Which revenue cycle management records can qualify for data licensing without PHI?

What can an RCM company license if claims data is off the table?

A revenue cycle management company qualifies through the know-how it has built, not through its clients' patient data. Payer-rule libraries, denial taxonomies, appeal templates, SOPs, training curricula and QA frameworks are often the firm's own work and contain no protected health information. A denial taxonomy that maps payer reason codes to root causes, owners and the fix that worked is a good example: it captures years of expert problem-solving without naming a single patient.

AI developers building agents for billing, coding and payer follow-up need that kind of structured expertise. Claims, remittances and patient accounts are a different matter. They are PHI-heavy, and without HIPAA authorization or proper de-identification they are a red flag for a SourceX introduction.

The PHI split: which RCM records sit on which side?

HHS guidance describes two ways to meet the HIPAA de-identification standard: Expert Determination, in which a qualified expert documents that the risk of re-identification is very small, and Safe Harbor, which removes 18 specified identifiers with no actual knowledge that the remaining information could identify someone. Health information de-identified either way is no longer PHI under the Privacy Rule (HHS de-identification guidance). If the firm signed business associate agreements with its provider clients, those agreements also govern what it may do with PHI, including whether it may de-identify it at all.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

Is the payer-rule library really the firm's own?

Often, but check four things before assuming it.

• Who built it. Libraries written by the firm's own staff from public payer policies and experience are the strongest case; employment and contractor agreements confirm ownership.
• For whom. Edits and workflows built under a specific client contract may have been assigned to that client.
• Third-party content. Licensed code sets, vendor rule engines and clearinghouse edit libraries belong to their publishers, even when the firm has annotated them.
• Where the work happened. Teams employed by an offshore vendor, rather than by the firm or its affiliate, can leave ownership with the vendor unless contracts say otherwise.

Which RCM companies meet the baseline?

SourceX looks for US companies with 50+ full-time employees at peak (contractors excluded), several years of documented operations, rights to license their own records and an authorized sponsor. Staff employed by a separate offshore vendor do not count; full-time staff of the company itself do. Operating, acquired and wound-down firms can all qualify if the records still exist. The who qualifies page and the overview of which companies qualify for data licensing set out the baseline in more detail.

Sub-segments and how they tend to screen:

• Physician and specialty billing companies: deep payer-rule and denial knowledge across many practices.
• Hospital RCM outsourcers: A/R follow-up, denial management and early-out workflows with mature SOPs.
• Coding companies: QA rubrics, coder training and audit methods, while chart-level work stays excluded.
• Prior authorization and eligibility services: payer requirement libraries and workflow scripts.
• Credentialing and enrollment firms: provider enrollment workflows, which involve provider rather than patient data but still need contract review.
• Behavioral health and substance use billing: extra-sensitive categories with stricter handling, so a narrower scope at best.

A quick screen before you introduce:

• The firm can name the non-PHI assets it owns: rule libraries, taxonomies, templates, SOPs, training
• Those assets live in systems or document stores separate from patient accounts
• Business associate agreements and client contracts are available for counsel to review
• Nobody expects claims data to be licensed in identifiable form
• The firm has not already licensed the same material for AI training
• An owner, CEO, CFO or authorized representative will lead

Who can introduce an RCM company?

RCM founders and executives talk regularly with healthcare services M&A advisors, PE sponsors consolidating billing and RCM businesses (see buy-and-build sectors for where data licensing fits across add-ons), fractional CFOs and CPA advisory partners, RCM software implementers and healthcare compliance consultants. Licensed professionals should check their own rules on referral fees and disclosure before accepting any reward.

1. Confirm in conversation that the firm has substantial non-PHI assets and meets the size baseline, or run the company fit checker for a preliminary, non-binding read.
2. Submit the company through the referral form, or share your referral link so the CEO can apply directly.
3. SourceX qualifies the firm, paying particular attention to PHI separation and client contracts.
4. The firm inventories its document stores, training platforms, rule libraries and workflow systems, with dates and export options.
5. Price and terms are agreed with the firm before AI labs and data buyers review.
6. Once a license is signed, material is prepared under agreed de-identification rules, delivered, and the firm is paid.

You never see a claim, a remittance or a patient account at any stage.

What to say to an RCM company's CEO

The briefs on title and escrow companies and third-party administrators show how other regulated businesses separate process records from personal data.

When to pass on an RCM referral

• The archive is mostly claims and patient accounts, with no de-identification plan
• Client contracts prohibit any secondary use of work product
• The same material has already been licensed for AI training
• The firm never reached 50+ full-time employees at peak
• Nobody can export the rule library, SOPs or training content

Next step

When an RCM founder can point to a real library of payer rules, denial playbooks and training, register as a partner and introduce the company, or send the CEO to sourcex.si/apply with your referral link.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company; rewards are paid only after the buyer pays and SourceX receives its fee, and no reward is guaranteed. The partner's share is carved from SourceX's fee, leaving the RCM company's payment intact.