Can a healthcare practice sell its data to AI?

Patient records can’t be sold without each patient’s authorization

Under the HIPAA Privacy Rule, a covered entity “must obtain an authorization for any disclosure of protected health information which is a sale of protected health information” (45 CFR 164.508(a)(4)). For a clinic or practice covered by HIPAA, that rules out selling charts, notes, images or anything else that identifies a patient, unless each patient signed. This page is not legal advice; take the scope to a healthcare lawyer before you sign anything.

De-identified records fall outside that rule

The same rule says health information that doesn’t identify a person, with no reasonable basis to believe it could, isn’t individually identifiable (45 CFR 164.514(a)). It allows two ways to get there. A qualified expert can determine that the risk of identifying someone is very small, or the practice can remove 18 kinds of identifiers, from names and birth dates to street addresses and medical record numbers.

The companies we list de-identify before training. Scale lists “employee and customer identities” among what never leaves your company, and you approve each package. micro1 removes personal and identifying information before anyone else sees the data. Agree in writing which HIPAA method applies, and who carries it out, before anything leaves your systems.

The business side of a practice is what they name

Scale and Telegraph list healthcare and life sciences, and Miro Advisory names “healthcare administration” among the industry systems it looks at. That is the work of running a practice:

• Policies, procedures and staff training material, in documents and SOPs.
• Billing, claims and payer correspondence, in accounting records and email.
• A patient help desk’s support tickets and staff chat.

Most of these still mention patients, so the de-identification rules above apply to them too.

Regulated data gets a longer review

Miro Advisory says “regulated industries require substantially greater privacy, consent and regulatory review.” Telegraph says regulated or third-party information “may need to be excluded.” Expect a longer scoping call than a company outside healthcare would get, and keep your privacy officer in it.

On size, Mode buys from medical firms with 10 or more employees, against 30 for most other businesses. micro1 asks for 30 or more full-time employees, Scale prefers 40 or more, and Miro Advisory works with roughly 20 to 700.