Sell medical practice data to AI companies

What medical practice data do AI companies buy?

AI companies buy medical practice data that shows how clinicians record, reason and decide, once it has been de-identified. Mercor's listing for medical practices specifies de-identified records.

• Clinical notes and encounter records, de-identified
• Referral letters and consult letters
• Triage records with the outcome of each case
• Coded diagnoses, investigations and prescribing
• Clinical protocols, care pathways and practice templates
• Dictation audio with its transcript

Protocols, pathways and templates written by the practice contain no patient information, so they are the simplest part of the archive to clear. Clinical records are worth more and carry far more risk. Coded records are easier for buyers to use when the coding system is stated, so record whether you use ICD-10-CM, SNOMED CT or another scheme, and which version, in your manifest. See expert domain data for how buyers use clinical material.

How much do AI companies pay for medical practice data?

AI companies publish a range of $80,000 to $820,000 for medical practice data. That is Mercor's referral listing for practices with 10 or more clinicians or 2,500 or more patients, with records de-identified, as reported by ddiy.co in October 2026.

The size test is unusual because it is based on patients as well as staff, so a small practice with a large patient panel can qualify. Not every broker will handle this material. SellMyData, for example, excludes person-linked health records from what it brokers. Practices that belong to a group, health system or management services organization should first confirm which entity is the covered entity for the records, because only that entity can authorize a license. A free data valuation tells you whether your records are realistic to clear.

Does HIPAA allow a practice to sell patient data?

HIPAA does not allow a practice to sell identifiable patient data without authorization. Under 45 CFR 164.502(a)(5)(ii)(A), a covered entity or business associate may not sell protected health information, and 45 CFR 164.508(a)(4)(i) requires an authorization for any disclosure of protected health information that is a sale.

De-identified data is treated differently. Under 45 CFR 164.502(d)(2), information that meets the de-identification standard is not individually identifiable health information. The same paragraph says disclosing a code or other means of re-identifying the records counts as disclosing protected health information, so keep any linkage key out of the package.

For a practice, that leaves two realistic routes: records properly de-identified under the Privacy Rule, or records from patients who signed a valid authorization. Involve your privacy officer and healthcare counsel before any work starts.

HIPAA de-identification works through one of two methods set out in section 164.514 of the HIPAA Privacy Rule, according to the HHS Office for Civil Rights guidance. The Safe Harbor list includes names, geographic subdivisions smaller than a state, most date elements, contact details, record and account numbers, biometric identifiers and full-face photos.

Dictation audio needs extra care. The recording carries the clinician's voice as well as spoken patient details, so transcripts are usually easier to de-identify than the audio itself. Frankfurt Kurnit Klein and Selz advises excluding high-risk data entirely rather than relying on de-identification. For a practice, that means leaving out rare conditions, sexual health, mental health and records of children unless an expert has assessed them. See de-identification for AI training data.

Do state health privacy laws apply?

State health privacy laws can apply on top of HIPAA. Washington's My Health My Data Act, at RCW 19.373.070(1), makes it unlawful to sell or offer to sell consumer health data without first obtaining a valid authorization from the consumer, separate from the consent to collect or share it.

Other states have their own medical records and privacy statutes, so check the law of each state where your patients live. Our guide to whether you can legally sell company data covers the general position.

If you hold UK or EU data

UK practices face stricter confidentiality rules. GMC guidance says anonymized information should be used in preference to identifiable information wherever possible, that explicit consent is normally needed for purposes beyond direct care or local clinical audit, and that removing names and addresses alone is unlikely to be enough.

In England, the national data opt-out covers confidential patient information from publicly funded care used beyond individual care, including by private providers, but NHS England says it does not apply to information anonymized in line with the ICO's code. Health data is special category data under Article 9 of the UK GDPR in any format.

How does selling medical practice data work with Sell My Data To AI?

Selling medical practice data with Sell My Data To AI starts with a consultation about your EHR system, patient panel, years of records and which entity holds them. We tell you plainly if we think the rights position cannot be cleared.

If it can, we help you document the de-identification method, run a re-identification test on a sample as our vetting standard requires, and share samples only with buyers you approve. You sign directly with the buyer after independent legal advice. Book a free consultation to start.