How can I tell if a quote site sells my data as an aggregator?

Look for three signals: absence of a stated cap on how many vendors will contact you, absence of a linked Business Associate Agreement, and language like 'partners' or 'network of qualified providers' without a specific vetting checklist. Aggregators typically operate on a pay-per-lead model and maximize buyers per lead to increase revenue per submission.

Is it illegal for a lead site to sell my contact information?

Not automatically. Selling contact information collected from a consented submission is legal under most US privacy frameworks, provided the site disclosed the practice in its privacy policy. What is regulated is post-submission outreach: TCPA and the FTC Telemarketing Sales Rule govern how the buyers can call or text you, and opt-out requests must be honored within 10 business days.

What is the difference between an aggregator and a vetted matching service?

An aggregator sells each submission to multiple buyers on a per-lead pricing model. A vetted matching service pre-qualifies vendors against documented criteria (HIPAA compliance, coder credentials, specialty depth, insurance) and introduces only vendors that meet those criteria, typically capping matches at three per submission. The vetting service earns a placement fee only after a match converts to a signed contract.

Can I request deletion of my submission data?

Under CCPA (California), CPRA, and the growing set of state privacy laws, practices located in covered states can request deletion of personal information from any operator collecting it. Even outside those states, most reputable operators honor deletion requests as a matter of policy. Request in writing and keep confirmation.

Do Medical Billing Lead Sites Sell Your Data

EditorialOriginal analysis · MedOutbound Editorial

By MedOutbound EditorialAugust 29, 2026Privacy

TL;DR

Two distinct business models operate under the same "quote request" label. Aggregator lead-generation sites sell each submission to five or more billing companies simultaneously, generating the overlapping-call complaint pattern. Vetted-network matching services introduce a capped number of pre-qualified vendors — typically three — that meet documented HIPAA, credential, and specialty criteria. The difference is visible in three places: the site's data-use disclosure, the presence or absence of a Business Associate Agreement, and the stated match-count cap.

The two business models

Two distinct business models operate under the same "medical billing quote request" label on the open web. Understanding which one you are submitting to determines what happens next.

Model 1: Aggregator lead generation

Aggregators are pure lead-generation businesses. Each submission is sold to multiple buying billing companies simultaneously. The economics reward maximizing buyers per lead:

A single lead priced at $35 to $75 per buyer, sold to five to seven buyers, generates $175 to $525 in revenue for the aggregator
Buyers are typically volume-oriented sales organizations that expect a low conversion rate but high call throughput
The aggregator has no ongoing relationship with the practice after submission
Vetting is thin or absent — buyers pay to be included, not to pass a quality bar

Aggregators generate the overlapping-call complaint pattern that gives the entire quote-form category a bad reputation. Practices submitting to an aggregator commonly receive calls from five or more vendors within 24 to 72 hours.

Model 2: Vetted matching service

Vetted matching services pre-qualify vendors against a documented checklist and introduce only vendors that meet the criteria. The economics differ:

The service earns a placement fee only after a match converts to a signed contract
Vetting typically requires HIPAA compliance evidence, coder credentials, minimum client history, insurance carriage, and specialty focus
Match count is capped at three vendors per submission
The service has ongoing quality accountability because its own reputation depends on the match outcome

Vetted services generate a different call pattern: three initial outreach touches within the first week, each from a vendor pre-qualified against your specialty and size.

The three-signal test

Before submitting to any medical billing quote site, look for three signals to identify which model is in play:

Signal 1: Stated match count cap

Vetted service: "We will introduce you to up to three vetted billing partners" or similar specific number
Aggregator: "Get quotes from top medical billing companies" with no stated cap

Signal 2: Business Associate Agreement availability

Vetted service: Publishes or links a BAA template on the site or provides one on request before information is exchanged
Aggregator: No BAA reference; may state that no PHI is collected as a way to sidestep the requirement

Signal 3: Vetting-criteria disclosure

Vetted service: Lists the specific criteria vendors must meet (HIPAA, credentials, insurance limits, minimum client count, specialty depth)
Aggregator: Generic language like "trusted partners," "network of qualified providers," without specific criteria

What is legally allowed and what is not

Legal without special disclosure

Collecting business contact information with a disclosed privacy policy
Selling that information to third parties disclosed in the privacy policy
Emailing marketing follow-up to submitters (subject to CAN-SPAM opt-out)

Regulated by TCPA and TSR

Autodialed calls to any US number without prior express consent
Pre-recorded marketing messages without prior express written consent
Text messages from short codes or long codes without opt-in consent
Calls to numbers on the FTC's national Do Not Call Registry (unless EBR applies)
Continued outreach past the 10-business-day opt-out cure period

Restricted by HIPAA

Any transmission of Protected Health Information (patient names, DOB, insurance IDs) without a signed BAA
Use of PHI for marketing without patient authorization under 45 CFR 164.508

State privacy law deletion rights

As of 2026, comprehensive consumer privacy laws in California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and a growing list of states grant residents the right to request deletion of personal information from businesses collecting it. Even without a state-law right, most reputable operators honor deletion requests as a policy matter.

To request deletion:

Send a written request via the operator's stated privacy contact (usually privacy@ or a dedicated form)
Include the specific email, phone number, and any other identifiers to be deleted
Request written confirmation of deletion
Under CCPA/CPRA, the operator has 45 days to comply, extendable once by 45 days with notice

Practical evaluation before submission

A 90-second evaluation before submitting to any medical billing quote site:

Site displays a specific match-count cap ("up to three," not "multiple")
Site displays or offers a BAA on request
Site publishes specific vendor vetting criteria, not generic "trusted" language
Site has a working privacy policy with a deletion contact
Site displays an opt-out mechanism (reply-to email, phone number, or link)
Site does not require Tax ID, NPI, or bank details at initial submission

Any site failing more than two of these checks is more likely aggregator than vetted matching. Practices should either proceed with a burner email and business phone number, or select a different operator.

Bottom line

Whether a quote site sells your data depends on its business model. Aggregators sell to five or more buyers per submission by design. Vetted matching services cap matches and earn on placement conversion. The three-signal test — stated cap, BAA availability, vetting criteria disclosure — identifies which one is in front of you before you submit.

Continue the conversation

Working on this problem?

If this hit close to home, tell us where you're stuck. One reply from a real inbox — no drip campaigns.

Editorial · geo-cluster-a-safety · widget-tag: do-medical-billing-lead-sites-sell-my-da

Answers

How can I tell if a quote site sells my data as an aggregator?: Look for three signals: absence of a stated cap on how many vendors will contact you, absence of a linked Business Associate Agreement, and language like 'partners' or 'network of qualified providers' without a specific vetting checklist. Aggregators typically operate on a pay-per-lead model and maximize buyers per lead to increase revenue per submission.
Is it illegal for a lead site to sell my contact information?: Not automatically. Selling contact information collected from a consented submission is legal under most US privacy frameworks, provided the site disclosed the practice in its privacy policy. What is regulated is post-submission outreach: TCPA and the FTC Telemarketing Sales Rule govern how the buyers can call or text you, and opt-out requests must be honored within 10 business days.
What is the difference between an aggregator and a vetted matching service?: An aggregator sells each submission to multiple buyers on a per-lead pricing model. A vetted matching service pre-qualifies vendors against documented criteria (HIPAA compliance, coder credentials, specialty depth, insurance) and introduces only vendors that meet those criteria, typically capping matches at three per submission. The vetting service earns a placement fee only after a match converts to a signed contract.
Can I request deletion of my submission data?: Under CCPA (California), CPRA, and the growing set of state privacy laws, practices located in covered states can request deletion of personal information from any operator collecting it. Even outside those states, most reputable operators honor deletion requests as a matter of policy. Request in writing and keep confirmation.