HIPAA Privacy Rule: the prohibition on the sale of protected health information (45 CFR 164.502(a)(5)(ii))
A covered entity or business associate cannot take money for protected health information without each patient's authorization; de-identified data is not protected health information, so the ban does not reach it.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“(A) Except pursuant to and in compliance with § 164.508(a)(4), a covered entity or business associate may not sell protected health information.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides