# Who can license lab correction records? | SourceX

Canonical: https://refer.sourcex.si/questions/who-can-license-lab-result-correction-histories-records
Last updated: 2026-10-19

Introduce the CEO (in an owner-run lab, usually the owner), with the laboratory director as sponsor and general counsel or the contracts lead at the table. The laboratory director owns the review and amendment procedure and knows which years are complete, so they are the right first conversation, but they rarely decide whether company records may be licensed. The quality manager and LIMS administrator have knowledge and access, not authority. Whether client results, or patient data in a clinical lab, can be part of any discussion stays open until counsel and SourceX's rights review settle it.

This decision tree belongs to the [lab result correction histories guide](/guides/workflow-lab-result-correction-histories). Its job is narrower: for one laboratory, work out who can say yes to a conversation about its correction records, and which records need someone else's permission first.

## Who touches correction records, and who can commit them

A single correction passes through several hands. Most of them can open the records; few can decide what happens to them.

| Role | What they can confirm | Can they authorize a licensing discussion? |
|---|---|---|
| Analyst or reviewer | How a specific correction was found and documented | No |
| LIMS administrator or IT lead | Systems, years of data, migration scope, legacy access end date | No: technical access only |
| Quality manager | Nonconformance, CAPA and accreditation records; audit findings | No, but knows which records are the lab's own |
| Laboratory director | How corrections are reviewed, approved and amended; which years are complete | Sponsors and convenes; usually not alone |
| General counsel or contracts lead | Client agreements, confidentiality terms, who owns results | Sets limits; approval sits with the CEO |
| CEO (often the owner) | Whether to open a licensing discussion at all | Yes; authorizes and signs |

The audit trail is a good example of why access is not authority. Part 11 expects time-stamped trails in which a change does not obscure what was recorded before, so the administrator can see every old and new value. Seeing them does not make those values the administrator's, or even the lab's, to license.

## The yes path: six questions in order

Walk these in sequence. The introduction is the first person who can honestly answer yes to question 4, with counsel aware by question 5.

1. **Does this person run a system?** If yes, they can say what it holds and for how long. Ask who owns the correction procedure.
2. **Does this person own review and amendment?** That is usually the laboratory director. Ask them to sponsor the conversation and to bring in the CEO.
3. **Is the lab clinical, or environmental, materials or industrial?** The answer changes the branch. Clinical labs hold patient information; contract testing labs usually face client confidentiality instead.
4. **Can this person commit company records to an agreement?** If yes, this is the introduction: the CEO, who in an owner-run lab is usually the owner.
5. **Is counsel involved?** If not, suggest the sponsor brings general counsel or the contracts lead to the first call, because client terms decide scope.
6. **For contract testing: who owns the results?** Test results normally go to the client who paid for the work. Counsel reads the agreements; the partner only flags that they exist.

The usual mistake is stopping at question 2. The laboratory director is the right sponsor and, in most labs, the wrong signer.

## Records that need client, legal or privacy sign-off

Some correction records sit behind someone else's permission. Name the branch and leave the decision to the people who own it.

| Record class | Why it needs review | Who decides | Likely outcome |
|---|---|---|---|
| Client test results, original and amended | Usually delivered to and owned by the client | Counsel, against client agreements | Excluded, aggregated or with client consent |
| Clinical results and reports | Patient information | Compliance and counsel | De-identified by Expert Determination or Safe Harbor, or excluded |
| Reviewer comments and audit trails | Lab's own work, but may quote client values | CEO, with counsel | Often in scope with client details removed |
| Nonconformance and CAPA records | Usually the lab's own quality records | Executive | Often the strongest candidate |
| SOP revisions and interface validation | Internal know-how | Executive | Often in scope |

Any licensed version of patient-level material would need de-identification under one of HIPAA's two methods, Expert Determination or Safe Harbor. Retention also shapes what exists: CLIA requires original, preliminary and corrected reports to be kept or retrievable for at least two years, ten for pathology, so older clinical report versions may only survive where the lab kept them longer. [Why data rights matter](/proof/why-data-rights-matter) sets out the general principle, and the [testing laboratory data licensing page](/industries/testing-laboratory-data-licensing) explains how labs split their own records from client results.

## A contract testing lab and a clinical lab: two paths (Illustrative)

Two fictional laboratories show how the same tree gives different answers. Neither describes a real organization or deal.

| Question on the tree | 280-person environmental testing lab | 450-person clinical reference lab |
|---|---|---|
| Who describes the records? | Laboratory director and quality manager | Laboratory director and compliance officer |
| Who sponsors? | Laboratory director | Laboratory director |
| Whose data is it? | Clients own results; the lab owns reviews, NCs and SOPs | Patient results under privacy law; the lab owns quality records |
| Who signs? | CEO | CEO, with the COO preparing the case |
| Extra review | Counsel against client agreements | Compliance on de-identification; counsel on payer and provider contracts |
| Likely starting scope | Nonconformance, CAPA and SOP history | Quality records first; de-identified corrections only after review |

The environmental path is shorter because no patient data is involved. The clinical path is longer, not closed. If the lab is part of a consultancy or being acquired, authority may sit with a parent or buyer; [environmental consulting firm acquisition](/guides/environmental-consulting-firm-acquisition) covers that situation. If the executive asks who would ultimately use the data, [what an AI lab is](/questions/what-is-an-ai-lab) is a plain explainer.

## What remains open until SourceX's rights review

When the right executive agrees to talk, be clear that these questions remain unanswered:

- **Scope:** which of the five record classes in the table above survive counsel's reading of client agreements.
- **Privacy method:** for a clinical lab, Expert Determination or Safe Harbor, and what each would strip out.
- **Interest:** whether anyone wants this kind of history once SourceX has looked.
- **Offer:** whether one is made at all, and on what terms.

The lab needs 50+ full-time employees at peak (contractors excluded), documented operating history, rights to license and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English. Partners sign the Channel Partner Agreement before submitting introductions; the first valid introduction within the 90-day window is credited when the company submits a verified application, and one partner is credited per company. The [worked copper unit case](/guides/lab-result-correction-histories-exception-examples) helps the sponsor explain what a complete correction looks like, and the [referral brief template](/resources/lab-result-correction-histories-referral-brief-template) puts the answers on one page.

## Next step

> **Refer a company. Earn up to $100,000.** Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

Once the laboratory director has named the executive who can say yes and counsel knows about the conversation, [register as a partner](/register), check the lab against [who qualifies](/who-qualifies) and read the [program terms](/terms) before you make the introduction.

## Sources

- https://refer.sourcex.si/terms
- https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html
- https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-493/subpart-J/section-493.1105
- https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11/subpart-B/section-11.10