A physician group, imaging center or specialty clinic can license patient records and imaging for AI work only after HIPAA de-identification, because selling identifiable health information needs each patient's written authorization. Buyers value records that stay linked: an imaging study with its signed report and what happened to the patient afterwards. The practice, as the covered entity, decides and signs; its EHR or PACS vendor cannot license the data on its own.
- Linkage is the value: a study, its signed report and the later visits or results that show the outcome.
- Identifiable records cannot be sold without each patient's authorization, so deals use de-identified data.
- Expert Determination keeps more detail than Safe Harbor, which strips every date to the year.
- A re-identification code that is not derived from patient data can keep records linked after de-identification.
- The practice signs. EHR, PACS, billing and transcription vendors hold the data for the practice, not for themselves.
Which patient records and imaging do AI buyers ask for?
Four record sets come up in buyer requests to practices and imaging centers. Each has its own guide; this page covers what they share: linkage, HIPAA and who signs.
| Record set | Who usually holds it | What makes it useful | Guide |
|---|---|---|---|
| Longitudinal patient records | Physician groups, specialty practices | Visits, notes, labs and medications over several years, ending in a known outcome | Patient records |
| Imaging studies with signed reports | Imaging centers, radiology groups, hospital outpatient departments | The DICOM study and the radiologist's signed report, ideally linked to pathology or follow-up | Medical imaging |
| Pathology reports and slides | Pathology groups, specialty clinics that keep reports, reference labs | The diagnosis on the report tied to the case and, where scanned, the slide image | Section below |
| Claims, denials and prior authorizations | Practices and their billing companies | Each request, the payer decision and the appeal outcome | Billing and denials |
Why does a linked record set matter more than volume?
A scan on its own shows what the image looked like. The same scan with its signed report shows what an expert concluded, and a later biopsy, surgery note or follow-up visit shows whether the conclusion held. That chain is what a model needs to learn or be tested against, and it is hard to recreate outside a practice. Benchmark authors find that agents still miss it: in DAYJOB, built by professionals, "agents accept premises that the record contradicts" and the strongest configuration "passes 24.7% of healthcare" attempts (DAYJOB, arXiv 2610.01306).
In Origin's view, a clinic that can show the link between study, report and outcome for a few thousand patients over several years has a stronger set than a larger archive of images without reports. The link needs a common key, such as an accession number or patient ID, that survives de-identification (see the re-identification code below).
What has been paid for patient records and imaging?
Each row is public evidence read on 14 November 2026, graded by its source. A figure in a company's own material is that company's claim; a published range or rate is a ceiling, not a price any given practice would receive.
| Evidence | What it says | Grade |
|---|---|---|
| Tempus AI filing, as summarised by Abura | Under a five-year order Tempus "will license up to 500,000 de-identified records of patients with Alzheimer's disease and other neurological conditions at $100 for each record delivered" (Abura) | Filing, via a secondary source; a ceiling, and Tempus is an aggregator, not a practice |
| Gradient Health, data partner page | Its worked example: "$3M (total deal size) x 40% (share of studies) x 20% (typical revenue share for data partners) = $240k" (Gradient Health) | Company claim; an illustration, not a reported deal |
| Gradient Health, data types | "Gradient works with medical imaging data, EHR data, pathology reports, clinical records, and multimodal medical data." (Gradient Health) | Company claim |
Read together: per-record prices exist for de-identified records with a defined patient group, and imaging aggregators pay data owners a share of each licence. No public price was found for pathology slides on their own. More programs are compared in the health data licensing programs guide.
What HIPAA allows: the rules quoted
This page is general information, not legal advice. Each rule is quoted from its official text with the date it was read; your counsel decides how it applies to your records and contracts.
Sale of identifiable records. Except in compliance with the authorization rule in § 164.508(a)(4), "a covered entity or business associate may not sell protected health information" (45 CFR 164.502(a)(5)(ii)). A sale is a disclosure where the covered entity or business associate "directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information" (same section). The authorization a sale needs "must state that the disclosure will result in remuneration to the covered entity" (45 CFR 164.508(a)(4)). The rule lists exceptions, for example research "where the only remuneration received by the covered entity or business associate is a reasonable cost-based fee to cover the cost to prepare and transmit the protected health information" (45 CFR 164.502(a)(5)(ii)(B)(2)). Whether any exception fits is for counsel; in practice, licences for AI use de-identified data.
De-identified data. Health information "with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information" (45 CFR 164.514(a)), and the Privacy Rule's requirements "do not apply to information that has been de-identified in accordance with the applicable requirements of § 164.514" (45 CFR 164.502(d)(2)). Two methods meet the standard (45 CFR 164.514(b)):
- Expert Determination: a qualified expert "determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual" and documents the analysis.
- Safe Harbor: eighteen identifiers are removed, including "All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death", and the covered entity has no actual knowledge that what is left could identify someone. For outcome-linked sets, losing every exact date usually removes the time between a study and its result, so Expert Determination is the more common route for this kind of data.
- Some state health-privacy laws, such as California's CMIA and Texas's medical records privacy act, are stricter than HIPAA; counsel checks them too.
- Images need both: DICOM header fields and any text burned into the pixels. The imaging guide covers the DICOM de-identification profile.
How do records stay linked after de-identification?
HIPAA lets a covered entity "assign a code or other means of record identification to allow information de-identified under this section to be re-identified by the covered entity", provided the code "is not derived from or related to information about the individual and is not otherwise capable of being translated so as to identify the individual", and the covered entity does not use or disclose it for any other purpose or disclose how it works (45 CFR 164.514(c)).
In practice that is how an imaging study, its report and a later pathology result can share one random study key in the licensed copy while the medical record number, accession number and dates of service stay inside the practice. A key built from the medical record number, a hash of it, or the patient's initials would not meet the "not derived from" condition. Your de-identification expert decides the method; the point for a first conversation is to know which systems share which identifiers today.
Pathology reports and slides with outcomes
Pathology is where imaging and the record meet: the report states the diagnosis, often with grade, stage and margins, and the slide is the evidence behind it. A set is strongest when each case keeps the report, the scanned slide where one exists, and the clinical follow-up that shows how the case turned out.
Three checks come first. Ownership: the laboratory that performed the test usually keeps the report and slides, so a clinic that sent specimens out may hold only copies of reports. Scans: glass slides are not data until they are scanned, and scanning an archive is a project of its own. Consent and state law: some states add rules for genetic or tissue testing on top of HIPAA; your counsel checks them before any genomic results are included.
In Origin's view, pathology reports linked to imaging and outcomes are more useful than slide images alone; no public price for either was found on 14 November 2026.
Who signs: the practice, its vendors or the hospital?
HIPAA roles decide who can license. The table is the usual position; your contracts decide the real one.
| Party | HIPAA role | Can it license the records? |
|---|---|---|
| Physician group, imaging center or specialty clinic | Covered entity | Yes, the de-identified records it holds as a covered entity, through its own decision and signature |
| EHR, PACS, RIS or cloud archive vendor | Business associate | No, not on its own; it may use the data only as its business associate agreement allows |
| Billing or transcription company | Business associate | No, not on its own; it can introduce the practice, which decides |
| Teleradiology group reading for other sites | Depends on the reading contracts | Only for studies its contracts let it control; reads done for another practice usually belong to that practice |
| Hospital-affiliated practice | Often part of the hospital's covered entity | Usually through the hospital's privacy office and data governance |
| Practice that is closing or being sold | Covered entity until its records pass to a custodian or buyer | Possibly, before the transfer and within state retention rules; see the practice closing checklist |
Checklist for a practice or imaging center
Write these down before a first conversation. None of them needs patient data to leave the practice.
| Check | What to write down |
|---|---|
| Systems | EHR, PACS, RIS, pathology or lab system, and the years in each |
| Volume and years | Patients, visits and studies per year, by modality or specialty |
| Reports | Whether signed reports exist for every study and in which system |
| Links | Which identifiers join a study to its report and to later visits, labs or pathology |
| Outcomes | What shows how a case ended: biopsy result, surgery note, follow-up imaging, readmission |
| Ownership | Studies read for other practices; records held by vendors; retention rules and any custodian arrangement |
| Sensitive categories | Substance use disorder records, behavioral health, reproductive health, minors, genetic results |
What happens next: three steps
No patient record leaves the practice for a first conversation, and you can stop at any point.
- Describe your records: systems, years, modalities or specialties and how studies, reports and outcomes link (describe your patient records and imaging).
- Rights and de-identification plan: Origin works through ownership, business associate agreements and state law with you and your privacy officer or counsel, and the de-identification expert you appoint sets the method. Nothing leaves the practice before you approve a small de-identified sample.
- Buyer review and terms: Origin works with buyers, the AI developers and data companies that license records like these, and shares a description only with buyers you approve. You approve scope, use, price and delivery, and the practice signs the licence itself.
- Origin does not charge data owners; a buyer may pay Origin when a deal closes (how Origin is paid).
Guides for the practice team
The detailed pages behind this hub:
- Licensing patient records to AI companies
- Licensing medical imaging and diagnostic data
- Health data licensing programs compared
- Who owns patient records and how long to keep them
- Claims, denials and prior authorizations and healthcare operational data
- How to de-identify company data before licensing
Run a practice, imaging center or clinic? Describe your systems and years. No patient data or system access needed.
Origin Data Partners works with companies that own data and helps get it bought. We are independent of the services on this page, and a buyer may pay us when a deal closes (how Origin is paid). See what your data is worth.
Common questions
Can an imaging center license studies that are linked to later patient outcomes?
Yes, once the studies, reports and outcome records are de-identified, usually by Expert Determination so that intervals between dates survive. The link itself can be kept with a random code that is not derived from patient information and stays inside the center, as 45 CFR 164.514(c) allows.
Who signs a data licence for a physician group: the group or its EHR vendor?
The group, as the HIPAA covered entity. EHR, PACS, billing and transcription vendors are business associates and may use the records only as their agreements allow, so they cannot license them on their own.
Can pathology reports and slides be licensed for AI training?
Yes, de-identified and where the practice controls them. The laboratory that ran the test usually holds the reports and slides; slides must be scanned to become data; and genetic results can bring state-law limits. No public price for pathology slides was found as of 14 November 2026.
Does keeping a code to re-link de-identified records break HIPAA de-identification?
Not if the code meets 45 CFR 164.514(c): it is not derived from or related to information about the patient, cannot be translated to identify them, and the covered entity neither uses it for another purpose nor discloses how it works.
What does Origin charge a practice or imaging center?
Nothing. Origin does not charge data owners; a buyer may pay Origin when a deal closes. The practice approves every step and signs any licence itself.
Sources and further reading
- 45 CFR 164.502 (eCFR): uses and disclosures, including sale of PHI (a)(5)(ii) and de-identified information (d)
- 45 CFR 164.508 (eCFR): authorization for a sale of PHI (a)(4)
- 45 CFR 164.514 (eCFR): de-identification standard and methods (a)-(b), re-identification codes (c)
- Abura: a public price for health data (secondary summary of the Tempus filing)
- Gradient Health: data partner page
- DAYJOB: a benchmark for long-horizon professional work (arXiv 2610.01306)