Patient data permissions
In the U.S., HHS describes two de-identification routes under the HIPAA Privacy Rule: Safe Harbor removal of listed identifiers, and Expert Determination by a qualified statistician (U.S. HHS Office for Civil Rights). In the EU, health data is special-category data under GDPR Article 9 and needs an additional condition beyond an ordinary lawful basis (EUR-Lex). Neither framework is a licence to commercialise; institutional agreements and ethics approvals also matter.
Clinician label ownership
- Labels made by employed clinicians may belong to the hospital under employment terms.
- Labels made by contracted readers belong to whoever the reading contract assigns.
- Labels made inside a research study may be bound by the protocol and consent form's stated purposes.
Pre-annotation checklist
| Question | Why it matters |
|---|---|
| Does consent or the IRB/ethics approval cover commercial AI training? | Research-only scope can block licensing later. |
| Is re-identification risk assessed for images (faces, burned-in text, DICOM headers)? | Image metadata often carries identifiers. |
| Who adjudicates reader disagreement? | Buyers will ask how ground truth was set. |
Regulatory note
The EU AI Act places data-governance obligations on training, validation and testing data for high-risk systems, which can include medical devices (EUR-Lex). This is general information, not legal advice; consult qualified counsel in each jurisdiction.
Have an annotated dataset or specialist expertise?
Tell us what you own, how the labels were reviewed and which rights you can license. A short overview of your dataset or annotation business is a useful place to start.
Prefer to write directly? hello@callwavemedia.com