Sourcing, privacy and licensing
The most useful thing to know about this data is what is not in it. Every source is a public document that an insurer or the federal government was required to publish.
There is no protected health information anywhere in this pipeline, because none ever goes into it. No claims, no medical records, no enrolment files. That means no business associate agreement to negotiate, no ethics review and no chain of custody to audit. In healthcare data purchasing that is usually the slowest step, and here it does not apply.
Where the data comes from
Insurer price filings
Published by insurers because federal transparency rules require it. Public by law.
CMS public datasets
Average sales price, the physician fee schedule, hospital outpatient rates, drug acquisition cost, Medicare use files and the provider registry. All public.
Insurer coverage policies
Published on insurers’ own public provider websites. Quoted word for word with a link back to the document.
Hospital price filings
Published prices and cost reports, filed under federal requirement.
What a license lets you do
Use it across your company
Unlimited internal users. We do not count seats and we do not charge per query.
Build on it
Models, benchmarks and internal tools are all fine, and what you build from it is yours.
Publish what you find
Publish findings and charts with credit to CareCost Data and the quarter you used.
Put it inside your product
Allowed under an embedding license, priced separately because it changes the economics for both of us. Tell us what you are building.
What it does not let you do
- Resell or redistribute the files as a dataset in their own right.
- Present the data as your own collection.
- Use it to make hiring, credentialing or eligibility decisions about named individuals. This is not a consumer reporting product and may not be used as one.
Security and access
How you get the files
Delivered to a private cloud storage location you control, or pulled from ours with a credential we issue you. Encrypted in transit and at rest either way.
Access credentials
One credential per organization, revocable by you at any time, scoped to the datasets you license and nothing else.
What we store about you
Your contact details and your license scope. We do not store, and cannot see, anything you build with the data.
SOC 2
Not yet certified, and we will not imply otherwise. There is no protected health information in the product, which is why most reviews clear quickly, but if your process requires the certificate tell us early.
If a number is wrong
Tell us and we will check it. If it is wrong we publish the correction in the changelog against the quarter it affects, rather than quietly changing it. Every coverage rule links to the insurer document it was quoted from, precisely so you can check our work.
Questions your procurement team will ask
The full license terms — what you may do, what you may not, term and liability — are written out in one place. Scope, security review and vendor onboarding are on the FAQ.