Healthcare Practices & AI Data Licensing: Admin Data, HIPAA Safe Harbor & What's Off-Limits

A healthcare practice can license only records with no protected health information: HR workflows, IT tickets, vendor and facilities management, internal training and policies. Clinical notes, claims, scheduling and patient messages are PHI, and HIPAA treats disclosing PHI for payment as a sale requiring each patient's authorization. Mode's medical minimum is 10 employees; scoping decides everything.

Why would AI buyers want a medical practice's data?

Healthcare administration is labor-heavy desk work: intake, scheduling, insurance verification, prior authorizations, coding, billing follow-up and credentialing. AI developers building agents for office work want examples of exactly that. Mode's program page groups medical with accounting and finance at a lower headcount minimum than general businesses, which signals buyer interest.

The problem is that nearly every one of those workflows runs on patient information. The demand is for the part of your operation you are least able to share.

Does your practice meet the minimum?

Mode's application asks for full-time desk employees separately from non-desk employees. Front-desk, billing and administrative staff are desk employees; how Mode counts clinicians is a question for intake. Confirm the threshold before you invest time in scoping.

Why is PHI off-limits?

Three HIPAA rules close the door on licensing patient records as they sit in your systems.

Selling PHI requires authorization. Under 45 CFR 164.508(a)(4), "a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information," and the authorization must state that the disclosure will result in payment to the covered entity. Collecting that from every patient whose information appears in your inbox or practice management system isn't realistic.

De-identified data is not PHI, but the bar is specific. HIPAA allows two routes, both in 45 CFR 164.514 and explained in HHS guidance:

The 18 Safe Harbor identifiers include names, geographic units smaller than a state, all date elements except year (for dates directly related to an individual), phone and fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers and full-face photos. Free-text messages are where Safe Harbor tends to fail: "the patient we saw Tuesday after the fall at the school" carries no name and may still identify someone.

Who does the de-identifying matters. Mode says it removes sensitive material and transforms identifiers in the agreed copy before onward delivery. That means its staff and tools handle the unfiltered copy first. If that copy contains PHI, Mode would be receiving PHI. That generally requires a business associate agreement and a permitted purpose, and receiving money for the data raises the sale-of-PHI rule above. Ask Mode in writing whether it signs BAAs. The cleaner route is to export nothing containing PHI.

The bar is getting tighter, not looser. The consumer privacy ombudsman's report in the Spirit Airlines data sale cited the Justice Department's view that advances in technology increasingly enable re-identification, according to a docket summary by Stretto. That sale agreement still required certification under the HIPAA standard for any PHI involved.

Does it matter what kind of healthcare organization you are?

Yes. HIPAA's rules attach to the role you play, and the role changes what you can license.

Business associates face the sharpest version of the problem. A billing company's operational record, its claim follow-up threads, denial workflows and payer calls, is exactly what AI buyers want, and almost all of it is made of its clients' PHI. Under the HIPAA rules, a business associate may use PHI only as its agreement with the covered entity permits. Licensing it for the business associate's own revenue is not a use those agreements normally allow. What remains licensable is the same narrow set any company has: internal HR, IT, vendor and training records.

Group practices owned by private equity or managed through an MSO should also confirm which entity owns the systems before anyone signs. Mode says it reviews "ownership and access terms" before making an offer, and a split between the practice and the management company is exactly the kind of issue that slows a deal or shrinks it.

What administrative data is realistically licensable?

"Admin" describes a function, not a privacy status. Sort by whether the system can hold patient information.

That leaves a smaller, cleaner asset. It may still be worth licensing for a practice with years of well-documented operations, but it is not the record buyers most want.

What other rules apply?

• State health privacy laws. Several states impose medical confidentiality rules stricter than HIPAA. Your counsel should check the states you operate in.
• Substance use disorder records. Federally assisted SUD programs are covered by 42 CFR Part 2, which has its own disclosure limits.
• Employee data. California employees' personal information has been fully covered by the CCPA since January 1, 2023, per the California Privacy Protection Agency. Emory law professor Ifeoma Ajunwa told Business Insider that whether employee consent extends to a sale is "an ethically gray area."
• Payer and vendor contracts. Payer agreements, EHR licenses and clearinghouse contracts may restrict how data from those systems is used or who owns it.

What could a practice be paid?

No public figure is specific to healthcare. The attributed ranges:

Mode says its calculator "is illustrative, not a guaranteed offer." It reviews the systems and dates in scope, years of history, record volume and quality, and ownership terms before making a fixed offer. Removing every PHI-bearing system takes out most of a practice's record volume, so expect a narrower scope to price below headcount-based estimates. Our methodology explains how the estimate below is built.

How does the process run?

Our process guide covers each stage.

What should a practice administrator check before signing?

• A written scope that names every included system and states that none contains PHI.
• A HIPAA review by your privacy officer and counsel, including your notice of privacy practices.
• Mode's position on BAAs and on how it would handle PHI found in an export.
• Filtering evidence. Mode's release says it built its own PII-removal tools after other vendors would not let it audit theirs. Ask for documentation. No one can honestly promise data is fully anonymous; see our explainer on de-identified versus anonymized data.
• Insurance. Dan Novaes said Mode was "working on" a third-party insurance policy for potential data leaks. Ask whether it exists.
• Staff notice before anything is exported.

Our risk checklist covers each point in more depth, and our valuation guide explains what drives offers.

Who are we?

DataLicensingAudit is an independent referral partner of Mode. If your practice signs after we introduce it, Mode may pay us a referral fee; your payment does not change. See our disclosure. We are not HIPAA counsel and do not give legal advice. Talk to your counsel and privacy officer.