Can a practice license medical imaging data to AI companies?
Sometimes, and only after the patient information is removed to a standard your counsel accepts. Medical imaging is one of the most regulated kinds of data a company can hold, and one of the most wanted, because a scan paired with the written finding of the doctor who read it teaches a model what to look for. The patient chart stays out. What can be considered is the image and the finding, stripped of everything that points to the person.
What an imaging center or practice holds
| Studies stored in DICOM | The standard file format for x-ray, CT, MRI and ultrasound. Each file carries the image plus a header full of patient and equipment details. |
| Written findings and reports | The read: what the radiologist or specialist saw, measured and concluded. A study without its report is worth much less. |
| Follow-up and outcome links | A later study of the same patient, or a biopsy result, that confirms or corrects the first read. Rare, and highly valued once de-identified. |
| Dental and eye images | Intraoral x-rays, panoramic films and retinal photos, often in their own formats, each with the chart note that explains them. |
| Equipment and protocol records | Which machine and settings produced a study. This explains why two scans of the same thing look different. |
Why the patient information comes out first
In the US, a covered practice can share health data without patient authorization only once it is de-identified under HIPAA, by one of two methods. Safe Harbor removes eighteen listed kinds of identifiers. Expert Determination has a qualified expert certify that the risk of identifying anyone is very small. Which method fits, and who performs it, is decided with your counsel. We do not certify de-identification.
Imaging needs more care than a spreadsheet. Names and dates sit in the DICOM header, but they can also be burned into the image pixels, written on a scanned requisition, or visible in the shape of a face in a head CT. Each of these is found and removed or masked.
Outside the US the rules differ. Under the GDPR, health data is a special category, and pseudonymized data is still personal data.
Who owns the images
Ownership of medical records varies by state, and the patient keeps rights to access them. A hospital contract, a teleradiology agreement or a group practice agreement may also limit what one party can do with studies it reads or stores. Counsel checks each agreement before any study is counted.
Reading physicians can matter too. If outside radiologists wrote the reports under a contract, that contract may say who owns the reports.
Preparing a sample
Start with counts: studies by modality and body part, the years covered, the share with a final report, and how many have a follow-up. Then a small set is de-identified, checked by the person counsel names, and reviewed by the owner before it leaves.
The liability question is part of the talk. When a lab asks the seller to carry the risk of a re-identification, the terms should place that risk with whoever does the de-identification.
What stays out of a medical imaging set
| Patient charts and identifiers | Names, record numbers, dates of birth, addresses and every other listed identifier are removed, and the chart itself is never part of the set. |
| Images with burned-in details that cannot be masked | Dropped rather than risked. |
| Studies covered by a contract that forbids it | Hospital, payer or research agreements that limit reuse are honored. |
| Research studies under a consent that excludes it | Images collected for a study follow that consent form and the ethics board approval behind it. |
More on this: how personal details are removed, who carries the risk and how you get paid.
An example, invented for illustration
Consider an outpatient imaging group with forty staff at its peak and ten years of studies, most with a signed report and some with a follow-up scan. Counsel chooses Expert Determination. A sample of three hundred chest x-rays goes through header scrubbing, a pixel check for burned-in text, and date shifting, and an outside expert signs off. Studies read under one hospital contract stay out because that contract limits reuse.
Questions owners ask about this
Is removing the DICOM header enough to de-identify a scan?
Rarely on its own. Text can be burned into the pixels, a face can be rebuilt from some head scans, and dates in file names can give a patient away. Each is checked, and counsel decides when the set meets the standard.
Do we need the radiology reports, or just the images?
The reports carry most of the value. An image with the finding attached tells a model what a trained reader saw; the same image alone is one picture among millions.
Who does the de-identification work?
It is agreed case by case once a buyer is interested. Often the buyer pays for it, sometimes a third party does it, and either way the owner reviews a sample first.
Didn't find your question? Ask us directly.
Keep reading
Related kinds of records
- Image collections: Product shots, condition photos, scans and design archives, sorted by who owns each picture and what note came with it.
Industries that keep these records
- Healthcare practices and clinics: Administrative records of a medical or dental practice, de-identified to the HIPAA standard, with clinical notes left out.
- Imaging and diagnostics centers: De-identified reports, protocol notes and aggregate scheduling; patient identifiers, raw scans and rare cases stay out.