Can a dental practice license its business records to AI companies?

Updated October 25, 2026 · How we research

Why is a dental practice so limited?

HHS (the U.S. Department of Health and Human Services) explains that the HIPAA Privacy Rule applies to health care providers that send health information electronically for standard transactions such as insurance claims or eligibility checks, whatever their size. That describes almost every dental office that bills insurance, including offices that use a billing service to send claims.

Protected health information covers anything that identifies a patient and relates to their health, their care, or payment for that care, in paper, electronic or spoken form. In a dental office that reaches well beyond the chart: a schedule, a ledger, a recall list or a voicemail can all qualify.

State law can add to this. In California, for example, the Confidentiality of Medical Information Act generally bars providers from disclosing medical information without the patient's authorization, apart from listed exceptions. Other states have their own rules, so ask your lawyer which apply.

What systems does a dental practice usually run on?

Most offices run on dental practice management software. Dentrix, for example, describes scheduling, charting and clinical notes, imaging, patient billing, insurance eligibility and electronic claims, and reporting dashboards in one product. Open Dental lists patient texting and reminders, online scheduling, a patient portal, web forms and electronic prescribing among its features.

In other words, the main system of record is built around patients and is full of protected health information. Licensable material, if any, usually sits elsewhere: staff email, shared drives, HR and payroll, accounting, vendor and supply records, and any internal manuals the team has written.

Which non-clinical records may interest buyers?

In a dental office, the possible candidates are limited to material written about the business rather than about patients, such as the following.

• Front-desk and office procedures written without real patient examples, such as opening and closing checklists or phone scripts.
• Insurance and billing workflow guides your team wrote from payer manuals and public sources, with no actual claims attached.
• Supply ordering, inventory and vendor management records.
• Equipment maintenance logs and facility records that do not mention patients.
• Staff training material, hiring checklists and policy manuals, cleaned of employee personal data.
• Marketing plans and practice-growth documents that contain no patient lists or testimonials.

What has to stay out of a dental license?

Treat the list below as the minimum. If a record could identify a patient, even indirectly, leave it out.

• Patient charts, clinical notes, periodontal charts, x-rays, intraoral photos and scans.
• Treatment plans, case presentations and consent forms.
• Appointment books, recall lists, patient ledgers and statements.
• Insurance claims, eligibility responses, explanations of benefits and pre-authorizations.
• Patient emails, texts, reviews you replied to, and call recordings.
• Prescription records, including electronic prescribing logs.
• Employee health records and any personal data about staff.
• Anything shared with a dental support organization, lab or billing service under a business associate agreement (the contract HIPAA requires when an outside company handles patient information for you).

What about de-identified patient data?

HHS says HIPAA places no restrictions on information that has been properly de-identified, either by removing a defined list of identifiers or by having a qualified expert determine that the risk of identifying anyone is very small. That is a specialized process, and the result is clinical data, not business records.

For that reason this site does not handle de-identified dental records, imaging or treatment histories. If that is your interest, start at licensemydata.com, which deals with clinical and medical data.

How should a dental practice decide whether it is worth pursuing?

Be realistic about volume. A single-location practice may have only a modest amount of non-clinical material once patient information is set aside, and that may not meet a buyer's minimums. Groups with many locations and a central business office tend to have more written procedures, vendor records and internal correspondence.

Start by listing which systems touch patients and setting all of them aside. Then check your business associate agreements and any group or management services agreement, since a parent organization may own or control the business records. Ask your privacy officer or lawyer to confirm what remains before you share even a sample. The guide on whether your company qualifies covers the common size and volume factors.

General information, not legal, tax or financial advice.