# License healthcare company data to AI: what stays out > Searching how to sell healthcare company data to AI? Any license keeps patient data out. HIPAA bars selling health information without authorization. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-healthcare-company-data-to-ai Published: 2026-07-13 Updated: 2026-10-14 ## The short answer License healthcare data to AI only after finding any patient records. HIPAA says you can't sell patient health data without a valid authorization. Mercor lists healthcare, and Protege runs a market for health datasets. A lawyer who reads your records decides. This page reports what the texts and buyer pages say. It is research, not legal advice. > **Patient records need a valid authorization before they can be sold.** Think of the attic. Patient files sit in the locked cabinet. The other boxes are a separate pile, and you sort that pile first. ## Does HIPAA stop a healthcare company from licensing its data? The sale rule, [45 CFR 164.502(a)(5)(ii)](https://www.law.cornell.edu/cfr/text/45/164.502), binds a covered entity or business associate. It reaches patient records and similar files a covered entity holds. For protected health information, the rule says yes unless an authorization meets its terms. Our [health and financial data page](/answers/can-i-sell-health-or-financial-client-data-to-ai) reads that rule and the de-identification test line by line, so this page does not repeat them. This page adds the industry view. A clinic, billing firm or health-software vendor holds records that may be protected health information. The operational files around them, such as vendor contracts or marketing assets, are a different category. ## What do the companies and marketplaces say about healthcare? [Mercor's data page](https://www.mercor.com/data/) names healthcare among eight sectors. It lists clinical notes, claims and intake forms as the data types for it (self-reported). Those are the files HIPAA's sale rule is written around. micro1's page lists six areas without naming health. See [does industry matter](/answers/does-industry-matter-for-selling-company-data). [Protege](/buyers/protege) sells licensed health, video and audio datasets to AI developers, per [its site](https://withprotege.ai/). Our [Protege page](/answers/protege-ai-data-marketplace) covers what it publishes. _The cafeteria menu can wait. Sort the patient files first._ ## What does a HIPAA violation cost? HHS's [inflation adjustment, published in the Federal Register](https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment), lists these figures for calendar year 2025: - Tier 1, no knowledge of the violation: $145 minimum, $73,011 maximum per violation. - Tier 2, reasonable cause: $1,461 minimum, $73,011 maximum. - Tier 3, willful neglect corrected within 30 days: $14,602 minimum, $73,011 maximum. - Tier 4, willful neglect not corrected within 30 days: $73,011 minimum, $2,190,294 maximum. Each tier carries a calendar-year cap of $2,190,294. ## Which other health rules sit beside HIPAA? Two come up for healthcare companies. Washington's My Health My Data Act, at [RCW 19.373.070](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070), bars selling consumer health data without a valid authorization that is separate from consent to collect it. The authorization expires one year after signing. [Section 19.373.100](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.100) exempts protected health information governed by HIPAA, among other categories. So our reading is that the Act reaches health data outside HIPAA's scope. [42 CFR 2.12](https://www.law.cornell.edu/cfr/text/42/2.12) applies Part 2 to records that identify a patient as having a substance use disorder and come from a federally assisted program. ## What can a healthcare company gather first? List the systems that hold patient information, the notices patients received and the business-associate agreements you signed. The [rights check](/rights-check) asks whether health records rules apply and lists what to settle with counsel. The [risks page](/risks) lists where company-data sales drew fines. Figure: range, HIPAA top tier, per violation, 2025 figures, $73K to $2.19M. HIPAA's top penalty tier reaches into the millions per violation. Source: HHS inflation adjustment, Federal Register. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [45 CFR 164.502(a)(5)(ii)](https://www.law.cornell.edu/cfr/text/45/164.502) - [Mercor's data page](https://www.mercor.com/data/) - [its site](https://withprotege.ai/) - [inflation adjustment, published in the Federal Register](https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment) - [RCW 19.373.070](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070) - [Section 19.373.100](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.100) - [42 CFR 2.12](https://www.law.cornell.edu/cfr/text/42/2.12)