- Health data can be licensed for AI training only after HIPAA de-identification by Safe Harbor or Expert Determination, or with patient authorization.
- Safe Harbor removes 18 identifiers; Expert Determination relies on a qualified expert's documented assessment.
- Platforms such as Protege pay health data holders a revenue share each time data is used.
- Imaging, notes and records with outcomes are the most sought-after.
What AI developers want from health data
Medical AI needs real clinical data: imaging with reports, clinical notes, records with outcomes, and recordings of care. Protege, which raised $30 million in January 2026, connects holders of de-identified clinical records and medical imaging with AI developers and pays revenue share each time data is used (SiliconANGLE). See medical imaging data and Protege's profile.
The HIPAA route
If you are a covered entity or business associate, protected health information can be used for AI training by a third party only with patient authorization or after de-identification. HIPAA recognizes two methods (HHS):
| Method | How it works | Fits |
|---|---|---|
| Safe Harbor | Remove 18 listed identifiers, including names, most dates and small geographic units, with no actual knowledge the rest could identify someone | Structured records |
| Expert Determination | A qualified expert determines and documents that re-identification risk is very small | Notes, imaging and data where Safe Harbor removes too much |
The rules are in 45 CFR 164.514. See HIPAA Safe Harbor and Expert Determination.
Beyond HIPAA
- State laws may add requirements for health data, genetic data and biometrics.
- Business associate agreements may restrict what a vendor can do with data it holds for you.
- Images may contain identifiers burned into pixels or file headers; strip both.
- Patient trust. Consider publishing how you license data and what you do with proceeds.
Deal structures
- Fixed fee for a defined dataset
- Revenue share through a platform, paid as data is used
- Research collaboration with a developer, with data use limited to a defined project
Read de-identification for AI training data.
Read next
Questions
Can a hospital sell patient data to AI companies?
Not identifiable patient data without authorization. De-identified data under HIPAA's Safe Harbor or Expert Determination methods is no longer protected health information and can be licensed, subject to state law and contracts.
Who can perform an Expert Determination?
A person with appropriate knowledge of and experience with statistical and scientific methods for rendering information not individually identifiable, per HHS guidance.