This decision tree belongs to the prior authorization follow-up guide, which covers what to inventory before a platform change. Here the question is narrower: once you know the records exist, who is allowed to say yes to talking about them?
Access is not authority: the people who touch these records
Five groups handle authorization history every day. Only one of them normally decides what happens to company data.
| Person | What they can tell you | Can they open a licensing discussion? |
|---|---|---|
| Authorization specialists and team lead | How pends are worked; which notes and versions are kept | No |
| Work queue or platform administrator | What the system stores, how far back, what exports exist | No |
| Revenue cycle director | Volumes, years covered, migration plan, payer mix | Sponsor; rarely the final word |
| Privacy officer or general counsel | Business associate agreements, payer contract limits, HIPAA obligations | Sets the limits; must be involved |
| CEO | Whether the company licenses its data at all | Yes; authorizes and signs |
The administrator's login is the trap. Someone who can pull every submission version is still not the person who can commit the company to a discussion about licensing them.
Branch one: is the company a provider or a billing vendor?
Ask this first, because it changes whose permission matters.
Provider group running its own authorizations. The group is the covered entity. Its records belong to it, subject to HIPAA and its payer contracts. The decision path is short: director, privacy officer, CEO.
Revenue cycle or billing company working authorizations for providers. The company usually handles the data as a business associate. HHS guidance is direct on this point: a business associate may use or disclose protected health information only as permitted or required by its business associate contract or as required by law. So the agreements with each provider client become a review item before any provider-derived record could be discussed. Medical billing company data explains this split in more depth.
Either way, write down the answer and the number of provider agreements involved. Do not ask to read the agreements; that is counsel's job.
Branch two: protected health information or the company's own material?
As they stand, authorization records name patients, services and diagnoses, so they are protected health information. Any licensed version would need to meet HIPAA's de-identification standard by one of two methods, Expert Determination or Safe Harbor; Safe Harbor vs Expert Determination compares them.
Some material in the same workflow carries no patient data at all, and its path is simpler:
- payer requirement logs that track what each payer asks for and when it changed
- pend-reason taxonomies and the team's work instructions
- aggregate counts of pends, resubmissions and turnaround by payer
Electronic requests and responses travel in the HIPAA standard transaction for prior authorization, ASC X12N 278 Version 5010, so a clearinghouse may hold transaction logs under its own contract. Those logs are a third branch: the clearinghouse agreement decides access, not the company's executives alone.
The tree, question by question
Walk through these with the revenue cycle director in one call. Record the answers, not documents.
- Provider or vendor? If vendor, note how many provider agreements cover the records.
- Which record classes are in scope? PHI-bearing records (versions, attachments, pend messages, statuses) or company-authored material (requirement logs, taxonomies, instructions)?
- Who holds copies outside the company? Clearinghouse logs and payer portals sit under third-party terms.
- Who signs contracts about company data? The CEO. That person is the introduction. If the sponsor is still unclear, the internal sponsor guide helps find one.
- Is the privacy officer aware? They will be involved anyway; involving them early avoids a stalled conversation later.
- Is authority about to move? A sale, a private equity recapitalization or a change of control can shift decisions to a board or buyer.
Two paths through the same tree (Illustrative)
Two fictional companies, written for this page.
| Question | 280-person orthopedic provider group | 610-person revenue cycle company |
|---|---|---|
| Role | Covered entity | Business associate to about 40 provider groups |
| Records in scope | Own authorization history and requirement log | Authorization history for clients; its own requirement log and taxonomy |
| Outside copies | Clearinghouse 278 logs | Clearinghouse logs; several client portals |
| Person introduced | CEO | CEO, with the revenue cycle director as sponsor |
| Extra review | De-identification method; payer portal terms | Every relevant business associate agreement, de-identification, portal terms |
| Cleanest starting point | Requirement log and taxonomy | Requirement log and taxonomy |
Same workflow, different trees. The provider group's path runs through one privacy officer. The billing company's path runs through dozens of client agreements, which is why its own non-PHI material is often the realistic place to start.
What stays unknown until SourceX's rights review
The partner's job ends at a named executive and a list of branches. SourceX's rights review decides which records the company can license, what de-identification is required, and whether any provider or third-party consent is needed. Buyer interest in this record type and any offer also stay open until then. SourceX licenses approved business data directly from companies for AI training and evaluation, and manages the agreement, rights review, data preparation, delivery and payout. Some companies cannot license at all; which companies cannot license their data lists the common reasons, and rights-cleared data explains what clearance means.
For SourceX, an introduced company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English. Partners sign the Channel Partner Agreement before submitting introductions, and the first valid introduction within the 90-day window is credited when the company submits a verified application. Once the executive is named, the referral brief template puts that name and the open branches into a one-page note.
Next step
Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
When the tree ends at a named executive and the privacy officer knows the conversation is coming, register as a partner, check the company on who qualifies and read the program terms before you introduce the executive, with the revenue cycle director as sponsor.