You could offer to sell your own consent to use your records to a healthcare provider, and collect if the provider agreed. But that wouldn't make you a "broker" as I see it, only a one-tiem seller. To be a broker you would somehow have to convincew many others to let you act as their agent in selling such consent to various providers,at some sort of commission. I don't see why anyone else would hire you to do that.
The value,of your records, by the way, would be not the cost of deletion (which would be rather small) but the potential income to be earned by retaining your records. But the incremental value of any one patient's records would probably not be large.
If the provider has used your information in ways that are unlawful, you could report this, and the provider might be fined. But that would put no money in your pocket. Offering not to report for a fee would be extortion (blackmail) a felony.
If the provider has de-identified (aka anonymized) records they may be used freely. Specifically, under the US HIPPA privacy rule:
De-Identified Health Information. There are no restrictions on the use or disclosure of de-identified health information. De-identified health information neither identifies nor provides a reasonable basis to identify an individual. There are two ways to de-identify information; either: (1) a formal determination by a qualified statistician; or (2) the removal of specified identifiers of the individual and of the individual’s relatives, household members, and employers is required, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual.
The HIPPA rule does not require a person's consent for that person's records to be de-identified, as the purpose of the rule is to protect the privacy of patients, not to allow them to make money from their information. Specifically, HHS says:
The Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) establishes, for the first time, a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services (“HHS”) issued the Privacy Rule to implement the requirement of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).1 The Privacy Rule standards address the use and disclosure of individuals’ health information—called “protected health information” by organizations subject to the Privacy Rule — called “covered entities,” as well as standards for individuals' privacy rights to understand and control how their health information is used.
Moreover, PHI can be used without de-identification and without consent for severla purposes under the HIPPA rule, including "Health Care Operations" and "Public Interest and Benefit Activities". The rule says:
Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make.
I am not clear as to whether training employees on equipment so that they can treat patients would come under "Health Care Operations" or "Public Interest and Benefit Activities", but it might.
The statements in the question about the cost of deleting a given patient's records are implausible. The exact effort required would depend on the design of the database system, but unless it has been designed in a highly inefficient way, a simple script that took as input a patient ID and deleted all records of that patient, could be devised once in a short time by a DBA or other database professional, and used without change thereafter. Even fully manual deletion would probably require no more than say 20-30 hours by an entry level tech, at a cost in salary of a few hundred dollars at most. De-identifing data is also not a high-cost operation -- I have had occasion to do it myself. One simply replaces in a copy of the DB each patient name with "TestPatient0001" "TestPatient0002" etc, and makes similar replacements for each of the other identifying indicators. A very repetitive and easy to program change.
In short, i don't think the prospect of getting a healthcare provider to pay a sizable sum for consent to use a single patient's data are large, although it would be legal to make an offer.
