Article

Health, card and other regulated records

By TrustPast

Updated October 29, 2026

A trade company doesn’t think of itself as holding medical records or card data. Then someone opens a fifteen-year-old work order and finds a customer’s heart condition in the access notes, or a full card number typed into the comments. Those details got there by accident, and a few of them sit under a rulebook written for them. This page settles why each kind of regulated record is treated differently, how it ends up in an HVAC, plumbing, roofing or auto repair company’s ordinary files, and what to set aside before you apply to micro1.

One line before anything else. We, TrustPast, are not lawyers, and nothing here is legal advice. We quote the rules from the pages that publish them and tell you where to look. Your counsel decides what applies to you.

The short answer

None of these records is what a buyer is after. That makes the decision easier than it sounds.

micro1 says: “We are looking for data that reflects how work is actually performed within an organization.” It says the most valuable datasets “capture real operational expertise, decision-making processes, and repeatable workflows”. Its October announcement says micro1 “uses de-identified company data”.

So the records are de-identified before use. In our reading, that means customer names and payments are not what is wanted. What is wanted is how the work was done. How an estimate became a job. How a change order was settled. How a repair was diagnosed. A diagnosis doesn’t need the customer’s dialysis schedule, the card that paid for it or the technician’s fingerprint on the time clock.

Our cornerstone page on what data buyers want from a trade business walks the wanted side, file by file. This page walks the other side, one regulated category at a time.

Apply & License Your Data

Two kinds of text on this page

What micro1 publishes, we quote. Everything else is our advice, and we label it.

micro1 doesn’t publish a list of regulated records it leaves out. What it publishes is a set of protections and an order of steps. “We protect sensitive information through data anonymization and secure handling. Before any participation, together we confirm:” four things, one of which is “De-identified before sharing”. Its contracting step reads: “We establish clear licensing terms, including a commitment not to resell or distribute your data until personal and identifying information has been anonymized.”

The six categories below, and the advice to set them aside, are TrustPast’s own. They are not micro1’s guidance. We picked them because several carry a rule or official guidance written for them, and none of them shows how a job was run. Ask micro1 what it will and won’t take. Its answer is the one that counts.

Health information: why it is different

Health details have a federal rulebook, HIPAA, and a definition that is wider than most owners expect.

Under 45 CFR 160.103, “health information” means information that “relates to the past, present, or future physical or mental health or condition of an individual,” among other things. It counts when it is created or received by a list of organisations. That list includes a “health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse”. Note the word employer. As our own reading, the definition alone puts no duty on an employer; the duties sit with covered entities and business associates.

The same section says who has to comply. A covered entity is “(1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.” Read plainly, a plumbing company is none of those three. Counsel confirms it for yours.

There is a second door. A business associate is a person who, on behalf of a covered entity, “creates, receives, maintains, or transmits protected health information” for certain functions. Whether a contractor that services a clinic ever walks through that door depends on what it does with patient information. That is counsel’s read, not ours.

One more line from the rule matters to employers. Protected health information excludes health information “in employment records held by a covered entity in its role as employer”. That carve-out speaks of covered entities. It doesn’t make your HR folder a safe thing to license. Our advice is simple: it stays out either way.

How health details get into a trade company’s files

They arrive in the notes field, written by someone trying to do the job well.

The access note. “Customer uses a wheelchair, use the side ramp.” “Pacemaker, keep the welder out of the kitchen.” “Dialysis at home, don’t cut the power before 2.” Every one of those is a good dispatcher’s note. Every one is a fact about someone’s health.
The priority flag. A dispatcher moves a no-heat call to the top because the customer is frail. The reason gets typed in.
The workers’ comp file. A back injury lifting a water heater, the urgent care bill, the light-duty letter.
The office inbox. A tech tells the service manager about a new medication that keeps him off roofs for a month.

The repair in each of those jobs is worth keeping. The medical reason behind the urgency isn’t. Our page on what happens to your staff’s personal details covers the HR and workers’ comp side on its own.

Payment-card data: why it is different

Card data has a rulebook too, though it doesn’t come from Congress. It comes from the PCI Security Standards Council, and the card brands run their own compliance programmes. The Council’s FAQ 1436 says each of its payment brand members “currently have their own PCI compliance programs for the protection of their affiliated payment card account data.”

The part that bites a trade company is one line. The Council’s FAQ 1533 says “sensitive authentication data must not be stored after authorization even if encrypted”. It defines that data as “specifically the card verification code and the PIN/PIN block.” The three digits on the back of the card are in it.

The full card number has its own limits. FAQ 1091 says “A maximum of the first 6 and last 4 digits of the PAN is the starting baseline for entities to retain after truncation…”, and the FAQ allows other formats depending on the card brand. A note that shows only the last four is a different thing from a note with all sixteen.

Who you report to and what you owe is a question for your payment processor and counsel. The Council itself says entities “should contact the payment brands directly for information about their compliance programs and reporting requirements.”

How card numbers get into work orders

Somebody took a card over the phone, and the software had no card field.

The comments field. “Paid by card over phone,” then sixteen digits, the expiry and the three-digit code. It happens in dispatch software, in shop management systems and in spreadsheets.
The paper work order. A tech writes the card on the ticket at the kitchen table. Years later the tickets were scanned into the job folder.
The photo. A picture of a check or a card, taken to process a payment, saved with the job photos.
The email. A commercial customer’s accounts payable clerk emails card details for a repair invoice.

The FTC’s guide for business says: “Don’t keep customer credit card information unless you have a business need for it.” That advice is about running your company. Ours, for licensing, is narrower: keep the payment processor’s exports and the accounting attachments out of scope, and look through the notes for anything shaped like a card number before your first call. Then tell micro1’s Data Partnership Manager what you found.

Financial-account data and the Gramm-Leach-Bliley Act

The FTC says the Gramm-Leach-Bliley Act “requires financial institutions” to “explain their information-sharing practices to their customers and to safeguard sensitive data.” It describes those institutions as “companies that offer consumers financial products or services like loans, financial or investment advice, or insurance”.

The FTC’s Safeguards Rule then “requires covered companies to develop, implement, and maintain an information security program”. Its guide lists examples of covered businesses, “including mortgage lenders, payday lenders, finance companies, mortgage brokers,” and more. Under 16 CFR 314.2, customer information is “any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic, or other form”.

Most trade companies don’t lend. Some do something close. An HVAC company that arranges financing on a new system. A roofer that offers payment plans. A shop that sells cars as well as fixing them; the FTC’s Gramm-Leach-Bliley page points auto dealers to a set of FAQs written for them. Whether any of that makes you a financial institution is a question for counsel, and only counsel.

What we can say is where the account data sits. ACH authorisation forms with routing and account numbers. Financing applications with income and credit details. Checks photographed for deposit. None of it shows how a furnace was sized. Our advice: the finance files and the payments folder stay out, whatever counsel says about the Act.

The IRS says a Taxpayer Identification Number “is issued either by the Social Security Administration (SSA) or by the IRS,” and “A Social Security number (SSN) is issued by the SSA”. Its page on Form W-9 says the form is used “to provide your correct Taxpayer Identification Number (TIN)”. A sole-trader sub writing its tax number on that form may well be writing its owner’s Social Security number.

The FTC’s guide for business says: “Use Social Security numbers only for required and lawful purposes”. It also says: “Don’t use Social Security numbers unnecessarily”.

Where they hide in a trade company:

The accounting export. A vendor list exported for the year-end filing, with each sub’s tax number in a column.
The 1099 worksheet. The spreadsheet the bookkeeper builds each January to prepare forms for subs.
The payroll export. A year-end file emailed to the outside accountant, saved in the sent folder ever since.
The background check. A report on a new tech, filed with the job application.

Our advice: leave out the folders the bookkeeper and the outside accountant use, and pull any email carrying a W-9 or 1099 before the scope is set. A nine-digit tax number says nothing about how a sewer line was scoped.

Driver’s licences and other ID scans

No single rule on this page is written for a scanned driver’s licence. We list it anyway, as our own advice, because it carries everything at once: name, home address, date of birth, a photo and an ID number.

Trade companies collect them more than they notice. An auto shop copies a licence before a loaner car goes out. A rental desk scans one for a lift or a trailer. A new hire’s file may hold a copy. A roofing sub’s licence gets photographed for a site access list.

They hide in the scanner folder, in the loaner agreements, in the HR files and in job photos. The loaner agreement is the surprise in an auto repair shop: it sits next to the repair order, under the same number. Leave the scans out. The repair order shows the diagnosis without them.

Children’s data

Children’s information has a federal rule, but it is narrower than people assume. The FTC says the COPPA Rule “was designed to protect children under age 13,” and it applies to “operators of commercial websites and online services” directed to children under 13, and to general audience operators “with actual knowledge that they are collecting, using, or disclosing personal information from children under 13”. Under 16 CFR 312.2, a child “means an individual under the age of 13,” and personal information includes “A photograph, video, or audio file where such file contains a child’s image or voice”.

Read that carefully. COPPA is about information collected online by an operator of a website or online service. A plumber’s job photo is not that, as far as the rule’s text goes. So why do we list children at all?

Because the photos exist, and they show nothing about the work. A technician photographs a water heater in a basement, and there’s a child’s bedroom behind it. A before-and-after set from a kitchen remodel shows the family on the fridge door. A school job file names the classroom and the teacher’s students. A note records that the homeowner’s twelve-year-old let the tech in.

Our advice: if you work in homes, schools or daycares, tell micro1 there are photos with children in them, and ask how faces are dealt with before any photo folder goes into the scope. Where you can, leave the photos from schools and childcare sites out. The work order tells the story of the job without anyone’s kids in frame.

Biometric data

The FTC’s press release of 18 May 2023 says “Biometric information refers to data that depict or describe physical, biological, or behavioral traits, characteristics, or measurements of or relating to an identified or identifiable person’s body.” The COPPA definitions give a list of examples: “fingerprints; handprints; retina patterns; iris patterns; genetic data, including a DNA sequence; voiceprints; gait patterns; facial templates; or faceprints”.

In our reading, for a trade company that means a handful of devices bolted to walls and dashboards. The fingerprint time clock in the shop. The face-scan badge reader at the warehouse door. The driver-facing camera in the service vans. The recorded calls, if anyone ever built a voiceprint from them.

Whether any law on biometrics reaches your time clock is counsel’s question. Ours is shorter: a fingerprint template can’t tell anyone why a compressor failed. Leave them out.

What this means for HVAC, plumbing, roofing and auto repair companies

Here is where each trade usually finds these records, as our own walk through four sets of files. None of this is a list from micro1.

An HVAC company. Service tickets with health flags on no-heat calls. Card numbers in the comments of old dispatch records. Financing applications for new systems. Fingerprint time clock exports. What stays: the ticket where the tech traced a short-cycling furnace to a cracked flame sensor, the estimate that went from a repair to a replacement, the maintenance history across ten winters.

A plumbing company. Access notes on medical equipment that can’t lose water or power. Photos inside homes, some with children in them. W-9s from drain and excavation subs. What stays: the job notes on a slab leak, the change order when the reroute went through the ceiling instead, the camera inspection report with the address removed.

A roofing company. Insurance claim files with the homeowner’s policy details. Photos from second-storey windows into bedrooms. Payment plan agreements. What stays: the inspection notes, the estimate and its revisions, the supplement request to the carrier and how it was argued, the crew’s daily log on a tear-off that found rotten decking.

An auto repair shop. Licence scans on loaner agreements. Card numbers on paper repair orders. Financing paperwork if the shop sells cars. What stays: the repair order, the diagnostic steps, the parts swapped and why, the comeback and what fixed it the second time.

The trade pages go deeper: HVAC companies, plumbing companies, roofing companies and auto repair shops. micro1’s referral page lists “30+ employees” among its requirements, and the four examples above assume a company of that size. Our page on companies with 30 or more staff covers that lane.

What to set aside before you apply

You don’t clean your systems first. micro1 says plainly: “No, micro1 has processes for de-identifying and transforming sensitive information.” Your files stay as they are.

What helps is a list. The FTC’s guide opens with the same habit: “Know what personal information you have in your files and on your computers.” Here is our version for this purpose, one line per item:

Name the folders that stay out. HR, payroll, workers’ comp, vendor, accounting, finance, the scanner folder.
Name the systems that stay out. The payment processor, the time clock, the badge reader, the fleet cameras.
Search the notes. Anything shaped like a card number, the words “card”, “CVV”, “wheelchair”, “dialysis”, “SSN”. Count the hits; don’t fix them.
Mark the jobs. Schools, daycares, clinics, care homes, by job number.
Call counsel if you lend, finance or service a covered health provider, or if a search comes back with more than a handful of hits.

Bring the list to the call. micro1’s referral page says qualified companies are invited to connect with a Data Partnership Manager “to discuss their data, licensing terms, and next steps.” Its data partnerships page puts “Contracting” before “Delivery & acceptance”. The scope is set before anything moves.

Then check it. micro1 says “companies are given the opportunity to review representative samples before prepared data is used.” Look for the search terms in the samples. If one shows up, say so before the records are used. How the names and numbers come out of what does go in is on how de-identification works.

Worth two minutes to see your range? Our estimate asks five questions.

What is never included

micro1’s own words on this are short. It says “We protect sensitive information through data anonymization and secure handling,” and that personal and identifying information “is removed or transformed before your data is shared with third parties.” It doesn’t publish a list of records it leaves out.

What follows is our own advice, not micro1’s guidance. Keep these out unless micro1 agrees otherwise in writing and your counsel is satisfied: attorney-client privileged records, health information, payment-card and financial-account details, Social Security numbers, minors’ data, biometric data, and classified or export-controlled material. On this page we add scanned driver’s licences and other ID copies. Where each of those hides across a whole company, not only in the regulated corners, is on what is never included in a records licence. Whether a buyer ever sees who your customers are is on does the buyer see customer names.

Where we fit

We, TrustPast, explain how this works and give you a range with our estimate. The range is ours, not an offer. You apply to micro1 yourself, through the button below. micro1 pays us a referral fee. You pay us nothing, and we never see your files. We give no legal advice: the rules quoted here are the start of a conversation with counsel, not the end of one. Our How it’s safe page has the short version of the protections.

TrustPast

Questions and answers

Is a plumbing or HVAC company covered by HIPAA?

Read plainly, the definition doesn’t name trade companies. Under 45 CFR 160.103 a covered entity is a health plan, a health care clearinghouse, or “a health care provider who transmits any health information in electronic form” in connection with a covered transaction. A trade company that works inside a clinic should still ask counsel whether it ever handles patient information on the clinic’s behalf. We are not lawyers.

Does micro1 publish a list of regulated records it won’t take?

No. micro1 says “We protect sensitive information through data anonymization and secure handling,” and that personal and identifying information “is removed or transformed before your data is shared with third parties.” The categories on this page are TrustPast’s own advice, not micro1’s guidance.

We wrote card numbers into old work orders. Does that rule us out?

Not by itself, as far as anything micro1 publishes says. micro1 says a company doesn’t need to anonymize its data before transferring it, because it “has processes for de-identifying and transforming sensitive information.” Our advice is to search for those notes first, tell micro1 they exist, and keep the payment exports out of scope. Card rules are for counsel and your payment processor.

Do we have to clean our files before they are transferred?

No. micro1 says: “No, micro1 has processes for de-identifying and transforming sensitive information.” What helps, as our own advice, is a short list of where regulated records sit, so the scope can name them before anything moves.

Are customer names or payments what a buyer wants?

No. micro1 says it is “looking for data that reflects how work is actually performed within an organization.” In our reading, what is wanted is how an estimate became a job, how a change order was settled and how a repair was diagnosed. micro1’s October announcement says it “uses de-identified company data”.