This page is general information, not legal, tax or financial advice. Talk to a qualified professional about your situation.
A medical practice should treat patient records as out of scope and look only at operations data that contains no protected health information, or data de-identified to HIPAA’s standard with counsel’s approval. HIPAA allows two ways to de-identify: an expert determination that the risk of identifying anyone is very small, documented with methods and results, or the safe harbor method, which removes 18 listed identifiers of the patient and of relatives, employers and household members (45 CFR 164.514(b)). Mercor lists healthcare among the industries it takes data from.
Records and how they are usually treated
| Records | Usually | Why |
|---|---|---|
| EHR clinical notes, charts, images, lab results | Exclude | Protected health information |
| Scheduling, billing and claims data | Exclude, or de-identify under counsel | Tied to patients; contains identifiers on the safe harbor list |
| Patient messages and call recordings | Exclude | Protected health information |
| Staff email and chat about operations | Possible, after a PHI review | Staff discuss patients more often than expected |
| Policies, protocols, training materials, SOPs | Often possible | Practice work product without patient data |
| Vendor, HR and finance records | Possible | Employee personal data needs de-identification |
Before you apply
- Find PHI everywhere, not only in the EHR: shared drives, email, chat and phone systems.
- Ask HIPAA counsel whether any de-identified data set is in scope and which method applies.
- Check business associate agreements with your vendors: data held by an EHR or billing vendor is governed by those contracts.
- Keep what state law requires. HHS says HIPAA has no medical-record retention period and state laws generally govern it; HIPAA does require six years for the practice’s privacy and security documentation (45 CFR 164.530(j)).
Which buyers take this industry
| Buyer and program | Industry rule | Company minimums | Operating or closed |
|---|---|---|---|
| micro1: Enterprise Data Partnership | No industry limit in the buyer’s published rules | 30+ full-time employees and substantial historical data; several years of records across systems is a stronger fit. No fixed minimum file count or size. | Both. Operating companies apply to the Enterprise Data Partnership; companies no longer operating apply to the Defunct Company Data Partnership. |
| micro1: Defunct Company Data Partnership | No industry limit in the buyer’s published rules | 30+ full-time employees and substantial historical data; several years of records across systems is a stronger fit. No fixed minimum file count or size. | Both. Operating companies apply to the Enterprise Data Partnership; companies no longer operating apply to the Defunct Company Data Partnership. |
| Nyne: Company data licensing | No industry limit in the buyer’s published rules | 20+ full-time US W-2 employees and 3+ years in business, plus a decision maker who can approve the licence | Operating companies only |
| Mode: Company data partnership | No industry limit in the buyer’s published rules | 10+ employees for legal; 15+ for accounting, medical and finance; 50+ for all other businesses. Several years of records you own make a stronger fit. | Not stated. Mode says businesses and nonprofits can qualify. |
| Mercor: Enterprise data | Buyer lists this industry | Not stated. Names target industries: legal, healthcare, finance and insurance, professional services, manufacturing, retail, real estate, logistics. | Not stated |
| Troveo: Business data licensing | No industry limit in the buyer’s published rules | Not stated | Not stated |
Questions people ask
Can the buyer de-identify patient data for us?
Only under an arrangement your HIPAA counsel approves. Before de-identification the data is protected health information, so handing it to a buyer is a disclosure the Privacy Rule must allow. Most practices keep clinical data out of scope entirely.
How long must we keep medical records?
HIPAA itself sets no medical-record retention period; HHS says state laws generally govern it. HIPAA does require you to keep your compliance documentation for six years.
Sources
- HHS: Guidance on de-identification of protected health information
- 45 CFR § 164.514: Other requirements relating to uses and disclosures of PHI (Cornell LII)
- HHS FAQ: Does the Privacy Rule require covered entities to keep medical records for any period?
- 45 CFR § 164.530: Administrative requirements (Cornell LII)
- Mercor: Enterprise data