Your Patient Records Could Become AI Training Data – What Do Privacy Rules Say About De-Identified Health Data?

Long after a patient leaves the clinic, their records can take on a second life as algorithm training material. Health systems hold huge repositories of clinical data, and AI developers have clearly noticed.

BioStack’s seed round is a handy example of where the trend is heading. The company has raised $9.5 million, led by Peak XV, for a data network that links fragmented clinical records into datasets for AI and biotech companies. It says it covers the US, India, Brazil and Argentina, and claims access to more than 100 million de-identified records.

De-identified data sounds reassuring to patients, but the label is doing a lot of work, and what it means in law varies between countries. The next sections follow a record’s route into a training dataset and what the rules say in the four markets involved.

Stitching Scattered Files Into One Patient Story

A useful AI dataset is rarely a single hospital file. It pulls together clinical notes, lab and pathology results and medical images, then adds prescriptions, medication histories, procedures, treatments and eventual outcomes, building a longitudinal view of a patient’s care.

Companies in this space describe what they build as data infrastructure: it connects records from hospital systems and packages them for medical AI development, clinical research and drug discovery. The industry’s shorthand for the result is multimodal, meaning one dataset holds different kinds of data side by side.

The commercial appeal is reach and diversity. A model trained on a single provider’s records learns that provider’s habits, whereas records from different health systems, countries and populations introduce it to a wider range of diseases, care patterns, imaging equipment and clinical practice.

Can “De-Identified” Labels Really Guarantee Patient Privacy?

Calling data de-identified isn’t the same as stripping away every trace of a person. It usually means direct identifiers such as name, address, medical-record number, dates of service and face images have been removed or transformed, so what’s left can’t readily be traced back to an individual.

The catch is re-identification. A rare diagnosis, an unusual mix of age, location, dates and treatments, or a match against another dataset can sometimes point back to a real person even after the obvious labels are gone. That’s why privacy frameworks treat tidying up identifiers and reaching durable, legally recognised anonymisation as two different things.

In the US, HIPAA offers two recognised ways to get a record through the de-identification door. Safe Harbor removes 18 specified categories of identifier, while Expert Determination needs a qualified expert to conclude that the risk of an anticipated recipient identifying someone is “very small”. Meeting either standard lets covered entities share data without patient authorisation, though state law, contracts and research protocols can still limit how it’s used downstream.

India’s Digital Personal Data Protection Act 2023 governs the processing of digital personal data, which hands cross-border networks some homework: establishing whether a record still counts as personal data after processing, who the data fiduciary is and what legal basis applies. The rules to put the Act into practice are still being worked out, so “de-identified” doesn’t automatically clear every obligation.

Brazil’s LGPD generally leaves fully anonymised data outside its scope, as long as it can’t reasonably be linked to a person directly or indirectly, while pseudonymised data stays personal data. Argentina has a comprehensive personal-data law, No. 25.326, is party to Convention 108 and treats health information as sensitive data with heightened protection. In both, coded data is the grey area, since a key or mapping table kept elsewhere can still turn the file back into a person.

Who’s Buying It And What Do They Build?

AI developers use datasets like these to train and test models for medical imaging, clinical documentation, diagnosis support, prediction and patient triage. Biotech and pharmaceutical companies study the same patterns to track how diseases progress, how patients respond to treatment, whether a trial is feasible and where the next drug target might be.

Academic and clinical researchers use the records to study outcomes, care pathways and population-level patterns, while hospitals may supply the raw material under partnership arrangements and, in some models, receive value from the research or products that follow. In practice, that can mean tools that flag treatment risks and line patients up for trials.

The upside is faster, more representative AI development, and the bill arrives as governance: patients may not know their hospital visits fed a commercial dataset, and the networks behind it still need clear legal bases, security controls, contractual limits and re-identification testing. That holds across the sector for any company building them.

Clinical AI clearly needs large datasets, so the argument is moving to how data networks can show that privacy, consent and cross-border compliance are built in. Multi-country models make that test sharper, since a record may originate under one legal regime and be aggregated or used for model development under another.

Expect closer scrutiny of the line between de-identified, pseudonymised and anonymised data, and more demand for auditable records of where each dataset came from.