Not legal adviceThis is general education, current as of October 2026. Rules depend on your contracts, industry and location. Have qualified counsel review any data licensing deal.
The rule
HIPAA bars covered entities and business associates from selling protected health information (PHI) without patient authorization, and the authorization must say the disclosure involves payment (45 CFR 164.502).
De-identified data is not PHI
HHS recognizes two methods (HHS guidance):
| Method | How it works | Best for |
|---|---|---|
| Safe Harbor | Remove 18 listed identifiers and have no actual knowledge the rest could identify someone | Structured data, simpler cases |
| Expert Determination | A qualified expert documents that re-identification risk is "very small" | Rich free text like notes, tickets, emails |
HHS is clear that the remaining risk "is not zero." Business associates may de-identify only if their business associate agreement allows it.
What's safer to license
- Billing, scheduling and intake procedures (no patient data)
- Revenue cycle SOPs and denial-management playbooks
- Staff training materials
- Credentialing and compliance checklists
See healthcare administration data.
Frequently asked questions
Can a healthcare company sell data to AI companies?
Not PHI without patient authorization. De-identified data (via Safe Harbor or Expert Determination) isn't PHI, and process documents with no patient data are generally outside HIPAA.
What are the two HIPAA de-identification methods?
Safe Harbor, which removes 18 identifiers, and Expert Determination, where an expert documents a very small re-identification risk.