# Can a Billing Company Sell Prior Authorization Data?

> Who owns claims and prior authorization data, what HIPAA allows a billing company, what the CMS rule changes, and what can be licensed to AI.

Canonical: https://origindatapartners.com/guides/license-prior-authorization-denial-data-ai
By: Origin Data Partners
Status: Published
Published: 2026-11-13
Updated: 2026-11-13
Sources checked: 2026-11-12

## Quick answer

A medical billing company cannot sell patients' prior authorization or denial records: it is a HIPAA business associate, may use the data only as its business associate agreement allows, and HIPAA bars selling protected health information without patient authorization. What may be licensable, with the client's permission, is properly de-identified case history (request, payer decision, denial reason, appeal outcome) and payer-policy mappings the company wrote itself. We found no published sale or price for such records.

## Key points

- The practice or hospital (the covered entity) controls patient data; the billing company holds it as a business associate.
- HIPAA bars covered entities and business associates from selling PHI without authorization.
- De-identified data is outside HIPAA, but a business associate may only de-identify if its agreement allows.
- Case histories with the payer's decision and the appeal outcome are the scarce part; public payer metrics are aggregate.

## Can a medical billing company sell data?

Not patient data. A billing or revenue-cycle company that handles claims for a practice is a HIPAA business associate, may use protected health information only as its business associate agreement permits, and may not sell it. A billing company can sometimes license de-identified case data, with its client's permission, and its own non-patient work product.

This page is general information, not legal advice: it states what each rule or contract says, with its source, and your counsel decides how it applies to your company.

HIPAA's definition of a business associate covers functions done for a covered entity including "utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing" ([45 CFR 160.103](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103)). The same section lists "A health care clearinghouse" as a covered entity, and its clearinghouse definition can include "a billing service" that converts claims into standard transactions.

Practices that want to license clinical records should read [licensing patient records](https://origindatapartners.com/guides/license-patient-records-ai-training); insurers and claims administrators should read [selling insurance claims data](https://origindatapartners.com/guides/sell-insurance-claims-data-ai). This page covers the billing and prior authorization layer between them.


## What prior authorization and denial data is, and why outcomes matter for AI

Prior authorization is the payer's approval before a service or drug is given. A complete case holds the request, the clinical documentation sent, the payer's decision with its reason, and any appeal and its result. Cases that end in a known outcome teach a model which submissions succeed and which denials are reversed.

| Part of a case | What it holds | Why it matters |
| --- | --- | --- |
| Request | Service or drug, codes, payer, plan, documentation sent | The input a model learns to prepare |
| Payer decision | Approved, denied, partially approved, or more information requested | The label |
| Denial reason | The payer's stated reason | Explains the decision |
| Appeal | What was resubmitted and argued | The correction |
| Final outcome | Upheld or overturned, and when | Shows whether the first decision stood |

The outcomes are lopsided, which is why they matter. KFF reports that in 2024 Medicare Advantage insurers "fully or partially denied 4.1 million prior authorization requests"; "Just 11.5% of denied prior authorization requests were appealed", and "most appeals (80.7%) were partially or fully overturned" ([KFF](https://www.kff.org/medicare/medicare-advantage-insurers-made-nearly-53-million-prior-authorization-determinations-in-2024/)).


## HIPAA: what a business associate agreement allows, and the sale ban

Three HIPAA rules decide what a billing company can do. It may use PHI only as its agreement permits; nobody covered by HIPAA may sell PHI without authorization; and de-identified data is outside the rule. Read your business associate agreements first, because they decide whether you may de-identify at all.

| Rule | What it says |
| --- | --- |
| [45 CFR 164.502(a)(3)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) | "A business associate may use or disclose protected health information only as permitted or required by its business associate contract or other arrangement". |
| [45 CFR 164.504(e)(2)(i)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504) | The contract must "Establish the permitted and required uses and disclosures of protected health information by the business associate." |
| [45 CFR 164.502(a)(5)(ii)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) | "A covered entity or business associate may not sell protected health information" except with authorization. A sale is a disclosure where the entity "directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information". |
| [45 CFR 164.502(d)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) | A covered entity may create de-identified information or disclose PHI "only to a business associate for such purpose". Information meeting 164.514(a) and (b) "is considered not to be individually identifiable health information, i.e., de-identified". |
| [HHS de-identification guidance](https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html) | "The Privacy Rule does not limit how a covered entity may disclose information that has been de-identified." But disclosing a re-identification code "is also considered a disclosure of PHI". |

Safe Harbor de-identification removes a listed set of identifiers and also requires that the entity "does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual" ([45 CFR 164.514](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514)). Rare diagnoses, small payers and exact dates can identify a patient. See [anonymization vs pseudonymization](https://origindatapartners.com/guides/anonymization-vs-pseudonymization).


## Who owns claims data: the practice, the billing company, the clearinghouse or the payer?

For HIPAA purposes the covered entity, the practice or hospital, controls its patients' information, and the billing company holds it under a business associate agreement. Payers keep their own copy of every request and decision. A clearinghouse is itself a covered entity with its own HIPAA duties and its own customer contracts.

- Practice or hospital. Owns the relationship with the patient and decides, through the business associate agreement, what its billing vendor may do with the data. Its permission is the starting point.
- Billing or revenue-cycle company. Holds the data to do the work. Its own procedures, payer rule libraries, appeal templates and workflow metrics are its work product, as long as they hold no PHI and its client contracts do not claim them.
- Clearinghouse. A covered entity in its own right under 45 CFR 160.103; read its provider and payer agreements for data-use terms.
- Payer. Provider participation agreements may include confidentiality terms on fee schedules and policies; check them before licensing anything built from them.


## What the CMS prior authorization rule changes about data

The CMS Interoperability and Prior Authorization final rule (CMS-0057-F) makes payers give a specific reason for every denial, decide faster, post aggregate metrics, and from 2027 run a Prior Authorization API. It applies to Medicare Advantage, Medicaid and CHIP programs and plans, and QHP issuers on the federal exchanges.

| Requirement | From | What it says |
| --- | --- | --- |
| Specific denial reason | 2026 | Payers "must provide a specific reason for denied prior authorization" decisions ([CMS](https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-and-prior-authorization-final-rule-cms-0057-f)) |
| Decision timeframes | 2026 | "Within 72 hours for expedited (i.e., urgent) requests and seven calendar days for standard (i.e., non-urgent) requests" |
| Public metrics | First report by March 31, 2026 | Payers "publicly report certain prior authorization metrics annually by posting them on their website" |
| Prior Authorization API | January 1, 2027 | The API must say whether the payer approves, "denies the prior authorization request (and a specific reason for the denial), or requests more information" |

The public metrics do not replace case-level data. KFF found that "the aggregated approval statistics do not allow for further analysis into which services are being denied" ([KFF](https://www.kff.org/patient-consumer-protections/prior-authorization-metrics-provide-new-insights-into-insurer-practices-but-gaps-remain/)). Structured denial reasons will make future case histories cleaner, which makes the cases a billing firm already holds more useful, not less.


## Is there a market for a prior authorization dataset?

Demand exists, but the public evidence is thin. The one intermediary we found offering this data to AI teams lists workflow procedures, not patient case records, and we found no published price or closed sale for prior authorization or denial records. The table states what each source is.

| Evidence | Source type | What it says |
| --- | --- | --- |
| DataPaid healthcare data for AI teams | Intermediary's own claim | Offers "revenue cycle SOPs, prior authorization workflows, denials management, scheduling and intake processes and coding guidelines, with personal information removed where relevant"; prior authorization workflows are "Payer requirements, submission steps, follow-up rules" and denials records are "Denial reasons, appeal templates, root-cause reviews" ([DataPaid](https://datapaid.ai/for-ai-teams/healthcare-data/)). No price published. |
| SamaCare | News site article marked as generated | Reports SamaCare's AI is trained on "2M+ cases" and that a revenue source "is the sale of de-identified data insights" to drug makers ([AInvest](https://www.ainvest.com/news/samacare-data-moat-targets-pharma-prior-authorization-bottleneck-watch-data-sales-scale-2027-fhir-deadline-looming-2603/)). Not confirmed by a filing. |
| micro1 Company Data Partnerships | Published program range, all company records | Payments "typically ranging from $100K to over $3M" ([micro1](https://company.micro1.ai/register/?referralCode=24823479-4339-4311-a157-2600b8cf72cf&utm_source=referral&utm_medium=share&utm_campaign=job_referral)) |
| Handshake AI data partnerships | Published program range, stated as an estimate | "$100K to $4M+ payouts", "an indicative estimate only and is not an offer" ([Handshake AI](https://joinhandshake.com/ai/data-partnerships/license/)) |

The program ranges cover all of a company's records, not prior authorization data. None of the rows above is a closed deal for this data type.


## What a billing company could license, and how to prepare

Two things are realistic: de-identified case histories with decision and outcome, licensed with each client's written permission, and payer policy mappings and appeal playbooks the company authored itself. Patient-level records in identifiable form are off the table.

- Read every business associate agreement. Note whether it permits de-identification and any use of de-identified data; if silent or prohibited, you need an amendment from the client.
- Separate your own work product (payer rule libraries, appeal templates, SOPs, turnaround metrics) from client data.
- Choose a method: Safe Harbor or Expert Determination. Outcome data with dates and rare services needs particular care; your counsel and the expert decide.
- Keep the chain intact: request, decision, reason, appeal, outcome, linked by a code that you never disclose.
- Check clearinghouse and payer contract terms for confidentiality of fee schedules and policies.
- Read [licensing healthcare operational data](https://origindatapartners.com/guides/license-healthcare-operational-data) for records with little or no PHI.


## Next step

Start with your own work product and one client whose agreement allows de-identification. Count closed cases with a recorded outcome by payer and service type. For contract terms, read [what a data licensing agreement should include](https://origindatapartners.com/guides/data-licensing-agreement).

Does your company hold records like these? [See what your data is worth](https://origindatapartners.com/check-fit).

Origin Data Partners works with companies that own data and helps get it bought. We are independent of the services on this page, and a buyer may pay us when a deal closes ([how Origin is paid](https://origindatapartners.com/referral-disclosure)). [See what your data is worth](https://origindatapartners.com/check-fit).


## Questions and answers

### Can a medical billing company sell its clients' patient claims data to AI companies?

No, not identifiable data. A billing company is a HIPAA business associate, may use PHI only as its agreement allows, and HIPAA bars selling PHI without patient authorization. De-identified case data may be licensable if each client's business associate agreement permits de-identification, plus the company's own non-patient work product.

### Who owns claims and prior authorization data, the practice or the billing company?

The practice or hospital, as the HIPAA covered entity, controls its patients' information. The billing company holds it under a business associate agreement that sets permitted uses. Payers keep their own records of each request and decision, and a clearinghouse is a covered entity with its own contracts.

### Can a business associate de-identify PHI and then license the de-identified data?

Only if its business associate agreement permits it. HIPAA says a business associate may use PHI only as its contract allows, and creating de-identified data is a use of PHI. Once data meets the de-identification standard, HHS says the Privacy Rule does not limit its disclosure.

### Does the CMS prior authorization final rule make payer denial data public?

Only in aggregate. Payers covered by CMS-0057-F post annual prior authorization metrics, first due March 31, 2026, and must give a specific denial reason. KFF notes the aggregated statistics do not show which services are denied, so case-level histories with outcomes remain private.

### What is a prior authorization dataset used for in AI?

Training and testing tools that prepare requests, predict whether a payer will approve, read denial reasons, and draft appeals. Cases with the final outcome matter most: in 2024 only 11.5% of denied Medicare Advantage requests were appealed, and 80.7% of appeals were partially or fully overturned.

### Is there a published price for prior authorization or denial data?

No. As of November 2026 we found no published price or closed sale. One intermediary lists prior authorization workflows and denials management records for AI teams without a price, and a news article reports SamaCare sells de-identified insights to drug makers. Neither is a price for case records.

### Can a revenue cycle company license its payer policy library and appeal templates?

Often yes, if it wrote them, they contain no patient information, and its client contracts do not claim them. Check provider and payer agreements for confidentiality of fee schedules or policies. This kind of work product carries far less legal risk than any patient-level case data.

## Sources

- [45 CFR 160.103: HIPAA definitions (covered entity, business associate, clearinghouse)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103)
- [45 CFR 164.502: uses and disclosures of PHI, including sale and de-identification](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502)
- [45 CFR 164.504: business associate contracts](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504)
- [45 CFR 164.514: de-identification standard](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514)
- [HHS: guidance on de-identification of protected health information](https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html)
- [CMS: Interoperability and Prior Authorization final rule (CMS-0057-F) fact sheet](https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-and-prior-authorization-final-rule-cms-0057-f)
- [KFF: Medicare Advantage insurers made nearly 53 million prior authorization determinations in 2024](https://www.kff.org/medicare/medicare-advantage-insurers-made-nearly-53-million-prior-authorization-determinations-in-2024/)
- [KFF: prior authorization metrics provide new insights, but gaps remain](https://www.kff.org/patient-consumer-protections/prior-authorization-metrics-provide-new-insights-into-insurer-practices-but-gaps-remain/)
- [DataPaid: healthcare administration data for AI teams](https://datapaid.ai/for-ai-teams/healthcare-data/)
- [AInvest: SamaCare data moat targets pharma prior authorization bottleneck](https://www.ainvest.com/news/samacare-data-moat-targets-pharma-prior-authorization-bottleneck-watch-data-sales-scale-2027-fhir-deadline-looming-2603/)
- [micro1: Company Data Partnerships (payment ranges)](https://company.micro1.ai/register/?referralCode=24823479-4339-4311-a157-2600b8cf72cf&utm_source=referral&utm_medium=share&utm_campaign=job_referral)
- [Handshake AI: get paid for your company data](https://joinhandshake.com/ai/data-partnerships/license/)

## Related reading

- [Can a medical practice license patient records to AI companies?](https://origindatapartners.com/guides/license-patient-records-ai-training)
- [Can you sell insurance claims data to AI companies?](https://origindatapartners.com/guides/sell-insurance-claims-data-ai)
- [Licensing healthcare operational data for AI: HIPAA basics](https://origindatapartners.com/guides/license-healthcare-operational-data)
- [Health data licensing programs compared: Segmed, Gradient Health, Dandelion and OneMedNet](https://origindatapartners.com/guides/health-data-licensing-programs-compared)
- [How to de-identify company data before licensing it](https://origindatapartners.com/guides/de-identify-company-data-before-licensing)
- [Anonymization vs pseudonymization: GDPR rules and examples](https://origindatapartners.com/guides/anonymization-vs-pseudonymization)
- [Data licensing agreement: what to include](https://origindatapartners.com/guides/data-licensing-agreement)
- [Healthcare Claims Data for AI: Denials and Prior Auth](https://origindatapartners.com/guides/healthcare-billing-denial-prior-auth-data)