Can a health tech company license its data to AI companies?
The company’s own work record can be a candidate, and the patients’ records cannot. A health technology company handles protected health information on behalf of customers, usually under strict agreements, and none of that is licensed. What remains is how the software was built, supported and kept safe, which is often well documented.
What a health tech company has that is licensable
| Product requirements and design pages | How a clinical workflow was turned into software, with the trade-offs that were weighed along the way. |
| Engineering and release records | Change histories, test plans and release notes that show how a regulated product is kept stable. |
| Support tickets from clinics and users | Questions about the software, with the answers, and with any patient detail removed or the ticket dropped. |
| Quality and safety procedures | The company’s own written methods for testing, review and handling defects. |
| Implementation and training notes | How the product was rolled out at a clinic, and what staff found hard to learn. |
Patient data is not the company’s to license
When a health tech company processes patient information for a hospital or practice, it usually does so under a business associate agreement that limits it to the customer’s purposes. The company does not own that data. The starting rule is that nothing from patients, or from systems that touch patients, is included.
Tickets and chat can still contain it
A support ticket can include a screenshot with a patient’s name, and an engineer can paste a record into chat to explain a bug. This is why the review of text is thorough, and why a ticket with any patient detail is dropped, not just cleaned.
Design reasoning is the valuable part
Health software is built under constraints most products do not have: safety review, audit trails and rules on access. The documents that explain how those constraints shaped a design are rare, and they carry no patient information if written well.
What stays out for a health tech company
| Patient records and images | Anything that identifies or describes a patient stays out of every set. |
| Customer clinic and hospital data | Material that belongs to the provider customer stays out unless the customer agrees in writing. |
| Tickets with patient detail | A ticket that contains any patient information is dropped, not partly cleaned. |
| Regulatory submission material | Files prepared for a regulator are screened with counsel before any use. |
An example, invented for illustration
A scheduling software company serving physical therapy clinics has 70 staff and eight years of product history. The owner selects the design decision pages, the release records and the quality procedures, and excludes every ticket mentioning a patient. Counsel checks that the customer agreements allow de-identified use of the company’s own documents. Names are replaced with stand-ins, and the owner approves a sample of design pages and release notes.
Questions owners ask about this
Can we license de-identified patient data we process for clients?
Not on your own authority. The data belongs to the provider and is governed by your agreement and health privacy rules, so it would need the provider’s explicit permission and expert review.
Does HIPAA apply to our internal documents?
Only where they contain protected health information. Documents that never touched patient data are outside it, and the review checks that claim before it is relied on.
What about wellness apps that are not under HIPAA?
They face other rules on consumer health data, which differ by place and are tightening. Treat user data as out, and license only the company’s own work record.
Do customers have to know?
Where an agreement limits how your own documents can be used, yes. Counsel reads the customer agreements before anything is chosen.
Didn't find your question? Ask us directly.
Keep reading
Records to look at first
- Support tickets: The whole thread, wrong guesses included, with customers replaced by stand-ins.
- SOPs and knowledge bases: Procedures with their edit history and comments; published help articles add nothing.
- Jira data export: How to get issues with their comments and links out of Jira, and the secrets to remove first.
Other industries
- Healthcare practices and clinics: Administrative records of a medical or dental practice, de-identified to the HIPAA standard, with clinical notes left out.