DataPacts

Medical Practices and Healthcare Providers Licensing Data to AI

By DataPacts Editorial Team · Checked

Medical practices and healthcare providers can license patient records to AI developers once the records are de-identified under HIPAA, or with each patient's authorization, and several data programs now publish what they want from a practice. Mercor states USD 80,000 to 820,000 for a medical practice (listing published 2026-10-17, checked 2026-11-09); no practice has confirmed a payout.

Patient records are one holding within AI training data licensing.

DataPacts Editorial Team checked the program pages, filings and rules cited here on 2026-11-09 and 2026-11-10, following how we source, date and check every figure.

What a Medical Practice Holds That AI Developers Ask For

Buyers ask practices for four kinds of records: free-text physician notes in the EHR, imaging studies with signed reports, raw diagnostic waveforms, and recorded patient visits, while operational records carry no patient data at all. Mercor lists all three health categories (checked 2026-11-09).

The table compares what programs state they want from a provider, as of 2026-11-09, with the exclusions each states.

Record type What programs state they want Stated exclusions Source
EHR physician notes free-text notes; 2,500+ patients or 10 clinicians; longitudinal records; de-identifiable (Mercor) synthetic charts; records without notes; data licensed exclusively through a broker Mercor listings API
Imaging studies DICOM with signed reports; de-identifiable including burned-in text (Mercor); imaging and pathology reports (Gradient Health) images without reports; exclusive contracts Mercor listings API; gradienthealth.io
Diagnostic waveforms raw ECG, EEG or EMG files, not only images (Mercor) none stated Mercor listings API
Recorded visits visits with consent covering secondary use; transcripts or clear audio (Mercor) scripted visits; recordings without consent Mercor listings API
Operational records not listed by any health program reviewed n/a none (the gap)

Operational records sit outside the health listings. The data-type view is medical and clinical data for AI training.

What a Practice May License Without Patient Authorization

A covered practice may license health data without patient authorization only once it is de-identified, because licensing protected health information for a fee is a sale that needs each patient's authorization. Four routes exist under 45 CFR Part 164 (eCFR as of 2026-11-05).

Route What the practice may license Condition Citation
De-identified data records stripped of 18 identifier types (Safe Harbor) or certified by an expert outside the Privacy Rule once de-identified 45 CFR 164.502(d)(2), 164.514(a)-(b)
Patient authorization identifiable PHI the authorization must state that the disclosure results in remuneration 45 CFR 164.502(a)(5)(ii), 164.508(a)(4)
Limited data set data with 16 direct identifiers removed only for research, public health or health care operations, under a data use agreement 45 CFR 164.514(e)
Research disclosure at cost PHI disclosed for research not a sale only where the fee is a reasonable cost-based fee to prepare and transmit 45 CFR 164.502(a)(5)(ii)(B)(2)(ii)

The limited data set serves research, public health and operations, not AI licensing. De-identified data is not a prohibited sale, since the Privacy Rule does not apply to it. Removing identifiers is covered in de-identification before licensing data.

Substance Use Records and State Health Data Laws

Behavioral health and addiction treatment practices face a second federal consent regime, and some states add their own rules for health data outside HIPAA. 42 CFR Part 2 sets separate consent rules for substance use disorder records held by federally assisted programs, so such a practice cannot rely on the HIPAA routes alone.

Washington's My Health My Data Act (RCW 19.373, in force 2024-03-31) requires a signed valid authorization naming the buyer before consumer health data, including biometric data, is sold, and a violation is an unfair or deceptive act under chapter 19.86 RCW (RCW 19.373.090). A digital health company outside HIPAA may fall under it.

Who Wants Practice Records and on What Terms

Health data reaches AI developers through a few programs that publish terms for practices, and most of them are intermediaries that pass records on rather than the developers that train on them. The table lists eight programs as of 2026-11-09, alphabetical, each value the party's own statement. The wider field is mapped under who buys AI training data.

Program Role What it acquires or handles Stated payment terms Source
Gradient Health data partners intermediary imaging, EHR and pathology reports from hospitals and imaging centers revenue share each use; USD 3M x 40 % x 20 % = USD 240k (Gradient's illustration) gradienthealth.io
Handshake AI Data Partnerships company-data program names healthcare and pharmaceuticals and life sciences among 11 industries see buyer profile joinhandshake.com
HUMXN company data licensing company-data program names healthcare among 24 industries see buyer profile humxn.io
Mercor Data Monetization licensee (company-data program) three health listings: medical practice, imaging center, digital health USD 80,000 to 820,000; USD 80,000 to 620,000; USD 100,000 to 900,000 per listing; wire on delivery api.data.mercor.com; mercor.com/data
micro1 Company Data Partnerships licensee PHI excluded unless the Order Form allows it (s.5.7) License Price in the Order Form micro1.ai legal
Mode company-data program 10+ employees for medical see buyer profile data.mode.inc
Protege data providers intermediary (marketplace) healthcare among its domains revenue share with each use; percentage not public withprotege.ai
Shfa.ai medical data licensing intermediary EHR exports, FHIR, clinical notes "Medical facilities have been paid $300,000 to $3,000,000" (representative outcomes) shfa.ai

Fixed Fee or Revenue Share: How Health Data Programs Pay

Health data programs pay in one of two ways: a fixed fee for a delivered dataset, as Mercor states, or a recurring revenue share each time the data is used, as Gradient Health and Protege state. Mercor states that it wires payment after the anonymized dataset is delivered, "typically within 2-4 weeks of the signed agreement", and covers anonymization costs (checked 2026-11-09). Shfa.ai says its range describes "representative and potential outcomes only" (checked 2026-11-10).

Gradient Health's own illustration (checked 2026-11-09) is USD 3M x 40 % x a "typical" 20 % share = USD 240k; Protege's percentage is not public. Other structures are in AI data monetization models.

Terms That Follow the Records After Delivery

Program terms decide what the practice still controls after delivery, and the published ones keep access for the developer and liability with the practice. Three published terms show it (checked 2026-11-09):

  • Protege Provider Terms: a worldwide, royalty-free, non-exclusive license (s.1.1); the provider indemnifies (s.4.1); a liability cap of 2x fees in 12 months (s.6.2) with exclusions (s.6.3); licensee access continues 12 months, academic 3 years, after termination (s.7.2).
  • micro1 Data License Master Terms s.5.7 (updated 2026-11-08): PHI is excluded unless the Order Form allows it.
  • Mercor listings: data licensed exclusively through a broker, and imaging studies under an exclusive contract, are stated as not a fit.

The clause list is explained in AI data licensing agreements.

What Filed Health Data Deals Show About Price

The only public health data prices with a filing behind them come from Tempus AI, a clinical data company that licenses de-identified records, not from a medical practice. Tempus states more than 8.6 million de-identified patient records as of 2025-12-31 (10-K, Tempus's figure), and its filings give three values:

  • Pathos AI, 2025: USD 200 million in data license fees over three years, including USD 50 million upfront paid as of April 2025, for the sole purpose of training a foundation model (Tempus 10-K FY2025).
  • Pathos Neuro Order Form, 2026-10-22: up to USD 55.0 million, made of USD 50.0 million at USD 100 per delivered record plus USD 5.0 million for updates, for 500,000 neurology records over five years (Tempus 10-Q Q3 2026).
  • Bristol-Myers Squibb Onco SOW, 2026-10-14: USD 137.5 million in aggregate fixed payments through 2031-12-31 (Tempus 10-Q Q3 2026).

HistAI lists H&E slide prices to developers from USD 5.00 to USD 2.00 per slide (checked 2026-11-09), a vendor's price, not a payment to hospitals.

The USD 100 per record is one order form for neurology records, not a market price, and none of the three is a payment to a practice. More filed values sit in AI data licensing deals.

Training In-House or Pooling Records: What Epic and Truveta Show

Some health systems keep their records and let them train models without selling them, either through their EHR vendor or through a company they own together. Epic's Cosmos paper (v3, 2025-11-07) describes de-identified data covering 16.3 billion encounters and 118 million patients. Truveta states that it is built with and owned by US health systems, covers over 140 million patients and lists AI training and validation as a use case (checked 2026-11-09).

Licensing Health Records From the EU, Germany and Finland

Outside the US, health data is a special category of personal data, and the EU is building a permit route that sits beside private licensing rather than replacing it. GDPR Art. 9 prohibits processing health data unless an Art. 9(2) exception applies (applies from 2018-05-25). Regulation (EU) 2025/327, the European Health Data Space, entered into force on 2025-03-25 and applies from 2027-03-26, with Chapter IV on secondary use from 2029-03-26 (Art. 105). Its purposes include AI training (Art. 53(1)); holders supply data through health data access bodies within three months (Art. 60(2)), and patients may opt out (Art. 71(1)), so it is never a direct sale.

In Germany, StGB s.203 makes disclosure of patient secrets by physicians a criminal offense, with up to one year in prison or a fine, and up to two years where the offender acts for remuneration (s.203(6)); prosecution is on request only (s.205(1)). The Datenschutzkonferenz resolution of 2024-09-11 states that special-category customer data, such as health data, may transfer in an asset deal only with informed explicit consent (Art. 9(2)(a) and Art. 7 GDPR). The general legal bases are set out in GDPR and AI training data.

In Finland, the Secondary Use Act 552/2019, as amended by 1159/2025 (in force 2026-01-01 and 2026-05-01), gives commercial development, including AI product development, only anonymous aggregated statistical data.

Patient Records When a Practice Closes or Is Sold

A practice that closes still holds its patient records, and their duties do not end with the business. The German data protection conferences adopted a resolution on 2024-05-15 titled "Besserer Schutz von Patientendaten bei Schließung von Krankenhäusern" (better protection of patient data when hospitals close), and the asset-deal consent rule of 2024-09-11 covers health data in a sale.

Spirit Airlines' Bill of Sale, an airline sale, names 45 CFR 164.514 as the standard for consumer health data (Bankr. S.D.N.Y. 25-11897, Dkt. 1463, 2026-08-14); the sale is not approved as of 2026-11-09, with a hearing set for 2026-11-17 (Dkt. 1779). The route for a defunct holder is covered under selling data from a shut-down company.

Benefits, Risks and Downsides for a Practice, and the Options Besides Licensing

Licensing de-identified records can earn a practice revenue from charts it already keeps, but the practice carries the re-identification and contract risk, and not licensing is a valid outcome.

Benefits

  • Revenue from charts already kept, with ranges stated by Mercor (checked 2026-11-09).
  • Mercor states that it covers anonymization costs.
  • A revenue share can recur, as in Gradient Health's illustration.

Risks

  • Failed de-identification turns a license into a sale of PHI that needs authorization (45 CFR 164.502(a)(5)(ii)).
  • The DOJ rule (28 CFR Part 202, effective 2025-04-08) bars bulk US sensitive data, even de-identified, from buyers in or linked to China, Cuba, Iran, North Korea, Russia or Venezuela, with a health threshold of more than 10,000 US persons in 12 months (202.205).
  • Protege's provider terms put indemnity on the provider (s.4.1).
  • Program breaches happen: the Mercor litigation (N.D. Cal. 3:26-cv-02821-WHO) concerns contractors and applicants, not health data, stayed pending mediation as of 2026-11-09 (Dkt. 44), and is tracked under data buyer incidents.

Downsides

  • Licensee access continues after termination (Protege s.7.2).
  • Exclusivity limits other routes (Mercor).
  • No practice has confirmed a payout, so every range is a program's claim.

Alternatives

  • Train in-house or pool records, as Epic Cosmos and Truveta describe.
  • Use the EU permit route through health data access bodies, from 2029-03-26.
  • License operational records only.
  • Not licensing at all.

Unlicensed records keep their current confidentiality position, and the options are compared in alternatives to selling data to AI labs.

Steps From Chart Review to a Signed Health Data License

A practice reaches a signed health data license in six steps, and the first three decide whether there is anything to license.

  1. Inventory EHR, PACS, recordings and vendor contracts, and read each contract for limits on reuse, because no rule on EHR vendor terms is stated here.
  2. Screen out Part 2 substance use records.
  3. Choose the HIPAA route, or decide not to license.
  4. Agree who de-identifies the records and who pays for it.
  5. Compare written terms from more than one program on fee basis, exclusivity, indemnity, liability cap and post-termination access.
  6. Check the buyer's country against the DOJ rule, then sign.

A practice that cannot complete step 3 keeps the records unlicensed.

Where Provider Licensing Meets Clinical Data, Health Privacy Law and Other Industries

Healthcare is one sector among many that license records to AI developers, and its professional secrecy duties resemble those of law and accounting firms. The sector overview is data licensing by industry, and law firms licensing data face a comparable duty, as do accounting and tax firms.

Imaging records have their own page, medical imaging and pathology data, and lab records belong with biotech and life sciences labs.

The federal and state overview is US AI training data law, and the HIPAA detail sits in HIPAA and AI training data. This page is information, not legal advice.

Programs, Deals and Rules Named on This Page

Each program and deal above has or will have its own page with dated terms and sources.

Frequently Asked Questions

Can a medical practice sell patient data to AI companies?

Yes, once the records are de-identified under HIPAA or each patient has signed an authorization that states the practice is paid. Identifiable records licensed for a fee without that authorization are a prohibited sale (45 CFR 164.502(a)(5)(ii)).

How much do AI companies pay for medical records?

No practice has published what it received. Mercor states USD 80,000 to 820,000 for a medical practice (checked 2026-11-09), and Tempus filed a price of USD 100 per delivered record in one deal (10-Q Q3 2026). The method is covered in what company data is worth to AI companies.

Not under HIPAA, because de-identified data falls outside the Privacy Rule. Part 2 records, Washington consumer health data and EU health data follow their own consent rules.