Yes, if the records are de-identified first. Selling identifiable patient information needs each patient's authorization under HIPAA, but data de-identified under HIPAA's Safe Harbor or Expert Determination standard is no longer protected health information. Published buyer ranges run $80K to $820K for practices with 10+ clinicians or 2,500+ patients and longitudinal charts with free-text physician notes, and $100K to $900K for digital-health companies with consented visit recordings.
- Free-text physician notes are what buyers pay for. Structured fields alone, or synthetic charts, do not qualify.
- De-identification happens before transfer, usually by the buyer's vendor under a business associate agreement, or by an expert you appoint.
- Check whether your data is already licensed exclusively through a broker or your EHR vendor; that rules a practice out.
What records buyers want from a practice
Buyers want the longitudinal chart: the same patients seen over months or years, with the notes physicians actually wrote. Published buyer requirements name the following:
| Record | Why it matters |
|---|---|
| Free-text visit notes | Show clinical reasoning; structured fields alone do not qualify. |
| Problem lists, medications, allergies, vitals and labs | Let a model follow a patient over time. |
| CPT and E&M coding with the documentation behind it, plus claims | Links documentation to billing decisions. |
| Imaging reports linked to patients | Connects reads to the rest of the chart. |
| Wearable or app data for the same patients | Adds data between visits. |
What AI buyers publish they pay
AI data buyers publish a range for each kind of company. As read on 1 November 2026:
| Company type | Company earns | Who qualifies |
|---|---|---|
| Medical practice or health system | $80K to $820K | 10+ clinicians or 2,500+ patients; US preferred |
| Digital health company | $100K to $900K | 10 to 500 employees; recorded visits; anywhere |
| Imaging and diagnostics center | $80K to $620K | Any size; US preferred; see the imaging guide |
The HIPAA rules that decide what can be licensed
HIPAA treats a sale of protected health information as needing each patient's authorization. De-identified data falls outside that rule, and HIPAA allows two methods:
- Safe Harbor: remove 18 kinds of identifiers, including names, dates more specific than the year, and contact details, with no actual knowledge that the rest could identify someone.
- Expert Determination: a qualified statistician documents that the risk of re-identification is very small. This keeps more clinical detail, such as exact dates, and is common for note-heavy datasets.
- Free text is the hard part: names, family details and places appear inside notes, so de-identification needs text processing and review, not only column removal.
- Sharing identifiable records with a vendor so it can de-identify them needs a business associate agreement first.
- Substance use disorder records under 42 CFR Part 2, and state laws such as California's CMIA and Civil Code section 1798.148 on de-identified patient data, can add limits. Washington's My Health My Data Act applies mainly to digital-health companies not covered by HIPAA.
What rules a practice out
Buyers list three disqualifiers:
- Synthetic or sample charts.
- Records without physician notes.
- Data already licensed exclusively through a broker. Check your EHR and data-sharing contracts before any discussion.
Can companies outside the US license these records?
Buyers prefer US practices but say they consider other countries. Digital-health buyers accept companies anywhere, and multilingual visits add value. Health data is the most restricted category in every country below.
The privacy law that applies to any personal data left in the records:
| Country | Main rule to check | Country guide |
|---|---|---|
| United States | HIPAA; state health privacy laws | US guide |
| United Kingdom | UK GDPR special-category data; common-law duty of confidentiality; NHS-contracted records need extra approvals | UK guide |
| Ireland | GDPR Article 9 special-category data | Ireland guide |
| Canada | PIPEDA plus provincial health acts such as Ontario's PHIPA | Canada guide |
| Australia | Privacy Act 1988: health information is sensitive information | Australia guide |
| India | DPDP Act 2023: consent-based | India guide |
Questions to answer before a first call
Buyers ask the same four questions. Answering them in a sentence each is enough to start.
- Which EHR do you use, and how many patients and years does it cover?
- Which specialties do you see?
- Who handles de-identification today, if anyone?
- Is any of your data already under a licensing agreement?
Next step
For records that hold little or no patient information, such as scheduling rules and billing workflows, see licensing healthcare operational data. Origin Data Partners is independent and is not affiliated with any AI data buyer. We help owners compare buyers and find the best fit for their records. See what your data is worth.
Common questions
Is it legal for a doctor's office to sell patient data to AI companies?
Selling identifiable protected health information requires each patient's written authorization under HIPAA. Data properly de-identified under the Safe Harbor or Expert Determination method is not protected health information, so it can be licensed. State laws and 42 CFR Part 2 (substance use disorder records) can add limits.
How much do AI companies pay for patient records?
Published buyer ranges run $80K to $820K, depending on patient count and note depth. Digital-health companies with consented recordings of patient visits, with transcripts and notes, see published ranges of $100K to $900K.
Which EHR systems qualify?
Buyers name Epic, athenahealth, eClinicalWorks, NextGen, Oracle Health and Elation. The system matters less than whether it holds free-text physician notes over at least a year of visits.
Which specialties are most wanted?
Buyers say primary care is the most requested, with strong demand for oncology, cardiology, neurology, rheumatology, behavioral health, women's health and rare-disease patients.
Can a telehealth company license recorded visits?
Yes, if the recordings are de-identified, voice and text included, or patients signed a HIPAA authorization that discloses the payment. Consent to record alone is not enough. Published buyer requirements want audio, transcripts and the notes generated from each visit, and excludes role-played visits and recordings made without consent.
Sources and further reading
Origin Data Partners is independent and not affiliated with any buyer named on this page.