Health data is the most heavily regulated category in machine learning and also one of the best served by open datasets — because the research community built careful routes for sharing it. We are not lawyers and this is not legal advice — it is an account of the questions that come up, so that you can take the right ones to someone qualified.
De-identified is a defined standard, not a vibe
The reason so many medical datasets can be shared openly is de-identification, and it is worth knowing that this is a specific standard rather than a general intention.
Under the main US framework there are two recognised routes: removing an enumerated list of identifier types, or having a qualified expert determine that re-identification risk is very small. Other jurisdictions have their own standards, and anonymisation under European law is a notably higher bar than de-identification under the US rules — which means a dataset described as de-identified is not automatically anonymous everywhere.
The practical consequence: if a dataset says it is de-identified, ask under which standard. A dataset prepared to one regime's requirements may not satisfy another's, and that is a question for your compliance team with a specific answer rather than a judgement call.
Imaging is harder than records
Removing identifiers from structured records is tractable: you know where the fields are. Medical images are harder in three specific ways.
Embedded metadata. Imaging files carry extensive header metadata, frequently including patient name, identifiers, dates, institution and equipment details. Stripping it is essential and routinely incomplete, because the headers have many fields and private vendor extensions.
Burned-in text. Some modalities overlay identifying text directly into the pixels. No amount of header cleaning removes it; detecting and masking it is a separate step people forget.
The anatomy itself. Head imaging can be rendered into a recognisable face. Dental and skeletal features can be identifying. This is why defacing or skull-stripping is a standard step for shared head scans, and why 3D reconstruction from shared data is a genuine concern rather than a theoretical one.
If you are preparing imaging data for release, all three need addressing, and the second and third are the ones that get missed.
Access routes for data you cannot download
Much of the most useful clinical data is not openly downloadable, and the routes to it are well established rather than mysterious.
Credentialed access. Several major clinical repositories require completing human-subjects research training and signing a data use agreement. The process takes days to weeks and is open to industry researchers as well as academics more often than people assume. The resulting data is genuinely rich — this route is worth the paperwork.
Institutional partnership. Working directly with a provider, under an ethics approval and a data sharing agreement. Slow, and the only route to data that does not exist publicly.
Federated or in-situ analysis. The model goes to the data rather than the reverse. Increasingly common for multi-site clinical work and worth proposing when a partner cannot share data but will host computation.
Synthetic data. Useful for method development and poor for establishing clinical validity — see our synthetic data post. Reasonable for a pipeline prototype, not for evidence.
Regulatory status of the model, not just the data
The point most data-focused teams discover late: a model intended to inform clinical decisions may be a regulated medical device, and that status depends on its intended use rather than its architecture.
This affects your data work directly and early. Device frameworks expect documented evidence about training data provenance and composition, demonstrated performance across relevant subgroups, and a defensible account of how the validation data relates to the deployment population. Those are data decisions made at collection time, and they are expensive to retrofit.
The practical advice: if there is any chance your model is a regulated device, find out before you design the dataset. Subgroup representation and a clean, documented, never-trained-on validation set — see our golden eval set guide — are much cheaper to plan than to reconstruct, and they are what the evidence requirements will ask for.
Questions people ask
Can I use an open medical dataset commercially?
Depends on its licence, and medical datasets skew more restrictive than average — research-only and non-commercial terms are common, and several large imaging sets are explicitly academic-use. Check per dataset; our guide to dataset licences covers reading the terms.
Is de-identified data still personal data?
Potentially, under some regimes, if re-identification remains reasonably possible. European anonymisation is a higher bar than US de-identification. This is precisely the kind of question to put to a compliance professional with your specific dataset in hand.
Do I need ethics approval to use public medical data?
Often not for already-public de-identified data, though your institution may require a review regardless, and credentialed repositories impose their own agreement. For anything involving new data collection or patient contact, assume you do.
How much medical data do I need?
Usually less than you fear for the model and more than you expect for the evidence. Transfer learning from general or medical pretrained models works well with modest datasets. Demonstrating performance across relevant subgroups is what drives the real requirement, and that is about representation rather than volume.