Article

Medical practices and health systems: get paid for your records

By TrustPast

Updated November 7, 2026

This page is for medical groups, specialty practices, clinics, dental groups, surgery centres and the regional health systems that run several of them. Owners and administrators in healthcare hear “your data has a price” and think of patients. That reaction is right, and it is also why most of them never look at the rest of what they keep.

The rest is large. A practice of forty or four hundred people runs on procedures, schedules, work orders, payer rules, equipment logs and an administrative inbox that never sleeps. None of that is a chart. All of it records how a hard operation is run. A buyer pays to license records like these to train AI models. The patients are never part of it.

We set out the same principle for trade companies on what data buyers actually want from a trade business: what has value is how the work was done, not who it was done for. In a medical practice, that line is sharper than anywhere else, so this page draws it first and keeps drawing it. Here is what is left once the patients are out, and how it works with micro1.

The records a medical practice or health system keeps

These are our examples, not a buyer’s list. They are the operational records a practice produces as it runs, apart from the clinical record, which stays where it is.

The facilities and biomedical work order. An exam-room light fails. An autoclave throws an error code. An imaging room’s air handling drifts out of range. Each one is a ticket: the request, the technician’s finding, the part ordered, the fix, the sign-off. Preventive maintenance on clinical equipment runs on a schedule, and every missed or rescheduled job has a note saying why.

The IT help desk and the EHR change request. A front desk can’t print labels. A provider wants a new order set. A template change breaks a report. The tickets say how each problem was narrowed down and fixed, and the change requests say who asked for what, who reviewed it and why it was approved or sent back.

The policy and procedure manual. How to open the clinic. How to handle a walk-in during a full schedule. How to escalate a phone call that sounds urgent. How to clean a room between patients. Each policy has versions, and many versions trace back to a specific incident that made the old one inadequate.

The scheduling rules. Which visit types go in which slots, how long each takes, how the template changed when a provider went part-time, how no-shows are handled. A scheduling template is a hard-won answer to a hard problem.

The revenue cycle playbook. Not the claims themselves, which carry patients, but the procedures: how a denial is worked, which payer needs which documentation, how a prior authorization request is assembled. The playbook and its revisions show the practice learning each payer’s habits.

The credentialing and onboarding procedure. The checklist for bringing on a new provider, the timeline, the steps that always run late and the workarounds.

The purchasing and vendor record. Supply orders, the substitution when a product was back-ordered, the vendor evaluation when a contract came up for renewal.

The administrative inbox. The practice manager’s email with vendors, landlords, IT contractors and the health system’s central office. Most of it is operations. Some of it, inevitably, mentions a patient, which is why email needs the most care of all.

Two record types hold the heart of this. The facilities tickets, IT tickets and change requests are job files and work orders, each with notes on what was found and what was done. The administrative mail is covered on our page on email archives, which explains how far back an export reaches and how threads are kept together.

Put together, they show how an equipment fault was diagnosed, how a scheduling problem was solved, how a policy changed after a near miss, how a payer’s new rule was absorbed into the workflow. That is the how. The who, whether patient or staff, comes out.

See your estimate

What counts, in micro1’s own words

micro1 says what it wants on its data partnerships page: “We are looking for data that reflects how work is actually performed within an organization.” It names “standard operating procedures (SOPs), process documentation, internal knowledge bases, workflows, templates, operational frameworks, and other business process artifacts.” A practice’s policy manual and its scheduling templates are those things, by name.

It adds: “The most valuable datasets capture real operational expertise, decision-making processes, and repeatable workflows.” A clinic day is a repeatable workflow under constant pressure: the same steps, every day, with exceptions on every hour.

micro1 lists industries whose operational data “can contribute”. It doesn’t name healthcare. Three headings fit a practice’s operations. Operations & logistics: “Operational SOPs, logistics processes, fulfillment workflows, inventory management, and internal operations.” Customer support: “Support documentation, ticket workflows, QA processes, customer operations, and knowledge management.” And Finance & accounting: “Financial processes, SOPs, reconciliations, approvals, reporting workflows, and operational documentation.” micro1’s referral page lists “All industries” among its company requirements. We apply those headings to a practice; micro1 decides what it licenses.

On eligibility, micro1 says it is “looking for established companies with 30+ full-time employees, mature business operations, and substantial historical operational data.” On volume: “There’s no fixed minimum number of files, documents, or terabytes.” It evaluates “the historical depth, breadth, quality, and relevance of the available data,” and says “Companies with several years of records across multiple business systems are generally a stronger fit.” A practice with a ticketing system, a policy library and an email archive, each going back years, has several systems.

What is never included

Patients. Charts, clinical notes, images, lab results, prescriptions, appointment histories tied to a person, insurance details, claims, payment records and anything else that identifies a patient stay out of every scope. That is our own advice and it has no exceptions. Our page on what is never included shows where personal details hide in operational files. In a practice, they hide in surprising places: a work order that names the room and the time, an IT ticket with a screenshot of a schedule, an email thread about a complaint.

The law is the reason to be strict. CMS’s page on covered entities says HIPAA “covers both individuals and organizations,” and that “Providers who submit HIPAA transactions, like claims, electronically are covered.” Its examples include “Doctors”, “Clinics”, “Dentists” and “Nursing homes”. The same page says that if a covered entity engages a business associate, “the covered entity must have a written business associate contract or other arrangement with the business associate.” Whether any licence touches those rules, and how the scope must be drawn so that it doesn’t, is a question for counsel. Ask counsel before the first conversation about scope, not after. Our page on health, payment and other regulated data goes through regulated categories and where they turn up.

Staff come next. Employee health records, credentialing files with licence numbers and home addresses, payroll and performance reviews are personal data and stay out.

Then contracts. A health system’s agreements with its EHR vendor, its payers and its management company may restrict what can be shared, including screenshots and configuration documents. Anything a vendor or partner owns under contract stays theirs. Our page on client-owned work and NDAs covers how to find those terms.

Some committee records need special care too. As our own advice, leave peer review and quality committee minutes out unless counsel says otherwise.

What is left is still a working record of how a medical operation runs: the procedures, the tickets, the templates, the administrative correspondence with patient references cut out at the source.

How de-identification works

micro1 says a company doesn’t need to clean its files before transfer: “No, micro1 has processes for de-identifying and transforming sensitive information.” For a covered entity, our advice is to go further than that sentence. Patient information is kept out of scope at the source, system by system, before any transfer is discussed. De-identification is then a second layer for staff names and stray references, not the first.

micro1 publishes four confirmations made “Before any participation”. De-identified before sharing, in micro1’s words: “Personal and identifying information is removed or transformed before your data is shared with third parties.” Data segregation: “Your data is kept separate from other companies’ data, with access restricted to authorized personnel.” Defined retention periods: “Raw data is deleted according to an agreed schedule.” And data is licensed “exclusively to labs and enterprises based in the U.S. and allied countries.”

micro1 describes what happens after transfer: “Depending on the nature of the data, personally identifiable information may be removed and certain datasets may undergo synthetic rewrites that preserve workflow structure while reducing direct ties to original records.” For a facilities work order, the structure is the fault, the diagnosis and the fix. The room number and the technician’s name are what a rewrite changes.

On protection, micro1 says “access is restricted to a limited number of authorized team members,” that customer data is processed “through isolated pipelines,” and that “companies have the opportunity to review representative samples before use.” Your privacy officer should read that sample. Our page on how de-identification works covers what to check for.

What decides the price

micro1 publishes three tiers. “Qualified Enterprise Data Partnerships” are $100K-500K (indicative, not an offer). “Large-scale operational datasets or ongoing participation across multiple teams and business functions” are $500K-3M (indicative, not an offer). “Highly unique, proprietary operational data” is $3M+ (indicative, not an offer).

micro1 says compensation “is based on the quality, uniqueness, and value of the data provided.” Its FAQ names “dataset size and volume, workflow complexity, data quality, domain expertise represented, and the uniqueness of the operational knowledge contained within the dataset.” It also says “Each partnership is evaluated individually.”

A health system’s operations score on workflow complexity: one equipment failure can move a schedule, a procedure, a vendor and a payer authorization in a single afternoon. A multi-site group has breadth: the same policy applied, adapted and argued about in each location. The weak spot is the scope. Once patient records are out, what remains has to be enough, and that depends on how well the practice documented its operations.

micro1’s payout page asks for employees, years of data and headquarters country, then says the figure is an “Indicative estimate only. Final payout is determined based on data sources, volume, quality, access terms, and due diligence.” In our reading, what lowers it: operational records tangled with patient detail so tightly that little can be separated, or a policy library that was never versioned. What raises it: years of tickets with real notes, a policy manual with its history, and administrative mail that can be filtered cleanly. Our page on what decides the price goes through each factor.

On payment, micro1 says: “We pay in full within 30 days of acceptance.”

Which programme fits

micro1’s programme is for companies with 30 or more people, counted now or at peak, and for a company of any size outside the US. micro1 says it is “currently prioritizing US companies, followed by other Western markets.” Our estimate asks how many people work at the practice, counting clinical and administrative staff alike, and names the programme that fits that headcount. The line is explained on the programme page for 30 or more people.

Practices close, merge and get absorbed into larger systems. micro1’s company referral page lists a “Defunct Company Data Partnership” and says: “We are acquiring data from companies that are no longer operating.” Its requirements are “30+ employees”, “10+ Countries”, “English” and “All industries”, with company compensation of “$100K-$3M+ for approved data packages” (indicative, not an offer). A closed group’s operational records, kept apart from the patient records its custodian holds, are what that route describes. Who may sign for a closed practice, and who holds its patient records, are questions for counsel.

Medical practices share their strict line between the client’s details and the firm’s own reasoning with investment firms, where the committee trail is licensable and the client accounts never are. They share regulated customer data and a written procedure for every exception with payments and fintech companies. And they share the triage-and-escalate workflow with cybersecurity companies, where every case starts with a symptom and ends with a written decision.

TrustPast

Questions and answers

Do patient records go to micro1?

No, as our own advice: patient charts, clinical notes and anything that identifies a patient stay out of every scope. CMS says providers that submit HIPAA transactions, like claims, electronically are covered entities, so ask counsel before any record that ever touched a patient is considered.

Then what is left to license?

The operations. micro1 says it is “looking for data that reflects how work is actually performed within an organization,” and names SOPs, process documentation, workflows and templates. A practice’s policy manual, scheduling rules, facilities and IT tickets and its administrative procedures are that kind of record.

Does micro1 say it wants healthcare companies?

Its pages don’t name healthcare. They list “Operations & logistics”, “Customer support” and “Finance & accounting” among the operational data that can contribute, and say the program covers “All industries”.

What does micro1 pay?

micro1 lists tiers of $100K-500K, $500K-3M and $3M+ (indicative, not an offer). It says “Each partnership is evaluated individually.”

Do we have to remove names before anything moves?

micro1 says: “No, micro1 has processes for de-identifying and transforming sensitive information.” For a covered entity, our advice is stricter: patient information is kept out of scope at the source, and counsel decides what that means for each system.

How many people does the practice need?

micro1’s published line is “30+ full-time employees.” Our estimate asks how many people work at the practice, counting everyone, now and at peak.