Can I license health or financial client data to AI?
The short answer
Two federal rules apply. HIPAA bars selling protected health information without authorization. GLBA requires notice and an opt-out opportunity before disclosing financial data to third parties. A lawyer decides application to your clients.
Neither rule mentions AI training. Wording written long before AI does all the work. Each rule turns on how the transfer is described, and on whether the right paperwork came first. HIPAA talks about a sale. GLBA talks about a disclosure.
What does HIPAA say about licensing health data?
The sale rule starts with a flat statement. A covered entity or business associate "may not sell protected health information" except as the authorization rule allows.
A sale means a disclosure where the entity receives payment, directly or indirectly, from or on behalf of the recipient in exchange for the information. The listed exceptions are:
- public health
- research at a cost-based fee
- treatment and payment
- a sale or merger of the entity itself
- work a business associate does on the entity's behalf
A vendor that holds health information for a health-care client can be a business associate. The rule names business associates alongside covered entities.
Does removing names make health data safe to license?
HIPAA has its own de-identification test, and it asks for more than names. The safe harbor in 164.514(b)(2) lists 18 identifier types. They cover the person and also relatives, employers and household members.
The list includes these:
- geographic units smaller than a state
- all date elements except the year
- phone and fax numbers
- email addresses
- account numbers
- device identifiers
- URLs and IP addresses
- biometric identifiers such as voice prints
- full-face photos
- any other unique identifying number, characteristic or code
The entity must also have no actual knowledge that what remains could identify someone.
A law firm checklist published by Frankfurt Kurnit Klein and Selz lists health and benefits information among the categories to exclude outright. It does not rely on de-identification.
What does the financial rule say?
Regulation P, 12 CFR 1016.10, sets four conditions. They apply before a financial institution discloses nonpublic personal information to a nonaffiliated third party.
- It must have given the initial notice.
- It must have given an opt-out notice.
- It must have allowed a reasonable time to opt out.
- The consumer must not have opted out.
The regulation's own mail example treats 30 days as reasonable.
Section 1016.11 limits what a recipient can do next. A recipient that got information under an exception may reuse it only within that exception.
Whether your business counts as a financial institution is a legal question of its own. The definition reaches beyond banks.
What can I gather before I talk to a lawyer?
Facts speed up that conversation. I would write down which clients are health-care or financial firms. I would also list which systems hold their records, and which notices and agreements those clients signed with you.
The rights check walks through those questions. The risks page lists where company-data sales have drawn fines. The managed readiness service assembles the same file and hands every legal call to your counsel.
Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
