Licensing de-identified hospital data for research: a guide for hospitals and labs

Hospitals, labs and imaging centres hold years of images, test results and clinical records. Researchers and companies say in print that they need exactly this kind of data: almost half the papers we analysed say their evidence came from a single centre. Yet most of it never leaves the archive, usually not because nobody wants it, but because the path from archive to licensed dataset isn't clear.

Here's what that path involves.

1. Is there demand for your data?

Data is most valuable when it fills a gap: a population under-represented in research, a region with little published data, long follow-up, images paired with reports, or a rare condition. Data from India and much of Asia, for example, is scarce in the public datasets most AI is trained on. Before investing, check who has published a need for data like yours. That's what DIA does.

2. Governance comes first

• An institutional decision on whether and how data is shared.
• Ethics committee approval, or a waiver, for secondary use. Requirements vary by country.
• A check of what patients consented to.
• Compliance with data protection law, such as India's Digital Personal Data Protection Act 2023, HIPAA in the United States or GDPR in Europe. Take legal advice.
• A policy on permitted uses, for example no re-identification, no insurance underwriting and no onward resale.

3. Know what you have

Make an inventory: which modalities and tests, which years, what volumes, how much has reports, what clinical data links to it and how consistent the coding is. Most archives are messier than expected, with missing reports, mixed formats and duplicate patients. A data readiness assessment shows what the data can support before anyone promises it to a buyer.

4. De-identification

Headers, text burned into images, faces in head scans and free-text reports all need treatment (our guide). Dates are usually shifted rather than removed, to keep timelines intact. The method should be documented and checked.

5. Choose a sharing model

• Licensing de-identified extracts. The data leaves under a licence for a defined purpose and term.
• Federated or remote access. The data stays on your systems; researchers run analyses or train models without taking it away.
• Working through a partner. A partner finds buyers, handles contracts and delivery, and shares the licensing revenue with you.

Each option trades control, effort and income differently.

6. What you get back

Licensing revenue; research collaborations and co-authorship; a better-organised archive; and research that includes your patients' population. Set realistic expectations: income depends on demand for your specific data and builds over time.

7. Questions to ask any partner

1. Who decides which buyers get access, and can we refuse a buyer?
2. Which uses are prohibited?
3. Where does the data sit, and who can reach it?
4. How is revenue shared and reported?
5. Who carries liability if something goes wrong?
6. Can we leave, and what happens to data already licensed?

The BCONZ Data Collaboration Programme works with hospitals, labs and imaging centres on readiness, de-identification and licensing, with a share of licensing revenue. Talk to us.