Fighter jets, satellite imagery and Medicaid claims all get handled within a short drive of the Arch.
St. Louis has a fighter line, an intelligence agency's western headquarters, big health systems and Medicaid plans. Each runs into the same issue sooner or later. Cleared staff, contractors and partners need separate, provable access, and Missouri's new insurance cyber rules add a four-business-day clock.
- Privileged Access ManagementCybersecurity
- Identity Governance & AdministrationCybersecurity
- Zero Trust ArchitectureCybersecurity
- Governance, Risk & ComplianceCybersecurity
- Healthcare Payer Platforms (Facets)Enterprise Platforms
- Insurance PlatformsEnterprise Platforms
- Data EngineeringData & Analytics
In St.
Louis we work with aerospace and defense suppliers, geospatial and location data companies, health systems, Medicaid plans and insurers. The work is privileged access, identity governance for mixed employee and contractor workforces, payer platform data and pipelines that keep sensitive imagery and claims scoped to the right people. Cohash is based in Frisco, Texas, serves St. Louis clients remotely and travels in for workshops and launches.
Cohash has no St. Louis office. We work with Missouri and Metro East organizations remotely from Frisco, Texas, and come to St. Louis for discovery, design workshops and cutover weekends.
- rules
- Missouri breach notification, RSMo §407.1500Missouri Insurance Data Security Act, RSMo §§375.1400–375.1427CMS Interoperability and Prior Authorization Final Rule
What's specific about St. Louis
Each figure comes from a public source, linked on the card.
NGA opened its $1.75 billion western headquarters in north St. Louis on Friday 26 September 2025, St. Louis Magazine reported, with roughly 3,000 employees relocating from the agency's 2nd Street campus near the Anheuser-Busch plant.
source ↗ 02 18,000Boeing said in February 2026 that it is moving its defense and space business back to St. Louis after nearly a decade on the East Coast, to keep leaders close to about 18,000 St. Louis workers. Its global headquarters stays in Arlington, Virginia.
source ↗ 03 281,300Education and health services leads the St. Louis MO-IL metro's supersectors, at about 281,300 of roughly 1,435,700 nonfarm jobs in September 2026 on preliminary BLS figures. Professional and business services follows with 210,900.
source ↗ 04Missouri's Department of Social Services lists three general MO HealthNet managed care plans, Healthy Blue, UnitedHealthcare and Home State Health, with Show Me Healthy Kids listed separately.
source ↗Who we work with in St. Louis, and the rules they work under
-
Aerospace and defense manufacturing
Fighter and weapons programs mix union production staff, engineers, foreign partners and hundreds of suppliers, and controlled technical data has to stay inside that circle. We set up identity governance that knows citizenship and program status, vault administrator access to engineering and MES systems, and log who opened which drawing.
-
Geospatial and location intelligence
Imagery, mapping and location analytics firms often work with classified customers on one side and commercial clients on the other. The unclassified side still holds licensed imagery, customer coordinates and model training sets. We separate tenants in the data platform, put service accounts that pull imagery feeds under rotation and track which models were trained on which datasets.
-
Health systems and Medicaid plans
Academic medical centers and managed care organizations trade member, claims and encounter data with the state and with each other. CMS's new API rules turn that exchange into public endpoints. We build the payer data pipelines and the authorization layer that decides which app or provider sees which member's records.
-
Insurance and wealth management
Brokerages and insurers run large advisor and agent networks, many of them independent. Agents come and go, and their access to policy and client data tends to linger. Missouri's insurance data security act now asks for MFA and vendor oversight, so we tie agent access to licensing status and automate removal.
-
Missouri breach notification, RSMo §407.1500 ↗
Notify affected residents without unreasonable delay. A vendor must tell the data owner immediately after discovery. Notice to more than 1,000 people at once also goes to the Attorney General and the national credit bureaus. A written no-harm finding must be kept for five years, and AG penalties reach $150,000 per breach.
-
Missouri Insurance Data Security Act, RSMo §§375.1400–375.1427 ↗
In effect from 1 January 2026. Licensees report qualifying cybersecurity events to the Director within four business days. The written information security program in §375.1405, which covers MFA and encryption, is due 1 January 2027, and its third-party provider subsection on 1 January 2028.
-
CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) ↗
Covers Medicaid managed care plans, so MO HealthNet's contracted plans fall under it. Prior authorization timing rules started 1 January 2026, and the Patient Access, Provider Access, Payer-to-Payer and Prior Authorization APIs are due mainly from 1 January 2027.
Most requested in St. Louis
The services clients in St. Louis ask us for most.
- CybersecurityPrivileged Access Management
- CybersecurityIdentity Governance & Administration
- CybersecurityZero Trust Architecture
- CybersecurityGovernance, Risk & Compliance
- Enterprise PlatformsHealthcare Payer Platforms (Facets)
- Enterprise PlatformsInsurance Platforms
- Data & AnalyticsData Engineering
01Does Missouri have a consumer privacy law like Texas or Minnesota?
As of 2026 Missouri has not passed a comprehensive consumer privacy act. The rules that bite are the breach statute in §407.1500, sector laws such as the new insurance data security act, and federal regimes like HIPAA. If you hold data on Illinois residents across the river, Illinois law can also apply, so check with counsel.
02We're an insurer domiciled in Missouri. What does the four-business-day rule cover?
It runs from when you determine a qualifying cybersecurity event happened and goes to the Director of the Department of Commerce and Insurance. Out-of-state licensees also report when 250 or more Missouri consumers are involved under certain conditions. We help with the identity side, so you can tell quickly which accounts and systems an event touched.
03Can you help a defense supplier separate program access from the rest of the company?
Yes. We tie access to attributes such as program assignment, citizenship and clearance from your HR and security systems, enforce them at the identity provider and engineering tools, and produce access reviews your program security officer can sign. Classified networks stay with your cleared IT staff.
04How long does a Medicaid plan API project take?
It depends on how clean your claims and clinical data are and how much of the earlier Patient Access API is already live. We start with a data readiness review of the core system, which tells you whether the 2027 date is a build or a rebuild.
More cities in Missouri
459d895f - 01St. Louis Magazine, NGA officially opens its North City headquartersstlmag.com ↗
- 02Defense One, Boeing moves its defense HQ back to St. Louis (February 2026)defenseone.com ↗
- 03BLS, St. Louis MO-IL economy at a glancebls.gov ↗
- 04Missouri DSS, contact your health plandss.mo.gov ↗
- 05RSMo §407.1500 (Missouri Revisor of Statutes)revisor.mo.gov ↗
- 06RSMo §375.1405 (Missouri Revisor of Statutes)revisor.mo.gov ↗
- 07RSMo §375.1410 (Missouri Revisor of Statutes)revisor.mo.gov ↗
- 08RSMo §375.1427 (Missouri Revisor of Statutes)revisor.mo.gov ↗
- 09CMS, Interoperability and Prior Authorization Final Rulecms.gov ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it