Do providers need patient consent to license de-identified AI data?

No, HIPAA does not require explicit patient authorization to license data that has been properly de-identified. HHS states that the Privacy Rule imposes no restrictions on use or disclosure of properly de-identified health information. The work is in proving the data meets the standard, using either Safe Harbor or Expert Determination.

What does HIPAA say about de-identified data and consent?

HIPAA defines de-identified health information as information that does not identify an individual and for which there is no reasonable basis to believe it can be used to identify an individual.

Once PHI is de-identified under the Privacy Rule, HHS says it is no longer PHI and may generally be used or disclosed for any purpose, subject to other applicable laws. That last phrase matters. HIPAA is one layer, and your counsel should check what other laws apply to your specific dataset and deal.

The Security Rule follows the same logic. HHS notes that it does not require safeguards for information that is no longer PHI.

What are the two HIPAA de-identification pathways?

HHS describes two pathways: a formal statistical determination by a qualified expert, or removal of specified identifiers with no actual knowledge that the remaining information could identify the individual.

What must you remove under Safe Harbor?

Safe Harbor requires removal of 18 identifier categories listed in 45 C.F.R. § 164.514:

1. Names
2. Geographic subdivisions smaller than a state, subject to the ZIP-code rule
3. Dates directly related to an individual
4. Telephone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health-plan beneficiary numbers
10. Account numbers
11. Certificate or license numbers
12. Vehicle identifiers and serial numbers, including license plates
13. Device identifiers and serial numbers
14. Web URLs
15. Internet Protocol addresses
16. Biometric identifiers
17. Full-face photographs and comparable images
18. Any other unique identifying number, characteristic, or code

The ZIP-code rule has a hard threshold. You may keep the initial three digits only if the geographic unit formed by combining all ZIP codes with those digits contains more than 20,000 people. Otherwise the digits must be changed to 000.

Removing the 18 categories is not the whole test. You must also have no actual knowledge that the remaining information could identify the individual.

Free-text clinical notes, images and device logs are common places for identifiers to remain. Item 18 is a catch-all, so a unique code or characteristic counts even if it is not named elsewhere on the list. Our guide to data anonymization before you sell your data covers the preparation work.

What does Expert Determination require?

Expert Determination requires a person with appropriate knowledge and experience in generally accepted statistical and scientific principles and methods. That person must determine that the risk of re-identification is very small, and the method and results must be documented.

This pathway fits datasets where Safe Harbor would strip too much, because the expert assesses the risk of the specific dataset rather than applying a fixed list.

What does Expert Determination cost?

We cannot give a verified dollar figure as of October 2026, and HIPAA's rule text does not set one. Ask each candidate expert for a written quote, and confirm in writing what the deliverable includes. At minimum it should include the documented method and results, since the rule requires both.

Can you keep a re-identification code?

Yes, with limits. A covered entity may assign a re-identification code, but the code cannot be derived from or related to information about the individual, and it cannot otherwise be capable of translation into the individual's identity.

You also must not use or disclose the code for another purpose, and you must not disclose the mechanism for re-identification. In a license, that means the key and the mapping table stay with you and never go to the buyer.

Does your Business Associate Agreement allow de-identification and licensing?

Check the text. HHS says a business associate's process of de-identifying PHI is itself a use of PHI, so the Business Associate Agreement must authorize it.

HHS recommends that the BAA specify whether the business associate may de-identify PHI and may also specify the permitted uses and disclosures of the resulting de-identified information.

The cited HHS materials do not say that every standard BAA authorizes commercial licensing, AI training, resale or onward disclosure. Whether yours does depends on its exact wording. If it is silent or narrow, amend it before anyone de-identifies your data for a commercial purpose.

What should your Notice of Privacy Practices say?

The HIPAA materials we rely on do not supply model NPP language for secondary AI use, and we are not offering boilerplate here. Because de-identified data is no longer PHI, HIPAA's consent mechanics do not drive the licensing decision. If you want to describe AI-related uses in your NPP, have counsel draft and review the wording against the rest of your notice.

Which contract terms reduce re-identification risk?

No HIPAA rule we cite prescribes specific anti-re-identification clauses for an AI data license. These are risk-control terms your counsel drafts. Tie them to the standard you relied on:

• No re-identification attempts. The buyer agrees not to identify, or try to identify, any individual in the data.
• No linking. The buyer agrees not to combine the data with other information in a way that could identify a person. Safe Harbor depends on there being no actual knowledge that the remaining information could identify someone, so a clause here protects the basis for your determination.
• No keys or mechanisms. The contract states that you provide no re-identification code or mechanism. This mirrors the rule that you must not disclose the mechanism for re-identification.
• Expert conditions carried forward. If you used Expert Determination, attach or reference the documented method and results, and require the buyer to stay within the conditions the expert relied on.
• Downstream flow-down. Anyone the buyer shares the data with accepts the same restrictions.
• Notice and termination. The buyer must tell you promptly if it finds identifying information, and you may terminate for breach.

These terms matter because HIPAA's Security Rule does not require safeguards once the data is no longer PHI. Your contract becomes the main control. HHS also says a cloud provider that receives and maintains only properly de-identified information is not a business associate for that activity, so a BAA with the buyer's hosting vendor will not do this work for you.

For how these terms show up in real deals, see AI data licensing: how the deals and terms work.

Can patients opt out of de-identified data being used for AI?

HHS's cited HIPAA materials do not state that patients have a HIPAA right to opt out of uses of properly de-identified data. Any opt-out you offer would come from your own policy, a contract or another law, so confirm with counsel before promising one.

What is the practical sequence?

1. Decide the pathway: Safe Harbor or Expert Determination.
2. If Safe Harbor, remove all 18 categories, apply the 20,000-person ZIP rule, and check free text and images for leftover identifiers.
3. If Expert Determination, hire a qualified expert, get a written quote, and keep the documented method and results.
4. Read your BAAs. Confirm that de-identification is authorized and what the resulting data may be used for.
5. Keep any re-identification code and mapping on your side only.
6. Add the contract terms above and have counsel review the full license.

This is general information, not legal advice, and a lawyer should read how these rules apply to your data and deal.

Once the data is ready, you can compare companies that buy data for AI, and use data valuation methods and real deal prices to frame your ask.