Can a Billing Company Sell Prior Authorization Data?

Can a medical billing company sell data?

Not patient data. A billing or revenue-cycle company that handles claims for a practice is a HIPAA business associate, may use protected health information only as its business associate agreement permits, and may not sell it. A billing company can sometimes license de-identified case data, with its client's permission, and its own non-patient work product.

This page is general information, not legal advice: it states what each rule or contract says, with its source, and your counsel decides how it applies to your company.

HIPAA's definition of a business associate covers functions done for a covered entity including "utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing" (45 CFR 160.103). The same section lists "A health care clearinghouse" as a covered entity, and its clearinghouse definition can include "a billing service" that converts claims into standard transactions.

Practices that want to license clinical records should read licensing patient records; insurers and claims administrators should read selling insurance claims data. This page covers the billing and prior authorization layer between them.

What prior authorization and denial data is, and why outcomes matter for AI

Prior authorization is the payer's approval before a service or drug is given. A complete case holds the request, the clinical documentation sent, the payer's decision with its reason, and any appeal and its result. Cases that end in a known outcome teach a model which submissions succeed and which denials are reversed.

The outcomes are lopsided, which is why they matter. KFF reports that in 2024 Medicare Advantage insurers "fully or partially denied 4.1 million prior authorization requests"; "Just 11.5% of denied prior authorization requests were appealed", and "most appeals (80.7%) were partially or fully overturned" (KFF).

HIPAA: what a business associate agreement allows, and the sale ban

Three HIPAA rules decide what a billing company can do. It may use PHI only as its agreement permits; nobody covered by HIPAA may sell PHI without authorization; and de-identified data is outside the rule. Read your business associate agreements first, because they decide whether you may de-identify at all.

Safe Harbor de-identification removes a listed set of identifiers and also requires that the entity "does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual" (45 CFR 164.514). Rare diagnoses, small payers and exact dates can identify a patient. See anonymization vs pseudonymization.

Who owns claims data: the practice, the billing company, the clearinghouse or the payer?

For HIPAA purposes the covered entity, the practice or hospital, controls its patients' information, and the billing company holds it under a business associate agreement. Payers keep their own copy of every request and decision. A clearinghouse is itself a covered entity with its own HIPAA duties and its own customer contracts.

• Practice or hospital. Owns the relationship with the patient and decides, through the business associate agreement, what its billing vendor may do with the data. Its permission is the starting point.
• Billing or revenue-cycle company. Holds the data to do the work. Its own procedures, payer rule libraries, appeal templates and workflow metrics are its work product, as long as they hold no PHI and its client contracts do not claim them.
• Clearinghouse. A covered entity in its own right under 45 CFR 160.103; read its provider and payer agreements for data-use terms.
• Payer. Provider participation agreements may include confidentiality terms on fee schedules and policies; check them before licensing anything built from them.

What the CMS prior authorization rule changes about data

The CMS Interoperability and Prior Authorization final rule (CMS-0057-F) makes payers give a specific reason for every denial, decide faster, post aggregate metrics, and from 2027 run a Prior Authorization API. It applies to Medicare Advantage, Medicaid and CHIP programs and plans, and QHP issuers on the federal exchanges.

The public metrics do not replace case-level data. KFF found that "the aggregated approval statistics do not allow for further analysis into which services are being denied" (KFF). Structured denial reasons will make future case histories cleaner, which makes the cases a billing firm already holds more useful, not less.

Is there a market for a prior authorization dataset?

Demand exists, but the public evidence is thin. The one intermediary we found offering this data to AI teams lists workflow procedures, not patient case records, and we found no published price or closed sale for prior authorization or denial records. The table states what each source is.

The program ranges cover all of a company's records, not prior authorization data. None of the rows above is a closed deal for this data type.

What a billing company could license, and how to prepare

Two things are realistic: de-identified case histories with decision and outcome, licensed with each client's written permission, and payer policy mappings and appeal playbooks the company authored itself. Patient-level records in identifiable form are off the table.

• Read every business associate agreement. Note whether it permits de-identification and any use of de-identified data; if silent or prohibited, you need an amendment from the client.
• Separate your own work product (payer rule libraries, appeal templates, SOPs, turnaround metrics) from client data.
• Choose a method: Safe Harbor or Expert Determination. Outcome data with dates and rare services needs particular care; your counsel and the expert decide.
• Keep the chain intact: request, decision, reason, appeal, outcome, linked by a code that you never disclose.
• Check clearinghouse and payer contract terms for confidentiality of fee schedules and policies.
• Read licensing healthcare operational data for records with little or no PHI.

Next step

Start with your own work product and one client whose agreement allows de-identification. Count closed cases with a recorded outcome by payer and service type. For contract terms, read what a data licensing agreement should include.

Does your company hold records like these? See what your data is worth.

Origin Data Partners works with companies that own data and helps get it bought. We are independent of the services on this page, and a buyer may pay us when a deal closes (how Origin is paid). See what your data is worth.