5 million in January 2026 to about 3 million by March, on a reporting database that was already failing under the smaller number.

Globalscape also bundled automation into EFT, but all of MediStreams' job automation—the workflows that pick up incoming files and push outbound ones—ran on a separate in-house system. What the counterparty-facing platform actually had to provide was narrow: SFTP, credentials, and a trustworthy record. Globalscape combined more capability with less dependable reporting.

Why Replacing It Meant Moving Everyone at Once

A problem this visible usually gets fixed sooner. This one survived because of what fixing it required. The entire counterparty base pointed at a single endpoint: 325+ incoming connections, counting roughly 300 external SFTP clients plus the in-house automation service, driving about 3 million transactions a month. Only three human users sat behind all of it. An estate that is almost entirely machines cannot migrate a few clients at a time, because scripts on both ends are aimed at one host. Replacing the platform meant a live, all-at-once cutover of every counterparty.

The corporate structure added constraints. MediStreams runs two separate production environments, technically belonging to two different companies: one carrying the 300+ counterparty accounts and one carrying a handful of legacy accounts, each under its own branded domain. And the in-house automation layer had to connect to the new platform exactly as it had connected to the old one, unchanged.

So the requirements were written before any vendor was named: HIPAA-compliant SFTP under a business associate agreement. Logging and reporting dependable enough to stand as evidence in a dispute. Structural segregation between two branded environments owned by two legal entities. Concurrency that holds up under heavy machine-to-machine traffic. And no need to replace the automation staying in-house.

MediStreams selected Files.com to be that platform for both production environments.

Two Branded Sites, 300 Imported Credentials, One Live Cutover

The Files.com deployment mirrored the corporate structure: a main site with child sites for each branded production environment, plus a separate site for test and development. Each production site runs under its own branded domain, so the counterparties of each company see that company. The boundary between the two entities is built into the architecture rather than maintained as a permissions convention.

Files.com's US-based engineers handled onboarding while Lewis-Crane handled the customer side. More than 300 user accounts, their SSH keys, and folder structures moved in bulk from the Globalscape export. Files.com supported the existing keys and concurrent sessions, so counterparties did not have to change their scripts. The new environment ran in parallel with Globalscape production while Lewis-Crane verified that the in-house automation service could connect unchanged. Then every client and script moved to Files.com in one live cutover.

Delivery Disputes Are Now a Lookup

With Files.com in production across both sites, MediStreams replaced a platform it could not get evidence out of with one where the evidence is the point.

• When a counterparty disputes an SLA, claims a file never arrived, or insists it sent something MediStreams doesn't have, the answer comes from the Files.com activity record: what arrived, when, and from whom. Nobody digs through logs hoping the reporting database is up that day.
• The audit gap on regulated data is closed. PHI, PII, and financial traffic moves under an executed HIPAA BAA with an activity record behind every transfer.
• The estate runs at full scale, roughly 3 million transactions a month, with only three human users on the platform.

A new counterparty is a credential on the branded site, and every file that counterparty sends or receives lands in the same activity record. The dispute process that now takes a lookup for 300 clients takes a lookup for the three hundred and first.

The Record Is Part of the Service Now

MediStreams' business has always been about proving things about payments: that a deposit matches a remittance, that a payment was funded before it posted. Its file estate now works the same way. Files.com's activity record shows what moved, when, and between whom.

For a company adjudicating deliveries of regulated data, the transfer platform's reporting was never a secondary feature. It was the evidence. Once the evidence could no longer be trusted, transfers that still worked were not enough, and that, more than anything about moving files, is why Globalscape had to go.