HIPAA and licensing medical practice data to AI
Short answer: Selling protected health information generally needs each patient's authorization, while properly de-identified data is not PHI. Mode excludes health records from its deals, so medical practices should expect any license to cover non-clinical operations only.
The rules
- Sale of PHI: 45 CFR § 164.502.
- De-identification standards: HHS guidance.
Program position
Mode: 'Health records, payment card data and children's data are excluded' (Mode affiliate FAQ).
This is general information, not legal advice. Talk to your own attorney or compliance advisor before you share or license any records.
What could your company's records be worth?
Answer 6 questions. See the published range for a company like yours and which program fits. Takes about 2 minutes.
Start the free checkFrequently asked questions
Does the 15-employee minimum apply to clinics?
Mode lists 15+ for medical.
Can a practice license staff email?
Clinical email usually contains PHI. Scope with counsel.
Sources
- 45 CFR § 164.502, including the sale-of-PHI rule (Cornell LII)
- HHS guidance on HIPAA de-identification
- Mode affiliate FAQ (PDF, dated Oct 14, 2026)
- Mode / BizBuyData referral page
Referral-fee disclosure: we may be paid by a program if your company signs with it after using this site. General information only, not legal advice.