How do privately run prisons make money?

The government pays for each prisoner they take.

State Departments of Corrections have the latitude to utilize State owned and run facilities, facilities out of state under contract, or contract privately run facilities.  These are suitably bonded vendor contractors.  Usually private contract detention facilities take only misdemeanor convicts for terms up to a year.  States rarely allow contract facilities to house felony convicts although it is lawful to do so.

In any case, the vendor becomes a joint feasor with the State and must behave as though they were State correctional officers.  All the laws and regulations apply to contract facilities as they would to state-owned facilities.

Privately hired correctional officers must be paid according to the State's rate of compensation, but the contract facility may not issue State uniforms.  There must be a State moderator on site at all times to assure compliance with State regulations.  The vendor is paid at rates agreed-to between the State and the vendor.  The vendor must offer the inmates comparable social services, rehabilitation, health care, and security which may include the use of deadly force to subdue such as prison riots. 

Note that the State of Ohio has room for prisoners from other states to serve their time.  They accept these prisoners under contract and adhere to the regulations of the state where the offense took place.

Basically,a firm gets paid more from the government than it costs the firm to run the prison.  Thus, the firm makes a profit.