How dental practices can sell data to AI companies

A dental record pairs images with decisions. A radiograph, the dentist's finding and the treatment that followed sit in the same chart, often across years of recall visits, which is the structure clinical AI developers look for.

Dental data is health data, though. HIPAA applies in full, and images raise de-identification problems that clinical text does not.

What dental practice data do AI companies buy?

AI companies buy dental practice data that links images, findings and treatment, once it has been de-identified. Protocols and procedures written by the practice contain no patient information, so they are the simplest part of the archive to clear.

Images with findings attached are the most valuable group, because a finding turns an image into a labeled example. See image datasets and expert domain data for how buyers use them.

Who buys dental data?

No buyer whose terms are public publishes a dental price or a dental-specific program. Protege licenses healthcare data to AI model builders, and Handshake AI lists healthcare among the industries it buys operational data from.

Mercor's published range of $80,000 to $820,000 covers medical practices, not dental ones, according to ddiy.co's record of Mercor's listing, and Mercor publishes no dental equivalent. A free data valuation gives you a realistic view for your practice.

Does HIPAA allow a dental practice to sell patient data?

HIPAA does not allow a dental practice to sell identifiable patient data without authorization. HHS lists dentists among the health care providers that are covered entities when they transmit information electronically in connection with a standard transaction, such as an insurance claim.

Under 45 CFR 164.502(a)(5)(ii), a covered entity may not sell protected health information, and 45 CFR 164.508(a)(4) requires an authorization for any disclosure that is a sale. Information that meets the de-identification standard is not individually identifiable health information under section 164.502(d)(2), so the realistic routes are properly de-identified records or records from patients who signed a valid authorization.

How do you de-identify dental images?

You de-identify dental images by cleaning both the file metadata and the pixels. HIPAA's Safe Harbor method, at 45 CFR 164.514(b)(2)(i), lists full face photographic images and any comparable images among its identifier categories, along with all elements of dates except year and any other unique identifying number, characteristic or code.

Extraoral photographs and smile images usually show the face, so leave them out. Radiographs and CBCT scans carry names, dates and record numbers in their DICOM headers and sometimes as text burned into the image. The DICOM standard's confidentiality profiles, in Part 15 Annex E, handle burned-in identifying information through a Clean Pixel Data Option, and warn that using the profiles does not guarantee that all identifying information is removed.

For rich image and text sets, the Expert Determination method, where a qualified expert documents that the risk of re-identification is very small, is often the better fit. See de-identification for AI training data.

CDT codes can affect a dental data license because the American Dental Association owns them. The ADA says it is the exclusive copyright owner of CDT, that dentists, dental teams and hospitals do not need a license to use CDT in practice, and that commercial use, copying or distribution requires a commercial user license.

The ADA's commercial licensing page covers outputs such as patient records, data, reports, claims and analytics that could not be created without the embedded codes, and says redistribution of the codes alone is not permitted. Ask the buyer whether it holds a CDT license, and agree in the license how codes will appear in the data.

Do state laws or DSO structures change the answer?

State laws can add to HIPAA. Washington's My Health My Data Act, at RCW 19.373.070(1), makes it unlawful to sell consumer health data without a valid authorization from the consumer, separate and distinct from the consent to collect or share it.

Group structure matters too. Practices supported by a dental service organization should confirm which entity is the covered entity for the records and whether the support agreement limits use of patient data, because only the right entity can authorize a license.

If you hold UK or EU data

UK dental professionals follow the General Dental Council's Standards for the Dental Team. Standard 4.2 says you must protect the confidentiality of patients' information and only use it for the purpose for which it was given, and the guidance asks for recorded consent before information or photographs are used for purposes such as teaching or research.

Health data is special category data under UK GDPR Article 9, so UK practices face a stricter test than de-identification alone. We recommend excluding UK patient records unless they are fully anonymized.

How do you sell dental data through Sell My Data To AI?

You start with a consultation about your imaging system, practice management software, years of records and which entity holds them. We tell you plainly if we think the rights position cannot be cleared.

If it can, we help you document the de-identification method, run a re-identification test on a sample as our vetting standard requires, and share samples only with buyers you approve. You sign directly with the buyer after independent legal advice. Book a consultation to start.