- The health-data brokerage economy is legal and large mostly because de-identified data falls outside HIPAA, and the patient is the only unpaid party in the chain.
- Mithras Health earns revenue from research access fees; patients are paid fair-market participation fees that post only on IRB-approved research-use events.
- Records never pool into a sellable asset: federated queries run in-region and return aggregates only, under a hard k ≥ 5 floor.
- A promise kept in policy can be repealed by the people who made it; a promise kept in architecture survives bad quarters and new owners.
On this page
A prescription gets filled at a pharmacy counter. The patient pays, takes the bag, and goes home. The record of that transaction does not go home. Stripped of the name, stamped "de-identified," it begins a second life — aggregated, licensed, and resold in a market most patients have never heard of and none of them joined.
Mithras Health does not participate in that market. Not as a seller, not as a buyer, not at launch and not later. This post explains why that is a structural decision rather than a marketing sentence — and why the difference between those two things is the whole point.
Follow the money
The trade in health-shaped data is old, large, and almost entirely legal. Prescription records, insurance claims, lab results, hospital discharge data, and the exhaust of consumer health apps flow from the places care happens to companies whose business is assembling and reselling them. The U.S. Supreme Court was already hearing arguments about this trade in 2011, in Sorrell v. IMS Health, a case about pharmacies selling prescription records for marketing use. The market did not shrink afterward.
Walk the chain and count who gets paid. The provider or pharmacy that supplies the records is paid. The aggregator that cleans and links them is paid. The broker that packages them is paid. The buyer extracts value from them. One party appears in every single record and in no part of the revenue: the patient. We map the mechanics of this economy in how health data gets bought and sold, and the fairness question it raises in should patients be paid when research uses their data? The short version: everyone in the chain is compensated except the person the data describes.
The loophole has a name
The broker economy runs on one legal fact: once data is de-identified under HIPAA, HIPAA stops applying to it. The HHS de-identification guidance defines two paths — remove eighteen listed identifiers, or have an expert certify low re-identification risk — and data that clears either path can be sold without the patient's knowledge, consent, or compensation.
The problem is that "de-identified" describes a procedure, not an outcome. Latanya Sweeney's re-identification work showed decades ago that combinations of ordinary fields — ZIP code, birth date, sex — single out most Americans without any name attached. Europe drew the harder line: under the GDPR, health data is special-category data, and data counts as anonymous only when re-identification is not reasonably likely by any means — a bar most "de-identified" commercial datasets do not clear. Washington's My Health My Data Act went further still for consumer health data, requiring signed authorization before a sale.
So the honest description of the status quo is this: a market built in the gap between what the law regulates and what actually protects people.
A different revenue model
Mithras earns revenue from research access fees, and patients are paid from research use — which means the platform never accumulates a sellable asset in the first place. That is the entire model, and it fits in a paragraph.
Mithras is a patient-mediated research-data platform for chronic disease. Patients own their records. A study that wants to work with those records requests access, and each patient grants — or declines — a revocable, scope-limited consent for that study specifically. The sponsor pays an access fee. The patient is paid a fair-market participation fee, and that fee posts only when an IRB-approved research-use event actually occurs. No use, no fee — for the patient and for us. When research touches your records, you are paid, and the event is logged. When it doesn't, nobody is.
This is what incentive alignment looks like when it is built rather than promised. A broker profits by moving the maximum volume of data to the maximum number of buyers. An access mediator profits only when patients keep saying yes — which means our revenue depends on remaining the kind of platform patients trust with a yes.
The architecture makes selling structurally awkward
It is not just that selling data is against our rules. It is that the system is shaped so there is nothing convenient to sell.
| Broker model | Access mediation | |
|---|---|---|
| What moves | Bulk copies of records | Queries in, aggregates out |
| Who pays | Data buyers, per dataset | Research sponsors, per approved use |
| Who is paid | Everyone except the patient | The platform and the patient |
| What a refusal does | Nothing — nobody asked | Stops future use immediately |
| What an acquirer inherits | A warehouse to resell | A consent ledger to honor |
Federated queries run in-region and return aggregates only; record-level data does not travel. No aggregate releases below the hard k ≥ 5 floor — a limit that is not configurable, for anyone. Every access event lands on an append-only, cryptographically anchored audit trail with six-year retention. There is no central pile of identified records waiting for a price list, and any attempt to create one would leave a permanent mark in a ledger designed to make quiet edits impossible.
What 'never' has to survive
Every company that ever sold out its users once had a page like this one. So the test of "never" is not how it sounds today — it is what happens during a bad quarter, under a new CFO, or after an acquisition. A promise kept in policy can be repealed by the same people who made it, in a meeting, on a Tuesday. A promise kept in architecture has to be demolished, and demolition is loud.
That is why we treat this commitment as apparatus rather than policy: consent checked in the query path, aggregates as the only exit, refusals and releases written to the same tamper-evident spine. An acquirer would not buy a dataset; it would buy a set of obligations with an audit trail attached. We consider that a feature.
The patient at the pharmacy counter deserves a simpler sentence than the data economy usually offers, so here is ours: research pays for access, patients are paid for use, and nothing about you is ever the product on the shelf.
Appendix · questions
Questions, answered
Does Mithras Health sell health data?
How is selling access different from selling data?
Isn't de-identified data safe to sell?
Do patients get paid on Mithras?
The patient-mediated research-data platform for chronic disease — 28 conditions, worldwide consented sources, one auditable spine. Join the launch list.
The sun is rising on chronic-disease research.
One email when we launch — and nothing else. Patients, researchers, sponsors, and programs all start here.