What happens to your data when an AI vendor shuts down

MIT Technology Review reported on October 13, 2026, that startups going out of business are selling their emails, chats, documents and code for use in training AI models, and that 47% of deals at SimpleClosure, a firm that helps startups close, now include code or data sales. If a vendor holding your patients' information closes, HIPAA bars it from selling that information without the patient's authorization, and your business associate agreement must require its return or destruction when the contract ends, where feasible. HIPAA does not cover de-identified data or business information such as the prices you pay, so limits on those should be written into your contract.

What did MIT Technology Review report?

The story, one of the picks in Kent Applied's healthcare AI news, describes a new trade in the files of companies that have closed. SimpleClosure added data sales to its services in April, and its Asset Hub platform has handled over 150 deals, the magazine reported. The buyers include foundation AI labs and companies that build simulated workspaces for training AI. A rival firm, Sunset, also has a fast-growing data resale business.

The firms that supply the files employ data scientists to scrub personal information from them, and buyers say they scrub too. Greg Ewing, an attorney who advises AI startups, pointed out that emails and calendars can hold private details such as doctor appointments. The story also says founders "have little to no visibility into who is buying the data and what they plan to do with it."

For a hospital or a practice, the question is what a vendor's files hold about you. If a vendor's support staff once pasted a patient's details into an email or a team chat, for example, those details now sit in the kind of files these sales include.

Has a healthcare AI vendor closed before?

Yes. Healthcare Dive reported on November 1, 2023 that Olive, a healthcare AI startup once valued at $4 billion, would shut down. Olive would sell its clearinghouse and patient access businesses to Waystar and Humata Health and wind down the rest of its operations, the report said.

A sale of part of a business and a wind-down of the rest raise the same question about the data a vendor holds, and HIPAA answers part of it.

What does HIPAA say happens to patient information?

A vendor that creates, receives, keeps or sends patient information on your behalf is a business associate under HIPAA, the federal health privacy law (45 CFR 160.103). Under HIPAA, a business associate "may not sell protected health information" unless the patient has signed an authorization for the sale (45 CFR 164.502(a)(5)(ii) and 164.508).

The rule also requires your business associate agreement to say that when the contract ends, the vendor will return or destroy all the patient information it "still maintains in any form" and keep no copies. Where that is not feasible, the vendor must keep protecting the information and limit any further use to the purposes that made return or destruction infeasible (45 CFR 164.504(e)(2)(ii)(J)). The Department of Health and Human Services' sample business associate agreement language applies that duty "upon termination of this Agreement for any reason" and says it survives the end of the agreement.

What does HIPAA leave to your contract?

Two kinds of data a vendor may hold fall outside those rules.

The first is de-identified data. Your organization may give patient information to a business associate so the vendor can de-identify it, which means removing what could identify a patient. Once information is de-identified under HIPAA's standard, the Privacy Rule's requirements "do not apply" to it (45 CFR 164.502(d)). Guidance that the Joint Commission and the Coalition for Health AI (CHAI) published in 2025 notes that de-identified data "may be used to train, tune, or test AI tools," and says organizations "should still apply strong protections and contractual guardrails" to it.

The second is your own business information. HIPAA's definition of health information covers information about a person's health, care or payment for care (45 CFR 160.103), so your contract terms, the prices you pay and internal documents that say nothing about a patient fall outside it.

For both kinds, HIPAA's rules on patient information do not apply, so any limit on what a vendor may do with the data, including selling it or training AI on it, should be written into your contract.

What should the contract say?

The Joint Commission's 2026 review guide for its responsible AI certification includes a CHAI control that calls for data use agreements or business associate agreements that cover "permitted and prohibited uses" and "data return/destruction terms at end of use." The 2025 guidance adds that organizations should consider extending the permitted and prohibited uses in their data use agreements to "rights around model outputs, local performance data, and monetization of data."

Five checks put those terms to work on any vendor that holds your data.

These checks add to the five data questions in How to score an AI vendor before the demo, which asks how you get your data back when you leave and calls for a deletion certificate in the contract. None of this is legal advice, so have your counsel write the wording for your contracts.