Can an imaging or diagnostics center sell data to AI companies?
Only with great care. Imaging and diagnostics centers hold some of the most valuable and most regulated records there are. The patient is in every file, often several times over. Whether anything can be licensed depends on de-identification done to a recognised standard, and on the right to use the records at all.
What an imaging or diagnostics center has that could be licensable
| Radiology and diagnostic reports | The findings, the impression and the follow-up advice, written by a specialist. After de-identification, the language of a report is the useful part, separate from the images. |
| Scheduling and referral patterns | Which exams were ordered, how long the wait was and how many were rebooked. Aggregated, with no individual visits in view. |
| Protocol and technologist notes | How an exam was set up, why a repeat scan was needed and what the technologist recorded about image quality. |
| Billing and coding records | Codes, denials and appeal letters. Usable only in a form that carries no patient detail. |
| Images, if and when cleared | Scans themselves are a separate project with their own approvals. They are covered last, and only after the text work is done. |
Where the records live
Reports sit in a radiology information system, images in a picture archiving system, and bills in a practice management tool. Each one holds the patient in a different way, which is why they are assessed one by one.
Tell us which systems exist, how many years each holds and who can run an export. Do not send us any patient record when asking about fit. A description of the fields is enough.
What de-identification means here
In the United States, HIPAA's privacy rule describes two ways to treat health information as de-identified. One removes a listed set of 18 kinds of identifier, including names, dates more specific than a year, and contact details, and requires that the organisation has no actual knowledge that what is left could identify someone. The other is an expert determination, where a qualified statistician documents that the risk of identification is very small. Neither is a find-and-replace job.
Imaging adds its own traps. Scan files carry identifying fields in their headers, and some images have a name or date burned into the picture itself. Free-text reports can mention a name, a relative or a rare condition in a small town. All of it needs a documented review, and a center with a privacy officer should involve that person early. General background only; your counsel gives the legal advice.
What stays out for an imaging or diagnostics center
| Anything that is not de-identified | Patient names, record numbers, birth dates, addresses and contact details are not part of a package, whatever the buyer asks. |
| Raw image files with headers | Scans with their original header fields or burned-in text stay out until a separate, documented process has cleaned them. |
| Records of rare or small-group conditions | Where a few cases in a small area could point to a person, the records are dropped even if every field has been cleaned. |
| Referring doctor and insurer details | Physician names, plan numbers and claim identifiers are removed, since they can lead back to a patient. |
More on this: how personal details are removed, who carries the risk and how you get paid.
A sample, step by step
A regional imaging center with eighty staff has ten years of reports in its radiology system. The privacy officer and counsel agree on the route first. A small test batch of reports is de-identified, reviewed by a second person, and read as a sample. Images, billing detail and anything flagged as rare are held back. The center decides after seeing the sample whether to continue.
Questions owners ask about this
Is removing the patient name enough?
No. The identifier list is much longer than names, and free text can identify a person without one. The review covers every field and every sentence.
Can reports be used if patients signed a general consent?
A general treatment consent usually does not cover this use. The notice of privacy practices and state law need checking, and de-identification is normally the safer route.
Do we need to involve our referring doctors?
Not for properly de-identified reports, but contracts with hospitals or physician groups can restrict what a center does with their patients' data, so those are read first.
Should we send a few records so you can judge?
Please do not. Describe the fields and the systems instead. A sample is prepared only after the privacy review is in place.
How long do we keep the audit trail?
Keep the documentation of how de-identification was done for as long as your counsel advises. It is the record that shows the work was done to the standard.
Didn't find your question? Ask us directly.
Keep reading
Records to look at first
- Call recordings: Gong, Zoom and phone-system calls; transcripts before audio, and consent before everything.
- Accounting and ERP records: Invoices, approvals and memos from QuickBooks, Xero, Sage, NetSuite, SAP and Odoo; payroll and bank details never.
- SOPs and knowledge bases: Procedures with their edit history and comments; published help articles add nothing.
- Claims and underwriting files: A risk decision, its reasons and what happened next, with every policyholder removed first.
- Recordings made with consent: Recordings that people agreed to, with spoken details removed and anything unclear left out.
- QuickBooks data export: What to take from QuickBooks, which routes miss the memos and attachments, and what never leaves.
- Medical imaging data: Scans with their written findings, where patient privacy law and de-identification decide what can be considered.
Other industries
- Healthcare practices and clinics: Administrative records of a medical or dental practice, de-identified to the HIPAA standard, with clinical notes left out.