Healthcare organizations hold two kinds of records: protected health information (PHI) about patients, which HIPAA tightly restricts, and operational records such as scheduling rules, procedures, billing workflows and staff documentation, which may contain little or no PHI. Selling PHI is generally prohibited without patient authorization; de-identified data meeting HIPAA’s Safe Harbor or Expert Determination standards is not PHI. Get specialist advice before any discussion involving patient-level records.
- Separate patient-level records from operational procedures and workflows.
- HIPAA restricts the sale of PHI; properly de-identified data is not PHI.
- State health-privacy laws can add requirements beyond HIPAA.
Patient data versus operational data
Covered entities and business associates create many records that are not about any individual patient. Those operational records can still be valuable to AI developers building tools for healthcare administration.
| Record type | Likely PHI? | Notes |
|---|---|---|
| Clinical notes and charts | Yes | Highly restricted |
| Claims and billing records | Usually | Contain patient identifiers |
| Scheduling rules and templates | Often no | Check for embedded patient data |
| Policies and procedures | Usually no | May still be confidential |
| Staff training materials | Usually no | Check third-party copyrights |
HIPAA rules that matter
- The Privacy Rule limits uses and disclosures of PHI by covered entities and business associates.
- Sale of PHI generally requires authorization from the individual.
- De-identified information under the Safe Harbor or Expert Determination methods is not PHI.
- Business associate agreements may restrict what a vendor can do with data it holds for you.
State laws and contracts
Some states have health-data laws that go further than HIPAA, and payer or partner contracts may limit reuse. Check both alongside general privacy law.
Next step
Start with operational records and a company-level description. Read how to de-identify company data and the legal guide. This guide is general information, not legal advice.
Common questions
Can a clinic sell patient data to AI companies?
Selling identifiable PHI generally requires patient authorization under HIPAA. De-identified data under HIPAA’s standards is treated differently. Take legal advice.
What healthcare records might not be PHI?
Policies, procedures, training materials, scheduling rules and other documents that contain no individually identifiable health information.
What are Safe Harbor and Expert Determination?
They are HIPAA’s two methods for de-identification: removing 18 specified identifiers with no actual knowledge of re-identification risk, or a qualified expert determining that the risk is very small.
Sources and further reading
Origin Data Partners is independent and not affiliated with any buyer named on this page.