Can a medical or dental practice license its data to AI companies?
Sometimes, and only after the records are de-identified to the HIPAA standard. The material with the clearest path is administrative, not clinical: scheduling and reminder messages, billing and denial letters, intake procedures and staff handover notes. Patient records are protected health information, so a practice has to confirm it has the right to use the data before anything is prepared.
What a practice keeps that may be licensable
| Scheduling and reminder messages | The texts, emails and call scripts that book, move and confirm visits. They show how real people reschedule, cancel and ask questions in plain language. Names, dates of birth and phone numbers have to come out first. |
| Billing and denial correspondence | The back and forth with payers over a rejected claim, the appeal letter and the reply. A thread that ends in a paid claim shows what worked. Account numbers and patient identifiers are removed. |
| Intake process documents | The blank forms, checklists and instructions front desk staff follow when a new patient arrives. A blank form holds no patient data. A filled one usually does and stays out. |
| Internal procedures | How the practice opens and closes the day, handles a late arrival, prepares a room or processes a referral. Written once, revised many times, and often the best record of how the office really runs. |
| Staff handover notes | The short notes one shift leaves for the next about open tasks, equipment and follow-up calls. Those that mention a patient are cleaned or dropped. |
| Operations tickets | Requests to the office manager about supplies, room setup, system access and vendor visits. These are about running the place, not treating anyone. |
How a practice records its work
A practice with 30 or more people usually keeps its work in three places. The electronic health record holds the clinical chart. A practice management system holds appointments and billing. Email, texting tools and shared folders hold everything else. The third group is where most of the administrative material lives, and it is also where patient names slip into a message by accident.
That mix matters. A reminder that says only "your visit is tomorrow, reply C to confirm" is easy to prepare. A note that says "the patient with the knee surgery called again about pain" is not. The first kind is useful because it is routine. The second is clinical, even though it sits in an email.
What makes a practice's administrative records more or less useful
Value comes from complete threads with a clear outcome. A denial letter, the appeal and the final payment decision, kept in order, teach more than a pile of unrelated letters. The same is true of a reminder and the reply that followed it. A set that keeps the whole exchange is worth more than a set of fragments.
Value falls when the text is mostly boilerplate, when staff notes are too short to follow, or when the cleaning has to remove so much that the sentence no longer makes sense. Clinical notes are the hardest part. They are full of names, dates, places, rare conditions and free text that can point to one person, and they are the part most practices should expect to leave out.
Privacy and rights rules that shape the cleaning
In the United States, a medical or dental practice is usually a covered entity under HIPAA, the federal health privacy law. Health information that can be tied to a person is protected health information. The rule offers two routes to de-identification. Safe Harbor removes a long list of identifiers, such as names, addresses, dates tied to a person, phone numbers and record numbers. Expert Determination is a written finding by a qualified statistician or similar expert that the risk of identifying anyone is very small. We do not make that finding. A qualified expert does.
Two more checks come before any cleaning. A covered entity must have the right to use the data this way, and that depends on its patient agreements, its payer contracts and its own privacy notice. State laws can add rules, and some states treat mental health, substance use treatment or reproductive care with extra care. Your counsel confirms what applies. This page is not legal advice.
What a practice leaves out
| Clinical notes and charts | Left out by default. Free text from a visit is the hardest material to de-identify and the easiest to get wrong. |
| Images, scans and lab results | These are patient data by nature and are not part of an administrative sample. |
| Anything tied to a named patient | Names, phone numbers, addresses, insurance member numbers and dates linked to a person are removed or replaced before a sample leaves. |
| Sensitive care categories | Mental health, substance use and reproductive care records are excluded unless counsel confirms a clear basis for including them. |
| Payer contract terms | Rate schedules and negotiated terms may be under confidentiality clauses with the payer and stay out. |
An example, invented for illustration
Take a regional dental group with forty staff that wants to see what it holds. It starts with reminder messages and payer appeal letters, not charts. Staff names are replaced with stable stand-ins, and every patient name, phone number and date of birth is removed. The remaining text is checked against the HIPAA Safe Harbor list, and an outside expert reviews the set before it is treated as de-identified. Counsel reads the payer contracts. The practice manager and the owners review a small sample and decide what goes forward.
Questions owners ask about this
Do patient records ever leave the practice?
Only after de-identification to the HIPAA standard, by Safe Harbor or by an Expert Determination made by a qualified expert. The practice approves a sample before it leaves. A set that cannot meet the standard stays in the practice.
Why start with scheduling and billing instead of chart notes?
Administrative text carries far fewer identifiers and is written in a repeatable pattern. Chart notes mix names, dates and rare conditions in free text, so they take the most care and are usually left out.
Does our patient agreement let us do this?
That depends on the agreement, the privacy notice and the contracts you have signed. Your counsel reads them and says so. We do not decide it, and we do not start preparing records until you have an answer.
Our state has its own health privacy law. Does that change anything?
It can. Some states add rules on top of HIPAA, especially for sensitive categories of care. Your counsel confirms which apply, and any category they flag is left out of the sample.
Didn't find your question? Ask us directly.
Keep reading
Records to look at first
- Support tickets: The whole thread, wrong guesses included, with customers replaced by stand-ins.
- Call recordings: Gong, Zoom and phone-system calls; transcripts before audio, and consent before everything.
- SOPs and knowledge bases: Procedures with their edit history and comments; published help articles add nothing.
Other industries
- Insurance agencies: A quote, a renewal and a claim follow-up in the agency’s own words, with customers and carrier files kept out.