Does the Anti-Kickback Statute apply to healthcare data referrals?
Usually not, but it depends on the facts. The federal Anti-Kickback Statute targets payments that induce or reward referrals of items or services paid for by federal health care programs. Introducing a healthcare administration company to license non-PHI operational records is a commercial data license, not that kind of referral, though compliance teams will still check.
The short answer
The federal Anti-Kickback Statute is aimed at money that changes hands to generate federal health care program business. An introduction that lets a healthcare administration company license its own non-PHI operational records to AI developers is a commercial data license, not a referral of patients or of federally reimbursed services, so in the usual case the statute is not the rule that governs it.
The facts still decide. Who you are, what else you refer, who pays you and what the dataset contains can all change the answer. Healthcare clients' compliance teams will ask about it, so it pays to walk in with the analysis already done.
What the statute is aimed at
In plain terms, the federal Anti-Kickback Statute (42 U.S.C. 1320a-7b(b)) makes it a crime to knowingly and willfully offer, pay, solicit or receive anything of value to induce or reward referrals of items or services reimbursable by federal health care programs such as Medicare and Medicaid. Regulatory safe harbors protect some arrangements that meet their conditions. Read the statute and the HHS Office of Inspector General's current guidance directly, because this page does not reproduce them.
States add their own layer. Many have anti-kickback, fee-splitting or patient-brokering laws, and some apply whoever the payer is. Rules vary by state; check with healthcare counsel where the company operates.
Two features drive most of the federal analysis: what is being referred, and whether federal program business sits anywhere in the chain of payments.
The payer-path test for a data licensing introduction
Work through four questions. If every answer points away from federal program business, the statute is unlikely to be the controlling rule. If any answer points toward it, stop and get advice before going further.
| Question | Typical data licensing introduction | Stop and ask counsel when |
|---|---|---|
| 1. What is being referred? | A company, so it can license its own operational records | You also refer patients, orders or provider business |
| 2. Who pays you? | SourceX, from the platform fee it collects | A provider, supplier or anyone billing federal programs pays you |
| 3. Does anything get billed to a federal program because of the introduction? | No; license proceeds come from AI labs and data buyers | The introduction could steer care, orders or referrals |
| 4. Does the dataset include PHI? | No; non-PHI administrative records such as SOPs, tickets and workflow logs | Claims, medical records or patient-level data are in scope |
How it applies in common partner situations
| Situation | What to check | Typical outcome to confirm |
|---|---|---|
| A revenue cycle consultant introduces a medical billing company's back office | Whether you sell services the client bills to federal programs; whether any PHI is in scope | Commonly treated as a commercial introduction; confirm with the client's compliance officer |
| A managed service provider introduces a healthcare administration client | Compensation terms in your existing contract; the client's vendor conflict policy | Disclose to the client and log it in its vendor file |
| A physician or clinical leader introduces a company they refer patients to | Any link between the reward and patient referrals | Highest scrutiny; get healthcare counsel before anything else |
| The partner works for a hospital or health system | Employer conflict and gift policies, plus state law | Usually an employer-policy question first |
| The company's most useful records are claims or medical records | De-identification or HIPAA authorization | Not ready until that is resolved |
To pre-screen a healthcare administration business before raising the subject, use the healthcare administration data referral screening worksheet.
What a client's compliance team will ask
Expect four questions, and answer each from the facts.
Who pays the partner, and when? SourceX pays from its own fee. Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, and rewards become payable only after the buyer pays and SourceX receives its fee. The reward is never deducted from what the company receives, and no reward is guaranteed.
Does the partner see our data? No. Partners make the introduction and give basic fit facts only; they never export, upload or describe records. De-identification and redaction requirements are agreed with the company before any work begins.
Is PHI involved? It should not be unless it is properly handled. HHS guidance on de-identifying protected health information describes two methods, Expert Determination and Safe Harbor, and health information de-identified under either is no longer PHI under the Privacy Rule. Business associate agreements with provider clients may also limit what the company can do with health information it handles.
Do our own promises allow this? FTC staff have written that promises not to use customer data for undisclosed purposes, such as training models, are enforceable wherever they are made, from privacy policies to terms of service. That post is staff guidance, not a rule, but it is a good reason to read the company's commitments before anything is licensed.
A disclosure line for the compliance file:
Questions to put to healthcare counsel
- Does any part of my relationship with this company involve federal health care program business?
- Do the state's anti-kickback, fee-splitting or patient-brokering laws apply regardless of payer?
- Does my employer, contract or professional body restrict outside referral compensation?
- Is any PHI in scope, and does the company's de-identification approach meet the HIPAA standard?
- Do the company's business associate agreements or privacy commitments restrict licensing?
Record the client's consent and your disclosure using how to document client consent before an introduction, and if the client asks you to waive or credit the reward, read passing a referral fee through to a client.
This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.
Next step
Check the company against who qualifies, or run the company fit checker for a preliminary, non-binding screen. When counsel is comfortable, register as a partner; the program terms set out attribution and payment.
- Step 1Share your linkSend your personal link to a company you know.
- Step 2Company appliesThe company applies itself at /apply.
- Step 3Buyer selects and paysThe buyer selects and pays for the data and SourceX receives its fee.
- Step 4You get your rewardYour share of SourceX fees becomes payable.
Common questions
Does the Anti-Kickback Statute only apply to doctors and hospitals?
No. It can reach anyone on either side of a payment, including consultants, vendors and marketers, when the payment is meant to induce or reward referrals of federally reimbursed items or services. What limits it is that link to federal health care program business, not the payer's job title. Ask healthcare counsel if your work touches such referrals.
Is any referral fee for a non-healthcare service a kickback?
Not in the statute's sense. Everyday speech calls many undisclosed payments kickbacks, but the federal statute concerns referrals tied to federal health care programs. Referral fees in other settings are governed by contract, professional ethics rules and, in some states, commercial bribery or fee-splitting laws, which is why disclosure to the client matters regardless of industry.
Can a healthcare administration company license its records at all?
Often, if the records are administrative rather than patient-level: procedures, support tickets, scheduling workflows, vendor management and internal communications. It also has to clear the general bar: 50+ full-time employees at peak (contractors excluded), a multi-year operating history on record, clear rights to the material and an owner or officer prepared to sponsor it. Records that are mainly PHI need HIPAA de-identification or authorization first.
What if I already bill the company as its consultant?
Tell the client about the possible reward in writing and check your consulting contract for terms on outside compensation. The reward comes from SourceX's fee, not from the company, but the client's compliance team may still want it recorded in its vendor conflict register. Never let the reward influence advice you give under your engagement.
Do state laws change the answer?
They can. Several states have their own anti-kickback, fee-splitting or patient-brokering statutes, and some apply whether or not a government program pays. The same introduction can be analyzed differently depending on where the company and the partner are located, so ask counsel familiar with the relevant state before you make it.
Related pages
Free resources
- Cash conversion cycle calculator — DIO, DSO, DPO and the cash conversion cycle.
- Operational data inventory builder — List systems, record types, years held and owners.
- AI readiness assessment — Ten questions, five dimensions, a score out of 100.
- All free tools · MCP resource center
By SourceX Partnerships Team · Published 2026-10-09 · Updated 2026-10-09
Know a US company with valuable proprietary data?
Become a referral partner from anywhere we support, get your link and introduce an owner or authorized decision-maker.
Refer a company →I own a business
Explore licensing your company's data to AI developers worldwide. Start a short assessment; no uploads needed.
Start an assessment