Can a third-party administrator license its data? A partner's guide to TPAs

Can a third-party administrator license its data?

Usually only part of it. A third-party administrator (TPA) processes claims, benefits and workers' compensation files on behalf of carriers, employers and self-insured plans, so the transactional records mostly belong to those clients and often contain health information. What can remain is the TPA's own operating knowledge: procedures, audit checklists, training material and handling patterns.

This page is for partners who know TPAs through benefits consulting, brokerage, M&A or finance work. It draws the line between records that are likely off limits and material that may belong to the firm. A TPA that clears the line and meets the baseline of 50+ full-time employees at peak (contractors excluded) is worth a screen. Many will not clear it, and saying so early protects your credibility.

What records does a TPA hold, and who owns them?

Why is protected health information the main obstacle?

Many TPA files contain protected health information (PHI). Health data generally has to be de-identified under the HIPAA standard or otherwise authorized before it can be shared. The U.S. Department of Health and Human Services describes two methods, expert determination and the safe harbor removal of specified identifiers, in its guidance on de-identification. Health information de-identified by either method is no longer PHI under the Privacy Rule.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Two practical points for a partner. First, de-identification is the company's and its counsel's job, not yours. Second, even de-identified claim data usually still belongs to the TPA's clients under the administrative services agreement, so client consent is a separate question from privacy law. A TPA whose value is mainly claim files is the pattern described in the guide on industries that are a poor fit.

Which TPAs are worth a conversation?

Use a four-point screen, the TPA split test: Whose data, What remains, Who signs, Where exported.

• Whose data: does the administrative services agreement say who owns work product, procedures and derived analytics?
• What remains: after removing client files, does the TPA still hold years of procedures, audits, training and playbooks in documents it controls?
• Who signs: is there an owner, CEO, CFO or authorized representative who can consider a license?
• Where exported: can someone pull the documents from knowledge bases, shared drives, learning platforms and QA tools?

Stronger candidates tend to be larger administrators of benefits and workers' compensation programs with a mature quality program and an internal training function. Weaker ones are small, focused entirely on claim adjudication, or tied to a single carrier with restrictive contract language.

When can a partner raise it?

Sector context for sponsors is in the guide on buy-and-build sectors.

How does the introduction work?

1. Confirm informally that the TPA owns a body of procedures and training material, without asking to see any of it.
2. Introduce the owner or CFO by referral link or the referral form.
3. SourceX qualifies the firm and flags any client-ownership or PHI problem early.
4. The TPA inventories its systems and what can be exported, using something like the data inventory builder.
5. Price and terms are negotiated, and nothing is binding until the company signs.
6. Buyers review the offering and, once the TPA is deal-ready, typically respond within about two weeks.
7. After an executed agreement and the company's authorization, data is delivered and the TPA is paid. Your reward is paid after SourceX receives its fee.

You never handle or describe confidential records.

What to say to a TPA executive

Compare adjacent industries, such as market research firms with similar consent limits, before deciding where to spend time.

How rewards work

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. Rewards become payable only after the buyer pays and SourceX receives its fee, and no reward is guaranteed. Licensed insurance professionals, including brokers and consultants, should check their own rules on referral fees and disclosure. See the program terms.

When to skip a TPA

• Its value is almost entirely client claim and member files.
• A carrier or plan sponsor controls every document in its contract.
• The firm has fewer than 50 full-time employees at peak.
• Nobody can export the knowledge base or training library.

Next step

Run a TPA you know through the company fit checker. If the firm clearly owns documentation of its own, register as a partner and make the introduction. Owners can also apply at sourcex.si/apply.