# Sell medical practice data to AI companies

URL: https://sellmydatatoai.net/sell-your-data/medical-practices

Medical practices and clinics can license de-identified clinical notes, letters, protocols and dictation to AI companies, and Mercor publishes a range of $80,000 to $820,000 per practice. HIPAA governs everything: a covered entity may not sell protected health information without patient authorization, so records must meet the Privacy Rule's de-identification standard before any license.

## Key takeaways

- AI buyers most want these records from medical practices and clinics: (1) de-identified clinical notes and encounter records, (2) referral and consult letters and (3) triage records with outcomes.
- Published buyer range for medical practices and clinics: $80,000 to $820,000 per company.
- Source: Mercor's published referral listing for medical practices, as reported by ddiy.co, checked November 2026.
- Size buyers look for: 10 or more clinicians or 2,500 or more patients, de-identified (Mercor's listing).
- The first rights issue to clear: HIPAA Privacy Rule: a covered entity may not sell protected health information without patient authorization. This page covers 5 more.
- Sellers pay nothing to be assessed. We charge a success fee only when a deal completes, and the fee is agreed in writing before we introduce you to any buyer.

## At a glance

- Records buyers ask for: De-identified clinical notes and encounter records; Referral and consult letters; Triage records with outcomes; Coded diagnoses and prescribing, de-identified; Clinical protocols and care pathways; Dictation audio with transcripts
- Why buyers want them: Clinical AI needs real examples of how clinicians record, reason and refer. De-identified records with outcomes are scarce and cannot be replaced by synthetic text without losing what makes them useful.
- Published buyer range: $80,000 to $820,000 per company (Mercor's published referral listing for medical practices, as reported by ddiy.co, checked November 2026)
- Size buyers look for: 10 or more clinicians or 2,500 or more patients, de-identified (Mercor's listing)
- Rights issues: HIPAA Privacy Rule: a covered entity may not sell protected health information without patient authorization; HIPAA de-identification standard at 45 CFR 164.514: Safe Harbor or Expert Determination; State health data laws, such as Washington's My Health My Data Act, require separate authorization to sell; Re-identification risk in rare conditions and free text; Groups and management companies must confirm which entity holds the records; UK and EU: GMC confidentiality guidance and the national data opt-out for UK practices

## What medical practice data do AI companies buy?

AI companies buy medical practice data that shows how clinicians record, reason and decide, once it has been de-identified. Mercor's listing for medical practices specifies de-identified records.

- Clinical notes and encounter records, de-identified
- Referral letters and consult letters
- Triage records with the outcome of each case
- Coded diagnoses, investigations and prescribing
- Clinical protocols, care pathways and practice templates
- Dictation audio with its transcript

Protocols, pathways and templates written by the practice contain no patient information, so they are the simplest part of the archive to clear. Clinical records are worth more and carry far more risk. Coded records are easier for buyers to use when the coding system is stated, so record whether you use ICD-10-CM, SNOMED CT or another scheme, and which version, in your manifest. See [expert domain data](https://sellmydatatoai.net/buy-ai-training-data/expert-domain-data) for how buyers use clinical material.

## How much do AI companies pay for medical practice data?

AI companies publish a range of $80,000 to $820,000 for medical practice data. That is Mercor's referral listing for practices with 10 or more clinicians or 2,500 or more patients, with records de-identified, as reported by ddiy.co in October 2026.

The size test is unusual because it is based on patients as well as staff, so a small practice with a large patient panel can qualify. Not every broker will handle this material. SellMyData, for example, excludes person-linked health records from what it brokers. Practices that belong to a group, health system or management services organization should first confirm which entity is the covered entity for the records, because only that entity can authorize a license. A [free data valuation](https://sellmydatatoai.net/data-valuation) tells you whether your records are realistic to clear.

## Does HIPAA allow a practice to sell patient data?

HIPAA does not allow a practice to sell identifiable patient data without authorization. Under 45 CFR 164.502(a)(5)(ii)(A), a covered entity or business associate may not sell protected health information, and 45 CFR 164.508(a)(4)(i) requires an authorization for any disclosure of protected health information that is a sale.

De-identified data is treated differently. Under 45 CFR 164.502(d)(2), information that meets the de-identification standard is not individually identifiable health information. The same paragraph says disclosing a code or other means of re-identifying the records counts as disclosing protected health information, so keep any linkage key out of the package.

For a practice, that leaves two realistic routes: records properly de-identified under the Privacy Rule, or records from patients who signed a valid authorization. Involve your privacy officer and healthcare counsel before any work starts.

## How does HIPAA de-identification work for medical practices?

HIPAA de-identification works through one of two methods set out in section 164.514 of the HIPAA Privacy Rule, according to the HHS Office for Civil Rights guidance. The Safe Harbor list includes names, geographic subdivisions smaller than a state, most date elements, contact details, record and account numbers, biometric identifiers and full-face photos.

| Method | What it requires | Practical note |
| --- | --- | --- |
| Safe Harbor | Remove 18 categories of identifiers of the patient and their relatives, employers or household members, with no actual knowledge that the rest could identify anyone | Free text often still holds identifiers after field removal |
| Expert Determination | A qualified expert finds the risk of re-identification is very small and documents the methods and results | Better suited to rich clinical text that buyers value |

Dictation audio needs extra care. The recording carries the clinician's voice as well as spoken patient details, so transcripts are usually easier to de-identify than the audio itself. Frankfurt Kurnit Klein and Selz advises excluding high-risk data entirely rather than relying on de-identification. For a practice, that means leaving out rare conditions, sexual health, mental health and records of children unless an expert has assessed them. See [de-identification for AI training data](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data).

## Do state health privacy laws apply?

State health privacy laws can apply on top of HIPAA. Washington's My Health My Data Act, at RCW 19.373.070(1), makes it unlawful to sell or offer to sell consumer health data without first obtaining a valid authorization from the consumer, separate from the consent to collect or share it.

Other states have their own medical records and privacy statutes, so check the law of each state where your patients live. Our guide to [whether you can legally sell company data](https://sellmydatatoai.net/guides/can-you-legally-sell-company-data-for-ai) covers the general position.

## If you hold UK or EU data

UK practices face stricter confidentiality rules. GMC guidance says anonymized information should be used in preference to identifiable information wherever possible, that explicit consent is normally needed for purposes beyond direct care or local clinical audit, and that removing names and addresses alone is unlikely to be enough.

In England, the national data opt-out covers confidential patient information from publicly funded care used beyond individual care, including by private providers, but NHS England says it does not apply to information anonymized in line with the ICO's code. Health data is special category data under Article 9 of the UK GDPR in any format.

## How does selling medical practice data work with Sell My Data To AI?

Selling medical practice data with Sell My Data To AI starts with a consultation about your EHR system, patient panel, years of records and which entity holds them. We tell you plainly if we think the rights position cannot be cleared.

If it can, we help you document the de-identification method, run a re-identification test on a sample as our [vetting standard](https://sellmydatatoai.net/how-we-vet) requires, and share samples only with buyers you approve. You sign directly with the buyer after independent legal advice. [Book a free consultation](https://sellmydatatoai.net/book-a-consultation?side=seller) to start.

## Frequently asked questions

### Can a medical practice sell patient data to AI companies?

A medical practice cannot sell identifiable patient data without authorization. Under 45 CFR 164.502(a)(5)(ii), a covered entity may not sell protected health information except with an authorization under 164.508(a)(4). Data de-identified to the HIPAA standard is no longer protected health information, but state laws may still apply, so take healthcare counsel's advice before starting.

### Is removing names enough to de-identify clinical notes?

No. HHS guidance on the Safe Harbor method lists 18 categories of identifiers, including geographic subdivisions smaller than a state, most date elements and record numbers. Free text can also mention relatives, places, dates and rare conditions that identify a patient. A documented method and a re-identification test on a sample are needed before any buyer sees the data.

### What size of practice do AI buyers look for?

Mercor's referral listing, reported by ddiy.co, asks for 10 or more clinicians or 2,500 or more patients, with records de-identified, and publishes a range of $80,000 to $820,000. Because the test includes patient numbers, a practice with few clinicians but a large patient panel can still qualify.

### Do clinics have to use Safe Harbor de-identification?

No. The HHS guidance describes two methods under section 164.514 of the HIPAA Privacy Rule: Safe Harbor, which removes 18 categories of identifiers, and Expert Determination, where a qualified expert documents that re-identification risk is very small. Expert Determination is often better suited to the rich clinical text buyers value.

## Sources

- [How to sell your company's data to AI companies](https://ddiy.co/sell-company-data-to-ai/), ddiy.co (figures taken from each buyer's own site), accessed November 2026
- [45 CFR 164.502: uses and disclosures of protected health information, general rules](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502), eCFR (US Government), accessed November 2026
- [45 CFR 164.508: uses and disclosures for which an authorization is required](https://www.law.cornell.edu/cfr/text/45/164.508), Legal Information Institute, Cornell Law School, accessed November 2026
- [Guidance regarding methods for de-identification of protected health information](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), US Department of Health and Human Services, accessed November 2026
- [RCW 19.373.070: sale of consumer health data, authorization required](https://lawfilesext.leg.wa.gov/Law/RCW/RCW%20%2019%20%20TITLE/RCW%20%2019%20.373%20%20CHAPTER/RCW%20%2019%20.373%20.070.htm), Washington State Legislature, accessed November 2026
- [Confidentiality: using and disclosing patient information for secondary purposes](https://www.gmc-uk.org/professional-standards/the-professional-standards/confidentiality/using-and-disclosing-patient-information-for-secondary-purposes), General Medical Council, accessed November 2026
- [Understanding the national data opt-out](https://digital.nhs.uk/services/national-data-opt-out/understanding-the-national-data-opt-out), NHS England, accessed November 2026
- [UK GDPR, Article 9: processing of special categories of personal data](https://www.legislation.gov.uk/eur/2016/679/article/9), legislation.gov.uk, accessed November 2026
- [Selling company data for AI training: what to know before you say yes](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes), Frankfurt Kurnit Klein and Selz, accessed November 2026

---

Book a free consultation: https://sellmydatatoai.net/book-a-consultation