RCM company acquisitions: separating BAA-bound data from firm-owned records

How should a PE team screen an RCM add-on for data licensing?

Set aside everything that is protected health information (PHI) belonging to provider clients, then look for firm-owned operating records: payer-rule libraries, denial-management playbooks, coder QA notes, workflow and ticket histories with patient details removed. If a company has years of those across several systems, it can be screened for an introduction.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Why does platform consolidation put revenue cycle management records at risk?

Consolidation retires platforms. When a billing company is folded into a platform, its claims-scrubbing tool, work queues and client portals are often replaced, and the old ones archived or cancelled. The records that explain how denials were resolved sit in those tools.

RCM firms usually act as business associates of their provider clients, so much of what they process is PHI handled under agreements the firm does not own. HHS guidance on de-identification describes two methods, Expert Determination and Safe Harbor, and says health information de-identified by either method is no longer PHI under the Privacy Rule. In practice, health data offered for licensing generally has to be de-identified under that standard or otherwise authorized. A partner does not make that call.

What is firm-owned and what is BAA-bound?

The SPLIT screen

• Separate PHI: can the company show where PHI lives and that operating records are kept apart?
• Provider contracts: do business associate and services agreements restrict use of derived material?
• Licensable remainder: is there a substantial remainder after PHI is set aside?
• Interval: do the records cover several years, including archived platforms?
• Team: 50+ full-time employees at peak (contractors excluded) and an authorized sponsor?

If most of what the firm holds is PHI with no authorization or de-identification path, park it. The company fit checker gives a preliminary read and the who qualifies page has the full baseline.

When to raise it in the consolidation plan

Other platform moments follow the same pattern; see the screens for 3PL WMS consolidation, cybersecurity services roll-ups and PE-backed franchise platforms.

Illustrative scenario

Illustrative and fictional: a PE-backed platform acquires a mid-sized medical billing firm and plans to move its work queues to the platform's tools within two quarters. In the first 100 days, the integration lead asks the billing firm's operations director three questions: where does PHI live, where do the firm's own appeal templates, payer-rule notes and coder QA sheets live, and who can export each. The answers show PHI concentrated in the claims system, while eight years of playbooks and QA records sit in a shared drive and a ticketing tool. The team preserves those exports separately, leaves PHI to the platform's compliance process, and only then runs the screen.

Questions to ask the add-on's leadership

• Which business associate agreements restrict use of derived material?
• Does the compliance officer have a map of PHI locations?
• Which tools hold the oldest appeal and denial history, and are they scheduled for shutdown?
• Who owns the payer-rule library, and is it authored in-house?
• Has any client asked for deletion at contract end?

Common mistakes in RCM integrations

How does the introduction work?

1. Register as a partner and pass your referral link to the add-on's CEO, or use the referral form.
2. SourceX checks size, history, data breadth and rights.
3. The company's compliance officer and IT lead build an inventory with PHI marked out of scope.
4. De-identification and redaction requirements are agreed with the company before any work begins.
5. Price and terms follow. Buyers review and typically respond within about two weeks once the company is deal-ready.
6. Delivery follows an executed agreement and the company's authorization, then payment to the company.

Partners never export, upload or describe claims, patient or provider records.

What should you say to the CEO?

How do rewards work for sponsors?

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward becomes payable only after the buyer pays and SourceX receives its fee; a lead, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed. Check your firm's policies on fees connected to portfolio companies. Read the program terms and the rewards page.

When is it not worth it?

• Almost everything is PHI and nobody can de-identify or obtain authorization.
• Provider contracts forbid any derived use.
• Platforms were cancelled and nothing was exported.
• The firm is below 50+ full-time employees at peak.
• A previous owner already licensed the same operating records for AI training.

Read the broader buy-and-build sector guide and the operating partner overview. The guide to assessing portfolio data opportunities shows the screen across a portfolio, and the property management roll-up screen covers a similar client-records boundary.

Next step

Run each RCM add-on through the SPLIT screen before its platform cutover. If one passes, register as a partner and make the introduction, or have the CEO apply at sourcex.si/apply.