Authorization, research or de-identification
Can hospitals sell patient data to AI companies?
Updated
A hospital cannot sell identifiable patient data without each patient's authorization; the routes the rules leave open are research under their own conditions and de-identified data.
What HIPAA says about a sale
160.103 makes a covered entity of a health care provider who transmits any health information in electronic form in connection with a covered transaction, which is every hospital that bills electronically. Under 164.502(a)(5)(ii) neither a covered entity nor its business associate may sell protected health information except in compliance with 164.508(a)(4), which requires the patient's authorization for any disclosure that is a sale.
Research has its own conditions
HHS's research guidance says covered entities may use and disclose protected health information for research with individual authorization, or without it under limited circumstances. 164.512(i) names one: documentation that an IRB or a privacy board has approved an alteration to or waiver of the authorization.
Limited data sets and de-identified data
164.514(e) lets a covered entity use or disclose a limited data set only under a data use agreement with the recipient. Below that sits de-identified data, which in HHS's guidance is outside the Privacy Rule once nothing identifies a patient and nothing gives a reasonable basis to think it could.
The hospital's own record duties and state law
The Medicare conditions of participation in 42 CFR 482.24 add that a hospital needs a procedure to keep patient records confidential; in California, Civil Code 56.10(a) requires a provider to get an authorization before it discloses medical information, with the section's own exceptions. Every rule is quoted on the register of rules on hospital patient data.