Can a Healthcare Company Sell Its Data for AI? HIPAA Explained

A healthcare company can’t sell its patients’ data for AI training in the ordinary course. HIPAA generally prohibits selling protected health information without each patient’s authorization. But a clinic, practice or health business also holds a second kind of data, about how it runs: policies, procedures, staffing, purchasing, facilities and IT. That operating data isn’t about patients, and it can be licensable once people’s details are removed.

This guide explains where HIPAA draws the line, what de-identification means under the rule, and what a health business can realistically offer. It’s general information, not legal advice. Have counsel confirm the scope for your business.

Who HIPAA covers

HIPAA’s privacy rules apply to “covered entities” and their “business associates” (45 CFR § 160.103):

• Covered entities are health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a standard transaction, such as billing an insurer.
• Business associates are people or companies that handle protected health information on a covered entity’s behalf, such as a billing service or an IT vendor with access to records.

Most clinics and practices that bill insurance are covered entities. Many health-adjacent businesses, such as some wellness apps or fitness studios, are not, but other laws can still apply to them (see below).

What counts as protected health information

Protected health information (PHI) is individually identifiable health information that a covered entity or business associate transmits or holds, in any form (45 CFR § 160.103). In practice that means charts, claims, intake forms, appointment records, messages with patients, and anything else that links a person to their health, their care or their payments for care.

The definition has exclusions. One matters for a health business looking at its own operations: PHI does not include employment records a covered entity holds in its role as employer (45 CFR § 160.103). Staff files aren’t PHI, but they are still personal data about employees, so they stay out of any dataset too.

Why patient data is off the table

HIPAA addresses sales directly. Except with an authorization that meets the rule’s requirements, “a covered entity or business associate may not sell protected health information” (45 CFR § 164.502). A sale is a disclosure where the covered entity or business associate is paid, directly or indirectly, by the recipient in exchange for the PHI. The rule lists exceptions, such as public health, certain research for a cost-based fee, treatment and payment, and the sale of the practice itself. Licensing patient records to train a commercial model isn’t one of them.

Getting a valid authorization from every patient for an AI license isn’t practical for most practices. The workable answer is to keep patient data out of scope entirely.

What HIPAA de-identification requires

Health information that is de-identified under HIPAA is no longer individually identifiable. The standard is that the information doesn’t identify a person and there is no reasonable basis to believe it could be used to (45 CFR § 164.514). There are only two ways to meet it:

• Safe Harbor: remove 18 categories of identifiers, of the patient and of their relatives, employers and household members. They include names, geographic units smaller than a state, all date elements except the year, phone and fax numbers, email addresses, Social Security numbers, medical record and health plan numbers, account numbers, vehicle and device identifiers, URLs and IP addresses, biometrics, full-face photos, and any other unique identifying number, characteristic or code. Ages over 89 must be grouped as 90 or older. On top of that, the organization must not have actual knowledge that what remains could identify someone.
• Expert Determination: a person with appropriate statistical and scientific expertise determines, and documents, that the risk of identification is very small.

Both routes take real work. Free-text notes, scheduling comments and small-town addresses make Safe Harbor hard to apply reliably by hand. Even where de-identified data could lawfully be shared, a practice should decide with counsel whether it wants to, given its patients’ expectations. SellMyData’s own process doesn’t take patient data at all; it’s described on the de-identification page.

What a health business can license

Leaving patients out still leaves a lot. The operating side of a health business describes work that AI systems are being trained to do, and it rarely exists in public:

Data	Examples	Usually from
Policies and SOPs	Front-desk procedures, no-show policies, intake flows, phone scripts	Shared drives, wikis
Training materials	Onboarding guides, compliance training, checklists	Drives, learning tools
Staffing and scheduling	Coverage threads, call-outs, room assignments	Chat, scheduling tools
Credentialing and compliance	Credentialing checklists, audit prep, policy reviews	Documents, tickets
Revenue-cycle process	Payer rules, denial reasons and appeal steps as a process, without patient identifiers	Workflow notes, tickets
Purchasing and vendors	Supply orders, service contracts, the ledger behind them	Accounting, email
Facilities and IT	Equipment, access and help-desk tickets	Ticketing tools

Three cautions apply to all of it:

• Check for patients in the margins. A staffing thread can mention a patient by name, and an IT ticket can include a screenshot of a chart. Exports have to be scoped to exclude channels and systems where patients are discussed, then checked.
• Leave staff health and HR out. Employee health information, HR files and payroll stay out, whether or not HIPAA covers them.
• Read your vendor contracts. Your EHR, practice-management and billing vendors’ terms, and any business associate agreements, may restrict what you can export and share.

SellMyData’s healthcare operations page lists what we take and what stays out.

How to scope an export

Patient data lives in the EHR, practice-management and billing systems, so those are out by default. Operating data usually sits elsewhere: shared drives and wikis for policies and training, chat channels for staffing and facilities, and ticketing tools for IT. Start the scope from those systems, exclude any channel or folder where patients are discussed, and write down what’s in, what’s out and why.

Other laws beyond HIPAA

HIPAA isn’t the only rule. Washington’s My Health My Data Act is described by the state’s Attorney General as the first privacy-focused law in the country to protect personal health data that falls outside HIPAA (Washington AG). It covers “consumer health data”, personal information linked or reasonably linkable to a consumer that identifies their past, present or future physical or mental health status, and it applies to businesses that serve Washington consumers (RCW 19.373). Other states have their own health and privacy laws. Counsel should confirm which ones apply to you.

Before you share anything

• Decide with counsel which systems are in scope, and write down that patient data is excluded.
• Export only from the systems and channels that hold operating data, and only for the date range you choose.
• Have the export checked for any patient or employee details before anyone outside the company sees it.
• Read your vendor agreements for export and sharing limits.
• When an offer arrives, check its terms: AI data license offers: the terms to check.

To size what you hold first, see Take inventory. This guide is general information, not legal advice; health privacy rules are strict and vary by state, so have counsel review the scope before you share or license anything.