Healthcare claims data from a practice, meaning claims, 835 remittances, denials, appeals and prior authorization requests with the payer's decision, is normally shared with an AI developer by the covered entity that owns it, after HIPAA de-identification. A billing company holds it as a business associate and needs each client's permission. Protege and Kinetic Systems have posted jobs to source this data; no price has been published.
- The practice or group (the covered entity) decides; a billing company usually cannot license its clients' records on its own.
- Selling identifiable patient information needs each patient's authorization, so these deals use de-identified data.
- Records that join a request or claim to the payer's decision and the appeal outcome are what buyers describe wanting.
- No closed price for revenue-cycle data has been published; the figures that exist are ceilings and adjacent markets.
Who can license healthcare claims data: the practice or the billing company?
The practice, group or other provider that bills electronically is the covered entity: HIPAA defines a covered entity to include "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter" (45 CFR 160.103). A billing or revenue-cycle company working for it is a business associate: the same definition covers a person who handles protected health information on a covered entity's behalf for functions including "billing, benefit management, practice management, and repricing".
A business associate "may use or disclose protected health information only as permitted or required by its business associate contract or other arrangement" (45 CFR 164.502(a)(3)), and that contract must "Establish the permitted and required uses and disclosures of protected health information by the business associate" (45 CFR 164.504(e)). Most business associate agreements are written for billing work, not for sharing data with third parties. In Origin's view, a billing company should treat its clients' claims as theirs: it can describe its own workflows and anonymous process statistics, and it can introduce clients who want to take part, but the client decides and signs.
| Holder | Usual position on the records | Can it sign alone? |
|---|---|---|
| Physician group or specialty practice | Covered entity; owns its claims, remittances and authorization files | Yes, through its owners or board, subject to HIPAA, Part 2, state law and payer contracts |
| Billing or revenue-cycle (RCM) company | Business associate holding clients' records under each agreement | Usually not; needs each client's written permission |
| Management services organization (MSO) | Usually a business associate of the practices it serves | Usually not; the practices decide |
| Practice that has closed | Records stay with the owner or the custodian named at closing | The owner or its successor, under the custody terms |
This page is general information, not legal advice. It quotes each rule with its source; your privacy officer and a healthcare lawyer decide how the rules apply to your records and contracts.
What do AI buyers want from claims, denials and prior authorizations?
Protege, a data company, posted two roles on October 22, 2026 to source this kind of data. One lists workflows including "Claims, billing, payment, revenue cycle, and denial management" and "Prior authorization, utilization management, and referral operations", and names "RCM companies" among the supply paths; the other is a "Strategic Partnerships Manager - Revenue Cycle Management" (Protege job posts, company claim). Kinetic Systems, a healthcare AI research lab, advertises for a lead to manage "partnerships with health systems, medical groups, specialty practices, data networks, and other organizations" (Kinetic Systems job post, company claim).
What these posts describe is operational history: each request or claim, what the payer decided, and what happened next. A single table of paid claims says little. The same claim joined to its denial reason, the appeal letter, the payer's reply and the final payment shows how the work is actually done.
| Record | What it shows | Where it usually sits |
|---|---|---|
| Claims (837) and claim status | What was billed, to whom and when | Practice management system, clearinghouse |
| Remittances (835) with adjustment codes | What the payer paid, adjusted or denied, and why | Clearinghouse, posting module |
| Denial work queues and appeal letters | How staff worked each denial and the result | Denial tool, document store |
| Prior authorization requests and decisions | What was asked, the clinical support sent, the decision and the turnaround | Authorization tool, payer portals, EHR |
| Eligibility checks and scheduling or intake logs | Coverage found before the visit and how access was managed | Practice management system |
What is revenue-cycle data worth?
No closed price for a practice's claims, denial or prior authorization records has been published. The figures below are the nearest public evidence, each graded. They are ceilings or adjacent markets, not offers.
| Evidence | What it says | Grade |
|---|---|---|
| Tempus AI 8-K (clinical, not billing, records) | A buyer licenses "up to 500,000 de-identified records of patients with Alzheimer's disease and other neurological conditions at $100 for each record delivered" (Abura summary) | Filing, read through a secondary summary; clinical records, a different market |
| Protege and Kinetic Systems sourcing roles | Roles to source administrative, revenue-cycle and provider data (Protege, Kinetic Systems) | Company claim (job posts); demand, no price |
Treat every figure as a ceiling. A buyer sets its price after reviewing a sample, and the volume, years and linkage of your records move it more than any published number.
What does HIPAA allow? Sale of PHI, de-identification and Part 2
Sale of identifiable records. "Except pursuant to and in compliance with § 164.508(a)(4), a covered entity or business associate may not sell protected health information" (45 CFR 164.502(a)(5)(ii)). That section requires "an authorization for any disclosure of protected health information which is a sale of protected health information", and the authorization "must state that the disclosure will result in remuneration to the covered entity" (45 CFR 164.508(a)(4)). The rule lists narrow exceptions, for example research where the only payment is "a reasonable cost-based fee to cover the cost to prepare and transmit" the information; whether any exception fits is a question for counsel. In practice, licensing identifiable claims would need an authorization from every patient, so these deals use de-identified data.
De-identified data. Health information is not individually identifiable when "there is no reasonable basis to believe that the information can be used to identify an individual", and two methods meet the standard (45 CFR 164.514(a)-(b)). Expert Determination: a qualified expert "determines that the risk is very small" of identification and documents the analysis. Safe Harbor: removing 18 kinds of identifiers, including "All elements of dates (except year) for dates directly related to an individual", with no actual knowledge that what is left could identify someone. Safe Harbor strips service, denial and decision dates down to the year, which removes turnaround times, so in Origin's view revenue-cycle data is better suited to Expert Determination. Information de-identified this way "is considered not to be individually identifiable health information" (45 CFR 164.502(d)). See how to de-identify company data.
Substance use disorder records. 42 CFR Part 2 covers records that "Would identify a patient as having or having had a substance use disorder" from programs it applies to (42 CFR 2.12), and those records "may be used or disclosed only as permitted by the regulations in this part" (42 CFR 2.13). Behavioral health and addiction medicine practices, and groups that bill for such programs, should leave these records out unless counsel confirms a route.
State law. HIPAA does not override a state law that "relates to the privacy of individually identifiable health information and is more stringent" (45 CFR 160.203). State medical privacy laws can therefore add limits, and payer contracts can restrict reuse of remittance and authorization data. Counsel should check both before any sample leaves the practice.
This page is general information, not legal advice. It quotes each rule with its source; your privacy officer and a healthcare lawyer decide how the rules apply to your records and contracts.
Records checklist for a practice or billing company
Write these down before a first conversation. No files are needed.
| Item | What to write down |
|---|---|
| Systems | Practice management or EHR (for example athenaOne, eClinicalWorks, NextGen, Epic), clearinghouse, denial and authorization tools; years in each |
| Volume | Claims, remittances, denials, appeals and authorization requests per year |
| Links | Whether each denial, appeal and payer decision stays joined to its claim or request, with dates |
| Specialties and payers | Specialties billed and the main payer types (commercial, Medicare Advantage, Medicaid) |
| Ownership | For billing companies: which clients own which records, and what each business associate agreement allows |
| Exclusions | Substance use disorder records under Part 2, records under payer contracts that bar reuse, open disputes |
What a one-page datasheet looks like (fictional example)
Invented to show the level of detail; it describes no real practice.
| Field | Fictional example |
|---|---|
| Company | Orthopaedic group, 35 physicians, three states |
| Years | Practice management system and clearinghouse, 2016 to 2026 |
| Volume | About 1.9 million claim lines; 140,000 denials with appeal outcomes; 60,000 prior authorization requests with decisions |
| Links | Claim, remittance, denial, appeal and final payment joined by claim number; authorizations joined to the scheduled procedure |
| De-identification | Expert Determination planned; patient and staff identities removed before any sample |
| Signer | Managing partner, after review by the privacy officer and outside counsel |
What happens next: three steps
A first conversation needs no patient data. You can stop after any step.
- Describe your records: answer six questions, with no files and no system access. Origin then checks which records belong to the practice, what each business associate agreement allows and which records, such as Part 2 records, stay out.
- Datasheet and sample: Origin turns your answers into a one-page datasheet like the example above, and you approve a small de-identified sample before anything leaves the company.
- Buyers and license: Origin shows the datasheet to the AI developers and data programs that have asked for revenue-cycle data, with their published terms. You approve scope, use, price and delivery, and sign the license yourself.
- Origin does not charge data owners; a buyer may pay Origin when a deal closes (how Origin is paid).
Patient records and imaging held by the same practice
Practices that also keep longitudinal patient records or imaging studies can read the guide to patient records and imaging data for practices.
Resources for billing and revenue-cycle teams
Guides for the people who work these records every day:
- Denial codes: CARC, RARC and the group codes explained
- Electronic remittance advice: how to read an 835 file
- Prior authorization form: what to include, with a tracking log
- Licensing healthcare operational data: HIPAA basics
- Who owns patient records?
- Health data licensing programs compared
Hold years of claims, denial and prior authorization records? Describe them in six questions, no files needed, and see what your data is worth.
Origin Data Partners works with companies that own data and helps get it bought. We are independent of the services on this page, and a buyer may pay us when a deal closes (how Origin is paid). See what your data is worth.
Common questions
Can a medical billing company sell its clients' claims data to AI companies?
Usually not on its own. A billing company is a business associate and may use or disclose patient information only as its business associate agreement permits. The practice that owns the records decides. A billing company can describe its own workflows and introduce clients who want to take part.
What is healthcare claims data?
The record of what a provider billed and what the payer did with it: the claim (an X12 837), the payment and adjustments (an 835 remittance), denials, appeals and claim status. For AI work, the useful version joins each claim to the payer's decision and the final outcome.
Can de-identified claims and denial data be licensed under HIPAA?
Information de-identified under 45 CFR 164.514(a) and (b) is not individually identifiable health information, so the Privacy Rule's limits on PHI no longer apply to it. For revenue-cycle data, Expert Determination is often the better fit, because Safe Harbor removes all date elements except the year.
Does selling patient data need patient authorization?
Yes, for identifiable data. A covered entity or business associate may not sell protected health information except with an authorization under 45 CFR 164.508(a)(4) that states the disclosure will result in payment to the covered entity, unless a narrow exception applies. That is why deals use de-identified records.
Are substance use disorder records treated differently?
Yes. Records covered by 42 CFR Part 2 may be used or disclosed only as that part permits, which is stricter than HIPAA. Most practices leave them out of any data project.
What prior authorization and denial records are most useful to AI developers?
The ones that keep the whole sequence: the request or claim, the documentation sent, the payer's decision with its reason code, any appeal and the final result, with dates. Buyers' job posts describe wanting real operational work, not static tables.
What is a practice's revenue-cycle data worth?
No closed price has been published. The nearest public figure is Tempus AI's $100 per de-identified clinical record, from a filing read through a secondary summary. That is a ceiling from a different market, not an offer.
What does Origin charge a practice or billing company?
Nothing. Origin does not charge data owners; a buyer may pay Origin when a deal closes. The practice approves every step and signs any license itself.
Sources and further reading
- 45 CFR 164.502(a)(5)(ii): sale of protected health information (HIPAA Privacy Rule)
- 45 CFR 164.508(a)(4): authorization required for a sale of protected health information
- 45 CFR 164.514(a)-(b): de-identification of protected health information (Safe Harbor and Expert Determination)
- 45 CFR 160.103: definitions (business associate, covered entity)
- 45 CFR 164.504(e): business associate contracts
- 45 CFR 160.203: preemption of state law, general rule and exceptions
- 42 CFR 2.12: applicability of 42 CFR Part 2 (confidentiality of substance use disorder patient records)
- 42 CFR 2.13: confidentiality restrictions and safeguards (42 CFR Part 2)
- Protege job board via Ashby's public posting API (Strategic Partnerships Manager roles, posted October 22, 2026)
- Kinetic Systems job board via Ashby's public posting API (Healthcare GTM)
- Abura: A public price for health data (summary of Tempus AI's October 2026 8-K)