Are workers' compensation records PHI? HIPAA limits for claims notes and licensing

Are workers' comp records PHI? The short answer

It depends on who holds the record and in what capacity. Protected health information (PHI) is a HIPAA concept: it describes individually identifiable health information held by a covered entity, such as a health plan or a health care provider that bills electronically, or by its business associate. A claims note is PHI only if the holder falls into one of those roles for that record. Whether a workers' compensation line falls inside or outside that definition depends on the entity's role and the facts, and counsel has to decide it. The same company's group health or provider lines may be treated differently.

That distinction is the first thing a portfolio operating partner should establish before treating a claims archive as a licensing candidate. It also does not end the analysis: state medical-privacy rules, contracts with employers and insurers, and the company's own privacy promises can all restrict reuse even when HIPAA does not apply.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

What does the HIPAA de-identification standard require?

If a record is PHI, health information offered for licensing generally must be de-identified under HIPAA's standard or otherwise authorized. HHS describes two methods in its guidance on de-identification of protected health information:

• Expert Determination: a qualified expert determines and documents that the risk of re-identification is very small.
• Safe Harbor: 18 specified identifiers are removed and the holder has no actual knowledge that the remaining information could identify an individual.

Health information de-identified by either method is no longer PHI under the Privacy Rule, according to the same guidance. Free-text claims notes are the hard case: adjusters write names, dates, employers, body parts and locations into narrative fields, which makes mechanical removal of identifiers difficult. That is why redaction and de-identification requirements are agreed with the company before any work begins.

How does this apply in common portfolio situations?

Use the table to frame questions for counsel. The right-hand column is what to confirm, not a conclusion.

If a record mainly consists of PHI and the company has no HIPAA authorization or de-identification route, it is a red flag for SourceX and the company should not proceed with that material.

What should a sponsor and counsel agree before any inventory?

Treat the following as a checklist for the portfolio company's general counsel or outside counsel. The partner does not take part in it.

• A written determination of which lines of business, if any, are covered entities or business associates.
• A map of where claims narrative lives: claims system, email, document store, call notes.
• Contract review: do insurer, employer and client agreements limit reuse or require consent?
• A state-law review, since medical-confidentiality and privacy requirements differ by state.
• A decision on the de-identification method for any health information, with documentation.
• A privacy-policy review: does anything the company told claimants conflict with licensing?
• Confirmation that records are the company's to license and not held only as a service provider.

The PII redaction matrix shows how different record types are typically treated, which helps with the narrative-text problem. For the ownership side, compare the question of who owns aircraft maintenance records, another case where the holder and the owner differ.

What can a company still license if claims notes are off limits?

Often quite a lot. Claims is only one source of operating records. A TPA or insurer with 50+ full-time employees at peak (contractors excluded) often also holds records that carry no health information at all:

• Internal policies, procedures and adjuster playbooks.
• Business email and Slack or Teams conversations about operations, with personal data redacted.
• Finance, vendor and contract records.
• Engineering, product and IT tickets for the claims platform.
• Customer service and employer-account management records.

Illustrative: a fictional claims administrator finds that its adjuster narrative is the most useful but also the riskiest set, so it keeps that out of scope and inventories its policy library, vendor records and platform engineering tickets instead. Whether any claims-related material is added later is a decision for the company and its counsel.

The data inventory builder helps list those systems by name and years of history without describing contents.

What is the operating partner's role?

You make an introduction and share basic fit details. You never handle claims files or describe confidential records. The steps below are written for a sponsor who wants the licensing question looked at without disturbing operations.

1. Ask the portfolio CEO or general counsel which privacy determination has already been made.
2. If none exists, suggest the company commission one from counsel before any licensing discussion.
3. Register as a partner and introduce the sponsor, or have the company apply through your referral link.
4. SourceX qualifies the company and asks for the inventory, scoped to what counsel has cleared.
5. Terms, price and redaction rules are agreed before buyers see anything, and nothing is delivered without a signed agreement and the company's authorization.

For the wider portfolio view, read referral opportunities for private equity operating partners.

How do rewards work?

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed. The reward is a share of SourceX's fee and is never deducted from what the portfolio company receives. Check your firm's policies on fees connected to portfolio companies before you register.

Questions to ask your counsel

• Which entities in the group are covered entities or business associates, and for which records?
• Does a state law add duties for workers' compensation or injury records?
• Do our contracts with insurers and employers permit licensing de-identified material?
• Which de-identification method suits free-text notes, and who documents it?
• What would a license change about our privacy notices?

Next step

Do not start with the claims notes. Start with the determination, and let a lawful scope drive the inventory. If the company has records outside the health-information question, register as a partner and introduce the sponsor, or send them to sourcex.si/apply. For another exception-heavy record type that avoids health data, see OS&D and freight claims records.