Authorized by each patient, or de-identified first
Can a physical therapy practice sell its data to AI?
Updated
Not with patients named in it: a practice that is a HIPAA covered entity needs each patient's authorization to be paid for their records, so licensing starts with de-identification.
Being paid for a patient's chart
45 CFR 164.502(a)(5)(ii) says that, except pursuant to and in compliance with 164.508(a)(4), a covered entity or business associate may not sell protected health information. 164.508(a)(4) requires an authorization for any disclosure that is a sale, and that authorization must state the disclosure will result in remuneration to the covered entity.
Two ways out of HIPAA's reach
164.514(b) treats health information as not individually identifiable once an expert determines the risk of identifying someone is very small, or once the Safe Harbor identifiers are removed. That list names full face photographic images and any comparable images, which matters to a clinic that films gait or movement.
HHS's de-identification guidance states that, regardless of the method used, the Privacy Rule does not restrict the use or disclosure of de-identified health information.
A limited data set
Between the two sits the limited data set: under 164.514(e) a covered entity may use or disclose one only if it enters into a data use agreement with the recipient, and only for research, public health or health care operations.
California and the EMR's own terms
California's Civil Code 56.10(d) adds that, except as a patient expressly authorizes, a provider shall not intentionally share, sell or otherwise use medical information for a purpose not necessary to provide health care services. Many PT systems already keep a de-identified use for themselves: the PT system terms board quotes each document, and every rule is on the register of physical therapy data rules.