1. The company that collects the data (the covered entity) has to have a Business Associate Agreement in place with the company they're sharing it with. This basically affirms that the other company is aware of their HIPAA requirements and intends to follow them.
2. The Business Associate needs to access the data to do the job they were hired for, which in turn should be related to patient care.
There are definitely a lot of companies out there doing this already, but I will say that the people with the data are not exactly giving it up easily. HIPAA makes it so that in the event of a breach the Covered Entity is responsible for beach notification to the patients. That means there's a huge incentive for hospitals, radiology groups, and anyone else who collects this data to make sure that the people they share it with have the proper safeguards in place. There are a ton of hoops to jump through, normally including independent third party audits. I've seen a few medical AI companies fail simply because they didn't have the security and no one trusted them with data.