Can a medical practice sell its data to AI?

Mode's 15+ rule for medical, HIPAA's sale-of-PHI rule, and what non-clinical records a physician practice might license.

Last updated 5 sources cited1 min read

Short answer: Only non-clinical records, in practice. HIPAA generally bars selling protected health information without patient authorization, and Mode says it excludes health records. Mode lists medical at 15+ employees; Census counts 21,367 U.S. physician offices with 15+.

On this page
  1. HIPAA
  2. What could be in scope
  3. Size
  4. Frequently asked questions
  5. Sources

HIPAA

The Privacy Rule generally prohibits the sale of protected health information without authorization (45 CFR 164.502). De-identified data under HHS's standards is not PHI (HHS), but Mode excludes health records regardless (Mode FAQ).

What could be in scope

  • Scheduling and front-desk workflows with patient data removed.
  • HR policies, training and vendor management.
  • Billing processes described at process level.

Size

Mode lists minimum team sizes of 10+ employees for legal, 15+ for accounting, medical and finance, and 50+ for all other businesses, for companies based in the US, Canada, the UK or Australia with several years of records they own (Mode).

Industry (U.S. firms, 2022)All firms15+ staff30+ staff50+ staff100+ staff
Offices of physicians (NAICS 6211)145,30521,36710,6426,2953,280

Source: U.S. Census Bureau, Statistics of U.S. Businesses 2022, detailed employment sizes. Firms (enterprises) by paid employees; contractors are not counted. Each column sums the Census size classes at or above that size.

This is general information, not legal advice. Talk to your own attorney or compliance advisor before you share or license any records.

What could your company's records be worth?

Answer 6 questions. See the published range for a company like yours and which program fits. Takes about a minute.

Start the free check

Frequently asked questions

Is a patient portal message clinical?

Usually it contains PHI. Keep it out.

Does de-identification make it licensable?

HIPAA de-identification can remove data from PHI status, but Mode excludes health records anyway.

Sources

  1. 45 CFR § 164.502, including the sale-of-PHI rule (Cornell LII)law.cornell.edu
  2. HHS guidance on HIPAA de-identificationhhs.gov
  3. Mode affiliate FAQ (PDF, dated Oct 14, 2026)bizbuydata.com
  4. Mode / BizBuyData referral pagebizbuydata.com
  5. U.S. Census Bureau, Statistics of U.S. Businesses 2022, detailed employment sizeswww2.census.gov

Referral-fee disclosure: we may be paid by a program if your company signs with it after using this site. General information only, not legal advice.

Compare programs

Best AI data program for a medical or dental practice (non-clinical)

Side by side from each program's own pages. Rankings follow published rules, not referral fees.

Related

All dental and medical practices guides · Every guide