Health data for medical AI: MIMIC-IV, All of Us, UK Biobank, RWD

The short answer

There are four main routes to health data for medical AI. Credentialed public datasets on PhysioNet, such as MIMIC-IV and eICU-CRD, are usually the quickest start: individual training, credentialing and a data use agreement, with review that PhysioNet says typically takes 1–2 weeks. National cohorts and NIH repositories (All of Us, UK Biobank, dbGaP, NCI imaging commons) add scale, genomics and imaging, but come with institutional sign-off and analysis-platform rules. Commercial real-world data (claims, EHR, lab and pharmacy data) is usually licensed in de-identified form and linked across sources with tokens. Health-system partnerships give you the data closest to your intended use, under a BAA, a data use agreement for a limited data set, an IRB-approved waiver, or de-identified data.

Pick the route by what you need the data for. Training needs volume and a license that allows model development. Validation needs data that is independent of training and looks like the population where the model will be used. Many teams need one route for each.

The main sources compared

Source	Access route	What's in it	Typical use	Key restrictions
MIMIC-IV v3.1 (PhysioNet), with MIMIC-IV-Note, -ED and MIMIC-CXR	Credentialed PhysioNet user, CITI “Data or Specimens Only Research” training, sign the DUA (PhysioNet Credentialed Health Data License 1.5.0). Also on Google BigQuery	Beth Israel Deaconess Medical Center ED and ICU patients, 2008–2022: over 65,000 ICU and over 200,000 ED patients. The Note module has 331,794 discharge summaries and 2,321,355 radiology reports	Model development, benchmarking, clinical NLP	Research use only; no re-identification; access can't be shared; derived datasets and models treated as sensitive
eICU-CRD v2.0 (PhysioNet)	Same credentialing, training and DUA as MIMIC-IV	Over 200,000 ICU admissions in 2014–2015 from 335 units at 208 US hospitals in the Philips eICU program	Multi-center development; a second ICU source for external testing of MIMIC-trained models	Same DUA as MIMIC-IV; de-identified to Safe Harbor, with hospital identity removed
Open PhysioNet databases	Most PhysioNet resources are open; check each project's license	Waveforms and signals, for example the ECG databases used in EC57 testing	Signal algorithms and standard benchmarks	Per-project license and citation terms
All of Us Research Program (NIH)	Institution with a Data Use and Registration Agreement; identity check, Responsible Conduct of Research training, sign the Data User Code of Conduct	Registered Tier: individual-level EHR, surveys, physical measurements and wearables. Controlled Tier adds genomic data, previously suppressed demographic fields and unshifted dates	Diverse-cohort studies, wearables, genomics	Workbench open to academic, health care, not-for-profit and government researchers. Analysis stays inside the Researcher Workbench; no counts of 1 to 20; no marketing use
UK Biobank	Application for health-related research in the public interest; data used on a restricted cloud platform	500,000 participants recruited in 2006–2010 at ages 40–69	Risk prediction, imaging and genomics at cohort scale	Open to academic, charity, government and commercial researchers, but new applications are paused until late 2026, when it intends to reopen them
dbGaP and NHLBI BioData Catalyst	Data Access Request by the investigator, co-signed by the institution's Signing Official, reviewed by an NIH Data Access Committee; eRA Commons accounts	Genotype–phenotype studies, including TOPMed and other NHLBI cohorts on BioData Catalyst	Genomics and cohort phenotypes	Each dataset has its own data use limitations; each institution in a collaboration files its own request
NCI Imaging Data Commons and TCIA	IDC data is public with no registration. TCIA public collections can be downloaded; collections that need a DUA now go through dbGaP	Cancer imaging, harmonized to DICOM in IDC	Imaging model development and testing	License per collection: most CC BY, a few non-commercial. Cite the dataset DOI; no re-identification
Commercial real-world data	License from a data holder or aggregator, usually as de-identified data	Claims, EHR, lab and pharmacy records, often linked across sources by tokens	Large-scale training, outcomes, subgroup coverage, real-world evidence	Contract terms set the permitted uses; the de-identification determination covers a specific dataset and use
Health-system partnership	BAA, limited data set with a DUA, IRB or Privacy Board waiver, patient authorization, or de-identified data	The partner's own EHR, imaging, waveform and operational data	Local and external validation, prospective studies, development for that setting	Set by the agreement, the IRB and HIPAA; plan for the time it takes to agree them

Sources: MIMIC-IV v3.1, MIMIC-IV-Note v2.2, eICU-CRD v2.0, PhysioNet About, PhysioNet FAQs, All of Us data access, All of Us registration, UK Biobank, UK Biobank apply for access, NIH: requesting dbGaP data, BioData Catalyst, NCI Imaging Data Commons, TCIA data usage policies. UK Biobank's application status is time-sensitive; check its site before relying on it.

Credentialed datasets: what the agreement means in practice

MIMIC-IV and eICU are the usual starting point because the access path is clear and individual. Under the PhysioNet Credentialed Health Data Use Agreement 1.5.0, each user agrees to:

use the data “for the sole purpose of lawful use in scientific research”;
not attempt to identify any individual or institution, and not share access with anyone else;
report any identifying information they find (the DUA gives the address PHI-report@physionet.org);
contribute the code behind any openly disseminated results to a repository open to the research community.

Three practical consequences:

Everyone on the team needs their own access. PhysioNet's FAQ says sharing within a team or class is not permitted, and credentialing has no expedited review. CITI training is a separate step.
Derived work stays inside the agreement. The MIMIC-IV page says derived datasets or models “should be treated as containing sensitive information”. If you share them, share them on PhysioNet under the same agreement as the source data.
Be careful with LLM services. PhysioNet's guidance on online services such as GPT says the DUA prohibits sharing the data with third parties, including through APIs. That covers a provider unless it doesn't retain the data, train on it or let humans review it. Local models are recommended.

Our reading, not legal advice: these terms make MIMIC-IV and eICU a strong fit for research, benchmarking, method development and publishing. Before a commercial product depends on them, take the license to counsel. For a product, the more reliable data usually comes through one of the routes below.

Sources: PhysioNet DUA 1.5.0, PhysioNet Credentialed Health Data License 1.5.0, MIMIC-IV v3.1, PhysioNet FAQs, PhysioNet LLM guidance (Sept 2025), Johnson et al., Sci Data 2023;10:1 (MIMIC-IV), Pollard et al., Sci Data 2018;5:180178 (eICU-CRD).

National cohorts and NIH repositories

All of Us brings EHR, survey, physical-measurement and wearable data together for individual participants, with genomics in the Controlled Tier. Its rules shape study design. Under the Data User Code of Conduct, participant-level data can't be copied, downloaded or otherwise removed from the Researcher Workbench. You can't link it at the participant level to other data without the program's documented permission, and you can't publish counts of 1 to 20. Plan to train and evaluate inside the Workbench, and to export only aggregate results. Access goes through an institution with a Data Use and Registration Agreement.

UK Biobank follows 500,000 participants and accepts applicants from commercial as well as academic, charity and government organisations. As of October 27, 2026, its apply-for-access page says applications are paused while changes are made to its Research Analysis Platform, and that it intends to accept new applications in late 2026.

dbGaP holds controlled-access genotype and phenotype data from NIH-funded studies. The request process runs from the investigator to the institution's Signing Official to an NIH Data Access Committee. The committee checks the request against each dataset's data use limitations. NHLBI BioData Catalyst provides cloud workspaces for approved NHLBI datasets, including TOPMed. More NIH-funded data will reach repositories under the NIH Data Management and Sharing Policy, effective 2023.

Imaging. The NCI Imaging Data Commons publishes cancer imaging in DICOM with no registration. Licenses are set per collection: most are CC BY, a small subset non-commercial. TCIA's usage policy requires dataset DOI citations and prohibits re-identification. Since NIH's April 2025 policy changes, TCIA datasets that need a DUA are hosted by the NCI Cancer Research Data Commons, with access through dbGaP.

Sources: All of Us data access and DUCC, All of Us registration, All of Us Researcher Workbench, UK Biobank, UK Biobank apply for access, dbGaP, NIH: requesting dbGaP data, BioData Catalyst, NIH DMS Policy, NCI IDC, TCIA data usage policies.

Commercial real-world data and tokenization

Commercial real-world data (RWD) is usually licensed as de-identified records. Because each source has its identifiers removed, linking a patient's hospital stay to later pharmacy fills or claims relies on tokens. A token is a code derived from identifiers such as name and date of birth, so the same person produces the same token in each dataset without the identifiers changing hands. HHS-funded research refers to the general approach as privacy-preserving record linkage (PPRL).

Three points from primary sources to keep in mind:

A token is not de-identification on its own. The HHS OCR de-identification guidance says an expert can determine that codes derived from PHI, such as keyed cryptographic hashes, are acceptable if the key isn't disclosed. A hash of identifiers without a secret key is still an identifying code under Safe Harbor. Datavant, a tokenization vendor, says the same: tokenization “is not enough under HIPAA” on its own, and Safe Harbor or Expert Determination is still required.
Designs differ. In Datavant's description of its design, each data holder gets site-specific tokens: a site key is applied to a master token, which is an irreversible hash of the direct identifiers.
Linkage quality varies. An HHS ASPE-funded NCHS project notes that “different PPRL tools may produce different linkage results”, which can affect findings. It compares three tools against gold-standard linkages and assesses their re-identification risk.

What we ask about before using a licensed dataset (our practice checklist):

Which de-identification route was used, and does the expert determination cover your use, including any linkage to your own data?
Is model training, validation or a commercial product a permitted use in the license? What happens to models trained on the data when the license ends?
Where did the records come from (which health systems, payers and labs), and which time span do they cover? Is that population close to your intended use?
How was linkage quality measured, and what share of patients link across sources?
How are outcomes and labels defined (diagnosis codes, lab thresholds, chart review), and can they be audited?

If the data will support an FDA submission, fitness for purpose matters as much as size. See our real-world evidence guide and the FDA guidance on real-world evidence for medical devices.

Sources: HHS OCR de-identification guidance (sections 2.9, 3.5), 45 CFR 164.514, ASPE PPRL evaluation project, Datavant on de-identification, Datavant on tokenization, FDA RWE guidance for devices. Vendor pages describe that vendor's own design; we have not tested it.

Health-system data partnerships

A health-system partner gives you data from the setting where the model will run, which matters most for validation. The legal route depends on what the data is for. The HIPAA de-identification routes themselves (Safe Harbor and Expert Determination) are covered on our medical data labeling page. The agreements are:

Route	When it fits	What the rule requires
Business associate agreement (BAA)	You perform a function or service on behalf of the health system, such as validating a model it runs	The contract sets permitted uses, safeguards, breach reporting, subcontractor terms, and return or destruction of PHI at the end. HHS's sample provisions say the parties should state whether the business associate may de-identify PHI, and what it may do with de-identified data
Limited data set with a data use agreement (DUA)	Research, public health or health care operations that need dates or geography	Removes 16 direct identifiers but can keep town or city, state, ZIP code and dates. The DUA sets permitted uses and who may receive the data, and the recipient agrees not to re-identify or contact individuals and to bind any agents to the same terms
IRB or Privacy Board waiver of authorization	Research that needs identifiable data and couldn't practicably be done without the waiver or without the PHI	The board must find no more than minimal privacy risk, with plans to protect and destroy identifiers and assurances against reuse
Patient authorization	Prospective studies that enroll patients	An authorization meeting 45 CFR 164.508; for research it can be combined with consent to take part
De-identified data	Development or validation that doesn't need identifiers	Not PHI once de-identified under 164.514(a)–(c). HHS says a DUA isn't required for de-identified data, though one may still be used

BAA or DUA? Our reading, not legal advice: a BAA covers work done for the health system. A DUA covers a recipient's own research or operations use of a limited data set. If your company wants to use partner data to build its own product, a BAA written for a service isn't, by itself, the right vehicle. Agree in writing whether data can be de-identified, by whom, by which method, and what the de-identified data may be used for. Then involve the partner's privacy office and IRB early, because these reviews often set the timeline.

For validating a model a health system already uses, see our guide to local validation of vendor AI. Privacy reviews and agreements are part of our HIPAA compliance consulting.

Sources: HHS: HIPAA and research, 45 CFR 164.514(e) (limited data sets), HHS sample business associate agreement provisions, HHS OCR de-identification guidance.

Choosing data for training vs. validation

Our practice guidance, built on the guides linked below:

Question	Training data	Validation data
What matters most	Volume, label coverage and a license that allows model development	Independence from training, and a close match to the intended-use population, setting and workflow
Good sources	Commercial RWD, partner data under a suitable agreement, public datasets for research and pre-training	A different site or later time period: a health-system partner, a second public dataset (for example eICU after MIMIC), or a prospective sample
Labels	Can be noisier if they are consistent and documented	Needs a reference standard you can defend, with expert review and agreement measured
Size	Driven by model learning curves	Driven by the precision you need on each metric and subgroup; see test set sample size
Leakage risks	Duplicate patients across splits	The same patients, sites or time windows as training; tuning on the test set

Testing on held-out patients from the training source is internal validation. External validation needs a different source, site or period. See validating a clinical prediction model.
For ECG and arrhythmia algorithms, standard PhysioNet databases and AAMI EC57 testing are covered in ECG annotation and EC57 evaluation.
Record the dataset version, extraction date and license with every result. PhysioNet datasets are versioned, so cite the version you used.

Key references

Related resources

Frequently asked questions

Can MIMIC-IV or eICU data be used to build a commercial product?

Read the license before you plan on it. The PhysioNet Credentialed Health Data Use Agreement 1.5.0 limits use to the sole purpose of lawful use in scientific research, bars sharing access, and requires anyone who openly disseminates results to contribute the code. In our reading, that makes these datasets a fit for research, benchmarking and method development, and a question for counsel before any product use.

How long does PhysioNet credentialing take?

PhysioNet's FAQ says credentialing review typically takes 1-2 weeks and there is no expedited review. Required training (CITI Data or Specimens Only Research for MIMIC-IV and eICU) is a separate step, and each person needs their own access.

Can I send MIMIC data to an LLM API?

Only under PhysioNet's conditions. Its guidance says the DUA prohibits sharing credentialed data with third parties, including through online platforms and APIs, unless the provider does not retain the data, train on it or have humans review it. PhysioNet recommends local models.

Is tokenized patient data de-identified under HIPAA?

Not by itself. HIPAA de-identification is Safe Harbor or Expert Determination under 45 CFR 164.514(b). HHS guidance says an expert can find keyed hash codes acceptable if the key is not disclosed, but an unkeyed hash of identifiers does not meet Safe Harbor. Datavant, a tokenization vendor, also says tokenization alone is not enough.

Do we need a BAA or a DUA to get data from a health system?

It depends on why you get the data. A business associate agreement covers work you do on the health system's behalf. A data use agreement goes with a limited data set used for research, public health or health care operations. De-identified data needs neither under HIPAA, though a contract is still usual. If you want to use data for your own product, settle the de-identification and permitted uses in writing first.

Scope it in 30 minutes

Book a scoping call and we'll name the smallest engagement that moves you forward. Most teams start with the fixed-scope Initial Audit.

Book a 30-min scoping call

Prefer to write? Send a short note.