HIPAA Privacy Rule: authorization required for a sale of protected health information (45 CFR 164.508(a)(4))
Selling identifiable health data needs a signed authorization from each patient that says the covered entity will be paid, which is impractical for a training corpus.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“(i) Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in § 164.501 of this subpart. (ii) Such authorization must state that the disclosure will result in remuneration to the covered entity.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides