License healthcare company data to AI: what stays out
The short answer
License healthcare data to AI only after finding any patient records. HIPAA says you can't sell patient health data without a valid authorization. Mercor lists healthcare, and Protege runs a market for health datasets. A lawyer who reads your records decides.
This page reports what the texts and buyer pages say. It is research, not legal advice.
In plain words
Patient records need a valid authorization before they can be sold.
Think of it like this
Think of the attic. Patient files sit in the locked cabinet. The other boxes are a separate pile, and you sort that pile first.
Does HIPAA stop a healthcare company from licensing its data?
The sale rule, 45 CFR 164.502(a)(5)(ii), binds a covered entity or business associate. It reaches patient records and similar files a covered entity holds. For protected health information, the rule says yes unless an authorization meets its terms. Our health and financial data page reads that rule and the de-identification test line by line, so this page does not repeat them.
This page adds the industry view. A clinic, billing firm or health-software vendor holds records that may be protected health information. The operational files around them, such as vendor contracts or marketing assets, are a different category.
What do the companies and marketplaces say about healthcare?
Mercor's data page names healthcare among eight sectors. It lists clinical notes, claims and intake forms as the data types for it (self-reported). Those are the files HIPAA's sale rule is written around.
micro1's page lists six areas without naming health. See does industry matter.
Protege sells licensed health, video and audio datasets to AI developers, per its site. Our Protege page covers what it publishes.
What does a HIPAA violation cost?
HHS's inflation adjustment, published in the Federal Register, lists these figures for calendar year 2025:
- Tier 1, no knowledge of the violation: $145 minimum, $73,011 maximum per violation.
- Tier 2, reasonable cause: $1,461 minimum, $73,011 maximum.
- Tier 3, willful neglect corrected within 30 days: $14,602 minimum, $73,011 maximum.
- Tier 4, willful neglect not corrected within 30 days: $73,011 minimum, $2,190,294 maximum.
Each tier carries a calendar-year cap of $2,190,294.
Which other health rules sit beside HIPAA?
Two come up for healthcare companies. Washington's My Health My Data Act, at RCW 19.373.070, bars selling consumer health data without a valid authorization that is separate from consent to collect it. The authorization expires one year after signing.
Section 19.373.100 exempts protected health information governed by HIPAA, among other categories. So our reading is that the Act reaches health data outside HIPAA's scope.
42 CFR 2.12 applies Part 2 to records that identify a patient as having a substance use disorder and come from a federally assisted program.
What can a healthcare company gather first?
List the systems that hold patient information, the notices patients received and the business-associate agreements you signed.
The rights check asks whether health records rules apply and lists what to settle with counsel. The risks page lists where company-data sales drew fines.
micro1 may pay us a referral fee if a company we introduce goes ahead with it. How we are paid
Have a lawyer read any contract before you sign. They like that.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
