Can a home health agency license its business records to AI companies?

Updated October 25, 2026 · How we research

Why is so little available in home health?

Home health work happens in patients' homes, so patient detail runs through nearly every record: who was visited, where, when, by whom, and why. HHS (the U.S. Department of Health and Human Services) explains that HIPAA protects identifiable information about a person's health, care or payment for care, in any form, when held by a covered provider or its business associates. Even a caregiver's route sheet or a text about a late visit can qualify.

Medicare rules add their own layer. Under 42 CFR 484.110, the federal conditions of participation for home health agencies, each patient's clinical record must include assessments, care plans, orders, visit notes and contact details, must be kept for five years after discharge (longer if state law requires), and must be protected against unauthorized use. The same section requires agencies to follow the HIPAA privacy and security rules.

What systems does a home health agency usually run on?

Agencies typically run on a home health platform that combines clinical and business functions. Axxess, for example, describes OASIS assessments, scheduling, EVV (electronic visit verification, which records when and where a visit happened), claim submission and remittance review, payroll and mobile clinical documentation in one system.

OASIS (the Outcome and Assessment Information Set) is the standardized patient assessment CMS (the Centers for Medicare & Medicaid Services) uses for home health quality reporting. CMS says that since July 1, 2025, agencies must collect and submit OASIS for patients of any payer, with some exemptions. Every one of these modules is patient-centered.

Outside that platform, agencies keep email and chat, HR and recruiting tools, accounting, policy manuals and vendor files. Those are the only places licensable material is likely to sit, and they still need careful screening.

Which records might be considered?

For a home health agency, the candidates are limited to records that describe the business without describing patients, such as the following.

• Policy and procedure manuals written without real patient examples.
• Caregiver recruiting, onboarding and training materials, cleaned of applicant and employee personal data.
• Compliance program documents your team wrote from public regulations.
• Vendor, supply and fleet or mileage policy records that do not reference visits.
• Internal IT tickets and project records that do not involve patient data.

What has to stay out?

Because patient detail is so pervasive, assume any operational message mentions a patient until a careful review shows it does not.

• OASIS assessments, plans of care, physician orders and visit notes.
• Visit schedules, EVV records, route sheets and mileage logs tied to visits.
• Claims, remittances, eligibility checks and authorizations.
• Intake referrals, discharge and transfer summaries.
• Caregiver texts, calls and emails about patients or visits.
• Patient and family contact details, home addresses and access instructions.
• Caregiver background checks, health screenings and other sensitive HR records.
• Anything covered by business associate agreements with hospitals, plans or referral partners.

What about de-identified clinical data?

De-identification under HIPAA is a specialized process, described in the guide on how de-identification works. Home health data is especially hard to de-identify, because addresses, visit times and small-town patterns can point to a person. Either way, the result is clinical data, which this site does not handle. If that is what you have, start at licensemydata.com.

Is it worth pursuing at all?

For many agencies, the honest answer may be that the licensable pool is small. Larger agencies or multi-state groups with a central office may have enough written procedures and training material to be of interest; a single-branch agency may not.

If you want to explore it, have your privacy officer or lawyer confirm which systems hold patient information and set them aside entirely. Then look at what remains and decide whether the cleanup effort is justified. The guide on what can be excluded helps with the setting-aside step.

General information, not legal, tax or financial advice.