Selling healthcare and medical data for AI training

Healthcare is one of the most data-rich and most regulated industries in the US economy. AI labs are interested in both clinical and administrative healthcare data because the work is complex, specialized and poorly represented in public sources. But licensing it requires more care than almost any other category. This guide explains the landscape so you can decide whether, and how, to explore it.

This guide is general information, not legal advice. Healthcare data is subject to HIPAA, state health privacy laws and other rules. Involve experienced healthcare privacy counsel before licensing any health-related data.

Two very different kinds of healthcare data

Administrative and operational data

Many healthcare organizations hold large volumes of operational data that isn't primarily clinical:

• Revenue cycle workflows: eligibility checks, prior authorizations, coding, claims, denials and appeals
• Scheduling, intake and patient-access processes
• Credentialing and provider enrollment
• Call center and patient communication workflows
• Internal SOPs, payer policy interpretations and training materials
• Staff coordination in Slack, Teams or email

This data captures some of the most complex administrative work in any industry. Some of it can be scoped and de-identified so that it contains little or no protected health information (PHI), which simplifies the analysis considerably. Much of it, though, touches PHI and needs careful handling.

Clinical data

Clinical notes, diagnoses, lab results, imaging and treatment histories are highly valuable for medical AI, and they're also the most sensitive and regulated. Licensing clinical data generally requires HIPAA-compliant de-identification, robust contracts and, often, institutional review processes. It's a case-by-case conversation.

HIPAA basics for data licensing

If your organization is a HIPAA covered entity (most healthcare providers, health plans and clearinghouses) or a business associate handling PHI on behalf of one, HIPAA governs how you can use and disclose PHI.

Key points:

• PHI generally can't be sold without patient authorization, and disclosures for purposes like this are tightly restricted.
• De-identified data is not PHI. HIPAA describes two recognized methods for de-identifying health information:
  • Safe Harbor: removing a specified list of identifier categories (names, most geographic subdivisions smaller than a state, most date elements other than year, contact information, record numbers and others), with no actual knowledge that the remaining information could identify someone.
  • Expert Determination: a qualified expert applies statistical or scientific methods and determines that the risk of re-identification is very small, documenting the methods and results.
• Limited data sets (which retain some dates and geography) can be shared for certain purposes under a data use agreement, but they're still PHI and have restrictions.
• Business associates may be contractually restricted from de-identifying or licensing data they hold for clients, even if HIPAA would otherwise permit it. Check your BAAs.

State laws may add requirements beyond HIPAA, especially for sensitive categories like mental health, substance use treatment, reproductive health and genetic information. Some federal rules (for example, for substance use disorder records) impose additional restrictions.

What to exclude by default

• Direct patient identifiers and anything not meeting your chosen de-identification standard
• Sensitive-category records (behavioral health, substance use, reproductive health, HIV, genetic) unless counsel approves
• Data you hold as a business associate unless your agreements clearly permit it
• Images and scanned documents, which often contain embedded identifiers
• Free-text notes, until they've been processed and validated

Making healthcare data valuable after de-identification

Rigorous de-identification removes identity but can preserve a lot of value:

• Workflow structure: the steps of a prior authorization, the sequence of a denial and appeal, the routing of a referral
• Coded data: diagnosis and procedure codes, payer categories, denial reasons
• Timing: intervals between steps, which can be preserved even when absolute dates are removed or generalized
• Procedural knowledge: SOPs, payer rule interpretations and training materials, which often contain little or no PHI

See our general de-identification guide, keeping in mind that healthcare has its own formal standards.

Who is a good fit

• Healthcare administration teams with mature, documented revenue cycle or patient-access workflows
• Specialty practices and groups with distinctive operational processes
• Healthcare services companies (billing, coding, credentialing, care coordination) that own their operational data and have contracts permitting de-identified use
• Organizations with existing data governance and privacy expertise

A cautious path forward

1. Map your data and identify where PHI lives.
2. Review contracts and BAAs to see what you're permitted to do.
3. Start with lower-risk data: SOPs, training materials and operational workflows that can be scoped to exclude PHI.
4. Choose a de-identification standard (Safe Harbor or Expert Determination) for anything health-related, with counsel and qualified experts.
5. Insist on strong contract terms: prohibitions on re-identification, security requirements, restrictions on onward sharing, and audit rights. See the licensing agreement checklist.
6. Approve everything (buyer, price, terms and a validated sample) before delivery.

How DataOffer approaches healthcare data

We evaluate medical and healthcare datasets case by case. Often the best starting point is administrative and procedural data that can be scoped to exclude PHI, and clinical data is considered only with appropriate de-identification and legal review. There's no upfront cost to explore it, and nothing is shared until you approve the buyer, price and terms.

This guide is general information, not legal, tax or financial advice. Figures and ranges are illustrative; talk to qualified advisors about your situation.