Medical billing company data: denial notes, PHI and what an RCM company can license

The short answer: can a medical billing company license denial and appeal notes?

Usually not as they stand. Denial notes, appeal letters and claim histories contain protected health information (PHI), and a revenue cycle management (RCM) company typically handles that PHI on behalf of healthcare providers as a business associate. Whether it can license any version of the records depends on three things: what its business associate agreements (BAAs) allow, whether the data has been de-identified to the HIPAA standard, and what the provider customers have agreed. This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

For an operating partner, the useful point is that an RCM company may still hold licensable material that is not PHI: its own workflows, payer-rule playbooks, staff training content, internal tickets and process documentation. The conversation should start there.

What does the HIPAA de-identification rule say?

HHS Office for Civil Rights describes two methods of de-identification under the HIPAA Privacy Rule: Expert Determination, where a qualified expert concludes the risk of identifying an individual is very small, and Safe Harbor, where specified identifiers are removed and the entity has no actual knowledge the remainder could identify a person. Data de-identified by either method is no longer PHI under the rule.

Two cautions follow. First, free-text appeal notes are the hardest content to de-identify because names, dates, facility details and rare diagnoses appear in sentences, not fields. Second, de-identification solves the privacy question only. It does not by itself give a business associate the right to use or license a provider's data; that comes from the contract. The same distinction is covered in de-identification versus permission to license and in the PII redaction matrix.

What do RCM companies typically hold?

How do these situations resolve in practice?

What is the operating partner's three-question screen?

1. Whose data is it? Ask the CEO whether the company owns any of the records it holds, or only processes them for providers.
2. What is not PHI? Ask for a list of systems that do not contain patient information, by name only.
3. What do the BAAs say? Ask whether counsel has ever reviewed use of de-identified or aggregated data under those agreements.

If the answers to the first and third are unclear, pause. If the second yields a meaningful list, the data inventory builder is the next step. Adjacent insurance and claims records raise the same issues, as in workers' comp claims notes, and collections-style businesses raise ownership issues, as in collection agency acquisitions.

What should you say to the CEO?

What questions should you ask counsel?

• Which of our customer contracts and BAAs mention aggregated, de-identified or derived data, and what do they allow?
• Would an expert determination be needed for any free-text content, and who would commission it?
• Do any provider customers need to authorize a license, and can we reach them?
• Are there state laws on health information or payer confidentiality that tighten the picture?
• Who is responsible if a de-identified file is later re-identified?

Bring the answers to the sponsor, not to SourceX as a partner. Your role ends at the introduction and the basic fit information, and no record is shared before a signed agreement.

How does the introduction work?

1. You introduce the company using the referral form or your referral link, with basic fit information only.
2. SourceX qualifies it on size, history, data breadth and rights, and flags PHI exposure.
3. The company completes a data inventory.
4. De-identification and exclusions are agreed before any work begins.
5. Price and terms are agreed, buyers review and the company decides whether to sign.
6. Data is delivered after an executed agreement and authorization.
7. Your reward is paid after SourceX receives payment.

The how to monetize company data page gives the wider context.

How do rewards work for a sponsor?

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed. Check your fund's and employer's policies on fees connected to portfolio companies before registering.

When is a billing company not worth an introduction?

• Data is mainly PHI without HIPAA authorization or de-identification.
• The company only processes provider data and owns none of it.
• Another party controls the archive after a sale or wind-down.
• The business has under 50 full-time employees at peak.
• Nobody can export the data.

Next step

If a portfolio RCM company has non-PHI operating records and clear rights, register as a partner and use the referral link. Who qualifies lists the baseline, and the operating partner overview covers screening across a portfolio.