Synthetic patient data is artificially generated health records that statistically resemble real patients without corresponding to any actual person. Produced by simulation or by generative models trained on real records, it lets teams develop, test, and share clinical AI when access to genuine records is restricted by privacy law. As of July 2026.
Why it matters in healthcare
Real health records are among the hardest data to move. Privacy law, consent, and institutional caution mean that a promising model at one hospital often cannot be tested at another. Synthetic data offers a way around the bottleneck. As one review puts it, "in lieu of revealing actual patient data, synthetic datasets that accurately capture the original distribution of the data would substantially lessen patient-privacy concerns and could be freely shared" 1. The same work notes a second use: emulating "the phenotypes of underrepresented conditions and individuals" so models "can make better medical decisions in a wider range of real-world environments" 1 — a lever on the representation gaps that plague clinical AI.
How it works
There are two broad routes. The first is simulation: encode clinical knowledge and disease progression as rules, then generate patients from them. The open-source Synthea tool works this way, and "one million synthetic patient records are now freely available online, encoded in standard formats" such as HL7 FHIR, and "free of legal, privacy, security, and intellectual property restrictions" 2. The second route is generative modelling: train a model on real records and sample new ones from the learned distribution. Simulation gives transparency and no link to real people; generative methods can capture messier, higher-fidelity structure, at the cost of a tighter dependence on the real data they learned from.
Where it appears today
Synthetic data now informs government policy, supports software testing, and augments datasets for predictive analytics 4. Its privacy standing, when the method is sound, can be quantified: evaluating fully synthetic health data, one study found "the meaningful identity disclosure risk for both of these synthesized samples was below the commonly used 0.09 risk threshold (0.0198 and 0.0086, respectively)" 3 — several times lower than the original data. That is the encouraging case, and it comes with a measurement attached rather than an assumption.
Common misunderstandings
Synthetic means private by definition. It does not. In a systematic security evaluation, "synthetic data either does not prevent inference attacks or does not retain data utility," and across a range of generators "synthetic data does not provide a better tradeoff between privacy and utility than traditional anonymisation techniques" 5. Privacy is earned through generation and testing, and has to be demonstrated for each release.
Any realistic record is a safe record. Fidelity and privacy pull against each other. A dataset detailed enough to be useful can memorise and re-expose real individuals, which is why a disclosure-risk assessment — like the one that yielded the sub-threshold figures above 3 — belongs before publication.
Synthetic data erases bias. It inherits it. Reviewers flag "data quality and data bias in synthetic data, which can limit applicability across different applications in the clinical context," alongside "risk of re-identification" 4. A generator trained on skewed data produces skewed patients.
Related terms
Synthetic data is one answer to the privacy problem that de-identification and anonymisation address differently, and it is often compared with federated learning, which moves the model to the data instead of sharing data at all. High-fidelity generation increasingly draws on a foundation model. For the wider evidence base, see our AI in healthcare statistics.