Healthcare bankruptcy: what data can be sold, and what can't

Healthcare businesses file bankruptcy for familiar reasons: reimbursement pressure, staffing costs, a lost payer contract, or debt taken on to grow. They also hold some of the most regulated data in the economy. If you run or represent a distressed practice, clinic, home health agency, staffing firm or healthcare vendor, the first rule is simple: patient data is not for sale. The second is less obvious: a lot of the operational record isn't patient data, and some of it may have real value.

General information, not legal advice. Healthcare privacy law is complex and fact-specific. Your bankruptcy and healthcare counsel should advise on your case.

Why patient data stays out

Protected health information (PHI) held by covered entities and business associates is governed by HIPAA and its Privacy and Security Rules, along with state medical privacy laws that are sometimes stricter. Selling PHI is generally prohibited without patient authorization, and HIPAA's de-identification standards are specific. Add the consumer privacy rules in § 363(b)(1), state laws on medical records, and the reputational stakes, and the practical answer is that a data license from a healthcare debtor should exclude patient records entirely. Our process treats clinical systems such as the EHR, patient portal and medical imaging as out of scope from the start.

The Bankruptcy Code's healthcare rules

The Code has provisions specific to health care businesses:

• Patient care ombudsman (§ 333). In a case involving a health care business, the court generally orders appointment of an ombudsman to monitor patient care, unless it finds one isn't necessary. This is different from the consumer privacy ombudsman, but both may be involved in the same case.
• Disposal of patient records (§ 351). If the debtor can't pay to store patient records, the Code sets out a procedure for notice and disposal, subject to the law governing retention. Records can't simply be sold off.
• Transfer of patients (§ 704(a)(12) and related provisions). A trustee must use reasonable efforts to transfer patients to appropriate facilities when a health care business closes.

These rules signal how seriously the court will look at anything touching patients.

What may be licensable

Operational records that don't contain PHI, or from which PHI can be fully excluded, may be candidates:

• Revenue cycle workflow, in aggregate form. Not claims data about patients, but internal procedures, denial-management playbooks, and staff communications about process, with all patient identifiers excluded. This needs careful scoping and often is best left out.
• Scheduling and operations procedures: SOPs, staffing models, training materials and policy manuals.
• Vendor and supply-chain communications: purchasing, inventory and vendor support tickets, with vendor names removed where contracts require.
• Internal IT and help-desk tickets about systems, provided tickets referencing patients are excluded.
• Business email and chat among administrative staff, after filtering out any message that references a patient.

The test is conservative: if a record could contain PHI and can't be reliably filtered, it stays out. For a healthcare vendor that isn't a covered entity, such as a software or staffing company, the analysis depends on whether it handles PHI as a business associate. If it does, the same caution applies to anything derived from client data.

Filtering and validation

Healthcare data sets need stricter processing than most:

1. Exclude whole systems (EHR, PACS, patient portals, billing systems containing claims) rather than trying to clean them.
2. Filter the remaining sources for medical record numbers, dates of service, diagnosis and procedure codes, insurance identifiers and patient names.
3. Drop records with hits rather than redacting them, when in doubt.
4. Sample heavily and document the miss rate; the threshold should be stricter than for other industries.
5. Have healthcare counsel review the method before anything leaves the company.

See de-identifying company data in bankruptcy for the general approach.

Lenders, payers and contracts

Healthcare debtors often have lenders with liens on receivables and general intangibles, and payer contracts or management services agreements with confidentiality clauses. Group purchasing and vendor contracts may also restrict disclosure. Review these before marketing. Proceeds treatment is covered in how data sale proceeds flow into the estate.

Is it worth it?

Because so much is excluded, a healthcare data license is usually smaller than one from a company of similar size in logistics or software. It can still be meaningful for a multi-location group with years of administrative history, or for a healthcare services vendor with extensive non-PHI support and operations records. A quick valuation can tell you whether there's a market before you spend time scoping.

In Chapter 7

A Chapter 7 trustee of a closed practice faces the § 351 records problem and patient transfer duties first. A non-PHI data license can sometimes help fund records storage and administration costs, which benefits patients and creditors alike. See the Chapter 7 trustee guide.

A worked example: a multi-site physical therapy group

A physical therapy group with 14 clinics and 160 employees files Chapter 11 after a payer dispute. The EHR, scheduling system and billing platform are excluded from day one. What remains: eight years of administrative email filtered for patient references, the operations team's chat workspace, a facilities and IT help-desk system, the policy and procedure manual with revision history, and vendor purchasing records. After filtering, roughly 60 percent of email threads are dropped as possibly patient-related, a deliberately conservative outcome. The remaining set still documents how a multi-site clinical business is run: staffing decisions, credentialing workflows, equipment maintenance and vendor negotiations. Healthcare counsel reviews the method, the patient care ombudsman is informed, and the motion describes the exclusions in detail. The license is modest, but it arrives before the DIP budget tightens and pays for several weeks of administrative costs.

Frequently asked questions

Can a bankrupt medical practice sell its patient data?

Generally no, not as a data license. Patient records are governed by HIPAA, state law and the Bankruptcy Code's records provisions. Records may transfer with patients or a successor practice under those rules, but that's different from licensing data.

What healthcare data can be licensed?

Operational records that contain no PHI, such as SOPs, administrative email filtered for patient references, vendor communications and internal IT tickets, after strict filtering and counsel review.

Is a patient care ombudsman the same as a consumer privacy ombudsman?

No. A patient care ombudsman under § 333 monitors the quality of patient care. A consumer privacy ombudsman under § 332 advises on the privacy aspects of a sale of personal information.

Does HIPAA de-identification make patient data sellable?

HIPAA de-identified data falls outside the HIPAA Privacy Rule, but we don't license patient-derived data from distressed providers. The risk and scrutiny aren't worth it, and buyers' needs can be met with operational records.

Are healthcare software vendors treated differently?

A vendor that processes PHI as a business associate can't use client PHI outside its agreements. Its own internal operational records, without PHI, may be licensable.

Who reviews the method before any data leaves?

Healthcare counsel, the debtor's privacy or compliance officer, and the team processing the data should each sign off in writing. Where a patient care ombudsman is appointed, it's sensible to keep them informed too.

This guide is general information, not legal, tax or financial advice, and reading it does not create an attorney-client relationship. Bankruptcy outcomes depend on the facts, the court and the parties; nothing here promises price, timing or court approval. Talk to your bankruptcy counsel about your case.