Data Use & Disclosure Statement

This document is the canonical, version-controlled statement of which datasets the Verzi Provider Intelligence API ingests, under what terms, and what those terms mean for customers using the API. It is maintained outside the auto-generated Terms of Service and Privacy Policy so that future regenerations cannot wipe out substantive data-source disclosures.

1. Summary

The Verzi Provider Intelligence API aggregates publicly available healthcare provider data from federal agencies, academic atlases, state open-data portals, and licensed commercial APIs. It does not ingest, store, transmit, or expose Protected Health Information (PHI) as defined under HIPAA. All data is at the provider, facility, organization, or population level — there are no individual patient records.

The full live catalog of every dataset we ingest — including source URL, license, refresh cadence, and last-loaded timestamp — is served at /sources. Per-source refresh history (every load attempt, success or failure, with timing and row counts) is at /sources/{source_id}/history.

2. HIPAA Classification

Specifically:

• No PHI is ingested. None of our sources publish Protected Health Information. CMS provider quality datasets are released under CMS's public-domain policy. HHS OIG, HRSA, CDC, AHRQ, IRS, DOL, SEC EDGAR, Census, and Dartmouth releases are publicly available under their respective open-data terms. State medical board feeds (e.g., California Open Data) are public license records.
• All data is provider-, facility-, or population-level. Star ratings, quality measures, MIPS scores, financial filings, license records, and shortage-area designations describe organizations and licensed providers — not patients.
• De-identified aggregations are not PHI. Where source datasets contain HCAHPS, claims-derived utilization, or prescribing data, the source agencies have already de-identified and aggregated the data to comply with their own HIPAA / Privacy Act obligations before publication. We ingest only what they publish.
• We do not act on behalf of covered entities. Customers may use the API as they wish under our Terms of Service, but their use of the data does not create a HIPAA Business Associate relationship with Verzi. Verzi creates, receives, maintains, and transmits no PHI on any covered entity's behalf.

If your organization is a HIPAA-covered entity or business associate and you intend to combine Verzi-served data with your own PHI, you are solely responsible for the resulting combined dataset and its HIPAA classification. Verzi does not enter into Business Associate Agreements (BAAs) because the data we serve does not require one.

3. Source Catalog

The complete, machine-readable catalog is at /sources. The categories below summarize the sources by origin and licensing.

3.1 U.S. Federal — Public Domain

These sources are released by U.S. federal agencies and are in the public domain under 17 U.S.C. § 105. Verzi reproduces, transforms, links, and serves them under no restriction beyond attribution and accuracy.

Source	Agency	URL
Hospital Compare (quality, HCAHPS, HVBP, HAC)	CMS	data.cms.gov
Nursing Home, Dialysis, Home Health, Hospice, IRF, LTCH, ASC Compare	CMS	data.cms.gov
Doctors & Clinicians (MIPS)	CMS	data.cms.gov
NPPES (NPI Registry)	CMS	npiregistry.cms.hhs.gov
DAC, PECOS Enrollment / Reassignment	CMS	data.cms.gov
Open Payments (Sunshine Act)	CMS	openpaymentsdata.cms.gov
Physician Utilization, Part D Prescriber	CMS	data.cms.gov
HCRIS cost reports, MA Star Ratings	CMS	cms.gov
Medicare Enrollment, Geographic Variation, HSAF	CMS	data.cms.gov
MSSP ACOs, REACH, NGACO, HAC Reduction	CMS	data.cms.gov
LEIE Exclusions	HHS OIG	oig.hhs.gov/exclusions
HPSA Shortage Areas	HRSA	data.hrsa.gov
PLACES (county / ZCTA health outcomes)	CDC	cdc.gov/places
Social Determinants of Health (SDOH)	AHRQ	ahrq.gov/sdoh
CBSA Crosswalk	Census / OMB	census.gov
Form 990 (nonprofit filings)	IRS	apps.irs.gov + IRS XML S3
Form 5500 (ERISA filings)	DOL EFAST2	efast.dol.gov
10-K / 8-K filings	SEC EDGAR	sec.gov/edgar

3.2 State Open Data

Source	Origin	License
California Medical Board license database	data.ca.gov	California public records / CA Open Data terms

Additional state medical-board feeds will be added over time. Each will be registered at /sources with its issuing authority and license terms.

3.3 Academic

Source	Origin	License
Dartmouth Atlas of Health Care — ZIP / HRR / HSA crosswalk	Dartmouth Institute	Research and educational use; commercial redistribution requires attribution.

3.4 Commercial APIs (Used Under Their Own Terms)

Source	License
Google Maps Geocoding API	Google Maps Platform Terms of Service. Coordinates cached locally; Google mapping content is not redistributed.
Financial Modeling Prep (FMP)	Commercial subscription. Used as parsed-feed proxy for SEC EDGAR 10-K / 8-K filings (themselves public-domain SEC filings).
ProPublica Nonprofit Explorer	ProPublica terms. Used for IRS 990 index discovery; underlying filings are IRS public records.

3.5 Verzi-Original Layers

The following are created by Verzi from analysis of the sources above. They are Verzi proprietary work product, licensed to API subscribers under our Terms of Service:

• org_eins — cross-source employer key (IRS / DOL / SEC / state SOS)
• system_hierarchy — parent-child system relationships
• physician_employer_systems — hand-curated PAC ID → parent-system + employer-typology crosswalk
• employment_attribution_signals — per-fact provenance ledger
• provider_licenses — NPI-keyed license records derived from NPPES taxonomy
• accuracy_ground_truth + accuracy_results — nightly variance benchmark vs publicly-stated counts
• Pre-computed HCAHPS / Market Intelligence / Community Health materialized views
• Cross-source data dictionary, source registry, and load-session history

4. Customer Use & Restrictions

4.1 Permitted Use

API subscribers may:

• Query and integrate the data into commercial products, internal analytics, compliance workflows, sales targeting, M&A diligence, and research.
• Cache responses locally for performance, subject to the refresh cadence published at /sources.
• Display data in customer-facing UIs, with attribution to Verzi where reasonable.

4.2 Restrictions

Customers may not:

• Redistribute the raw bulk Verzi-original layers (org_eins, system_hierarchy, attribution signals, accuracy benchmark, materialized views) as a competing data product. Customers may, however, redistribute insights, analyses, and derived works built on top of those layers.
• Use the API to attempt to re-identify individuals from de-identified aggregations.
• Use commercial-source-derived fields (e.g., Google Maps coordinates) in ways that violate the underlying provider's terms.

4.3 Attribution

When publishing analyses or visualizations drawing on Verzi data, customers should attribute as: "Provider intelligence data via Verzi Health (api.healthcaredata.io)." Citing specific underlying sources (CMS, IRS, etc.) where applicable is welcomed.

5. Accuracy & Methodology

• The accuracy benchmark and methodology for system-level claims are published at /accuracy and docs/ACCURACY_BENCHMARK.md.
• Every employment-, financial-, and license-intelligence claim returned by the API includes attribution_signals[] citing the specific source(s) and confidence weight.
• Refresh history per source is at /sources/{source_id}/history. Customers can audit not just what we serve but when each dataset was last refreshed and whether the last refresh succeeded.

6. Updates

Material changes to this document are reflected by incrementing the version and updating the "Last updated" date. The full revision history is in this file's git log at verzihealth/cms-star-ratings.

Version	Date	Change
1.0	2026-06-26	Initial standalone document. Substantive data-source disclosure extracted from auto-generated terms.html + privacy.html; expanded with full per-source catalog, HIPAA classification, customer use, restrictions, and accuracy methodology.

7. Contact

Questions about data sourcing, licensing, or HIPAA classification:

• Email: adrian@verzi.io
• Mailing: Verzi Health, Inc., 32 West 200 South #555, Salt Lake City, UT 84101, United States

For security review or vendor diligence, this document plus the /sources registry and /accuracy benchmark constitute the complete public-facing data-room artifact set.