Healthcare services PE exit readiness: licensing administrative records, never PHI

What a data license can include in healthcare services

For a PE-backed healthcare services company getting ready for exit, a data license is only worth discussing if it covers non-PHI administrative and operational records: finance and procurement workflows, IT service desk history, internal policies and SOPs, and the coordination behind them. Patient charts, claims and other protected health information are out of scope unless they have been de-identified under HIPAA's standard or properly authorized, and a company whose records are mainly PHI is the wrong introduction.

The HHS guidance on de-identifying protected health information describes two methods under the Privacy Rule: Expert Determination, in which a qualified expert documents that the risk of re-identification is very small, and Safe Harbor, which removes 18 specified identifiers with no actual knowledge that what remains could identify someone. Health information de-identified by either method is no longer PHI. For a referral partner, though, the practical rule is simpler: lead with administrative records and leave clinical data out of the first conversation entirely.

Multi-site healthcare platforms often look promising on headcount and history, which is exactly why the screen below matters. Its job is to stop introductions that would waste the CEO's time or raise compliance questions just as the exit process starts.

Which records healthcare services companies hold

Most platforms run two worlds side by side: clinical systems full of PHI, and a back office that looks much like any other multi-site business. Only the second is a candidate.

Which healthcare services companies fit

Read the program baseline through a healthcare lens. The company must be US-based and have reached 50+ full-time employees at peak (contractors excluded); it needs a multi-year operating history it can document, clear rights over the records it would license, and an executive or owner with authority who is open to an exclusive license for AI training over a set period. In this sector, that points to the operating platform's central back office rather than its clinical sites.

Stronger candidates:

• Management services organizations that run finance, HR, IT and procurement themselves for affiliated physician, dental or behavioral health practices.
• Healthcare IT services firms and software vendors whose own engineering, support and operations records are distinct from client data.
• Multi-site platforms with a central shared-services team and several generations of system history.
• Healthcare staffing companies, for their own recruiting, client service and finance operations rather than clinician files.

Weaker candidates:

• Revenue cycle, medical billing and coding outsourcers, whose working records are largely their provider clients' PHI.
• Single-site practices that miss the size baseline.
• Platforms that lost their archives in EHR or ERP migrations.

The who qualifies page sets out the full baseline. The brief on BPO and contact center platforms explains the same client-ownership problem in another outsourced sector.

Rights and confidentiality pitfalls specific to healthcare

1. Which entity owns the records. Depending on state law, some platforms keep clinical work in separate professional entities while a management company provides services under contract. Confirm which entity created and controls each record set before anyone discusses scope.
2. Client PHI handled as a service provider. Where the company processes PHI for provider clients, that information belongs to the clients and is governed by their agreements with the company. It is not the company's to license.
3. Incidental PHI. Service desk tickets, shared drives and chat channels pick up patient details. The company settles filtering and de-identification rules before anyone touches an export.
4. Payer and vendor confidentiality. Payer contracts and vendor agreements can restrict disclosure of rates and terms, so counsel should review them before those records enter scope.
5. Recorded calls. Scheduling and patient-access recordings carry PHI and consent questions; leave them out.
6. Earlier data arrangements. Check whether any record set was already licensed or shared for AI training, which is itself a red flag for a new license.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

How a license fits the exit timeline

A records conversation can strengthen exit preparation or distract from it, depending on when it happens.

For how a license interacts with each route to exit, see the guide to private equity exit options.

Who can introduce a healthcare services company

Operating partners with healthcare platforms, portfolio CFOs, sell-side advisers working on healthcare exits and interim executives placed in portfolio companies all see the systems map early. In this sector the partner's discipline matters more than usual: never forward a ticket, screenshot or spreadsheet to illustrate the opportunity, because any of them could carry PHI. You make the introduction and pass on basic fit information; the company works with SourceX directly, and data is delivered only after an executed agreement and the company's authorization.

Partners earn 25% of the eligible platform fees SourceX collects from the referred company's licensing deals, up to $100,000 per referred company, paid after the buyer pays and SourceX receives its fee. Rewards are not guaranteed and never reduce the company's proceeds.

The admin-first screen

Ask the CEO or CFO these questions in general terms, without requesting any records:

• Can you name several systems that hold no patient-level content?
• Did the company itself create those records, rather than its provider clients?
• Do they go back several years, including archived or read-only systems?
• Did the company reach 50+ full-time employees at peak (contractors excluded)?
• Is there a sponsor who can approve scope, price and terms?
• Is the exit timetable clear enough to fit a license before, or after, the process?

The company fit checker runs a preliminary, non-binding version with no contact details. For another sector where record ownership decides the answer, compare the testing, inspection and certification brief.

A conversation starter for the CEO or CFO

Next step

If the admin-first screen comes back clean, register as a partner so the CEO can apply at sourcex.si/apply through your referral link. The operating partner referral guide shows how to run the same screen across a whole portfolio.