How imaging and diagnostics centers can sell data to AI companies

Medical imaging is one of the clearest cases of labeled data in healthcare. Every study comes with a radiologist's report describing what the images show, and many patients return for follow-up studies that confirm or revise the finding.

Those pairs of images and expert reports are what imaging AI developers train and evaluate on. They are also protected health information, held in a format that hides identifiers in places a simple export will miss.

What imaging data do AI companies buy?

AI companies buy imaging data that links studies to expert interpretation and, where possible, to outcomes. Unreported images are worth far less than images with reports, measurements or confirmed diagnoses.

Linked outcomes turn a training set into an evaluation dataset, because they give a model's answer something to be checked against. See image datasets for what buyers check in delivery.

Who buys medical imaging data?

Protege licenses healthcare data to AI model builders, from startups to frontier labs, and highlights a Siemens Healthineers medical imaging team among its users. Handshake AI lists healthcare among the industries it buys operational data from. Neither publishes payouts for imaging data.

No buyer whose terms are public publishes an imaging price range, so volume, modality mix, report quality and linked outcomes decide the figure. A free data valuation applies those factors to your archive.

Does HIPAA allow an imaging center to sell scans?

HIPAA does not allow an imaging center to sell identifiable scans without patient authorization. Under 45 CFR 164.502(a)(5)(ii), a covered entity may not sell protected health information, and 45 CFR 164.508(a)(4) requires an authorization for any disclosure that is a sale.

Under section 164.502(d)(2), information de-identified to the Privacy Rule's standard is not individually identifiable health information. The same paragraph says disclosing a code or other means of re-identification counts as disclosing protected health information, so keep the linkage key for follow-up studies out of the package.

How do you de-identify DICOM images?

You de-identify DICOM images by cleaning three layers: the header attributes, any text burned into the pixels and, for some scans, the anatomy itself. HIPAA's Safe Harbor method, at 45 CFR 164.514(b)(2)(i), lists all elements of dates except year, full face photographic images and any comparable images, and any other unique identifying number, characteristic or code.

The DICOM standard's attribute confidentiality profiles, in Part 15 Annex E, are built to create a special purpose, de-identified copy of an existing data set. They handle burned-in identifying information through a Clean Pixel Data Option and define a separate Clean Recognizable Visual Features Option, and the standard warns that using the profiles does not guarantee that all individually identifying information will be removed.

Head CT and MRI may allow a face to be reconstructed in three dimensions, so treat them as comparable images unless facial features are removed. For large or rich sets, Expert Determination, where a qualified expert documents that re-identification risk is very small, is usually the better route. Our guide to de-identification for AI training data covers both methods.

The radiology report can be licensed only by the entity that holds the right to it. Some imaging centers contract with a separate radiology group or teleradiology provider to read studies, and that group may be its own covered entity with its own record of the report.

Read the reading agreement, any joint venture agreement with a hospital and your PACS and equipment contracts before you export anything. Our vetting standard checks contract restrictions and chain of title before any buyer sees a sample.

Do state laws and retention rules apply?

State laws can add to HIPAA. Washington's My Health My Data Act, at RCW 19.373.070(1), makes it unlawful to sell consumer health data without a valid authorization from the consumer, separate and distinct from the consent to collect or share it.

Retention rules stay in force too. Under 21 CFR 900.12(c)(4)(i), mammography facilities must keep original mammograms and reports for at least 5 years, or at least 10 years if no further mammograms are performed at the facility, or longer if state or local law requires. A license works from de-identified copies, and the originals stay where the rules require.

If you hold UK or EU data

Health data is special category data under UK GDPR Article 9 in any format, including images. In England, the national data opt-out covers confidential patient information from publicly funded care used beyond individual care, including care delivered by private providers.

NHS England says the opt-out does not apply to information anonymized in line with the ICO's code, so UK imaging needs a documented anonymization method before any license is considered.

How do you sell imaging data through Sell My Data To AI?

You start with a consultation about your modalities, PACS, reading arrangements and years of studies. We tell you plainly if we think the rights position cannot be cleared.

If it can, we help you document the de-identification method, run a re-identification test on a sample and share redacted samples only with buyers you approve, under a mutual NDA. Full data moves only after you sign a license directly with the buyer. Book a consultation to start.