{
 "name": "The rules a hospital patient record turns on",
 "title": "The rules a hospital patient record turns on",
 "kind": "terms-board",
 "url": "https://sellhospitaldatatoai.com/datasets/hospital-patient-data-law/",
 "csv": "https://sellhospitaldatatoai.com/datasets/hospital-patient-data-law.csv",
 "markdown": "https://sellhospitaldatatoai.com/datasets/hospital-patient-data-law/index.md",
 "computed_at": "2026-11-10",
 "license": "https://sellhospitaldatatoai.com/terms",
 "headline": "2 of 9 rules read bear on research uses of hospital patient data, each quoted from its own text, read 10 November 2026.",
 "quotes": [
  "2 of 9 rules read bear on research uses of hospital patient data, each quoted from its own text, read 10 November 2026.",
  "What it bears on for a hospital's patient records, by rule: research uses and disclosures 2 of 9, the patient's authorisation a sale needs 1 of 9, when a record stops identifying the patient 1 of 9, a limited data set and its data use agreement 1 of 9, the medical records a hospital must keep 1 of 9, selling protected health information 1 of 9, a state's own confidentiality law 1 of 9, whether the hospital is a HIPAA covered entity 1 of 9 (9 rules, read 10 November 2026).",
  "Where it applies, by rule: United States, federal 8 of 9, a US state 1 of 9 (9 rules, read 10 November 2026).",
  "The rule, in its own words, by rule: stated 9 of 9 (9 rules, read 10 November 2026)."
 ],
 "citation": "\"The rules a hospital patient record turns on\", updated 2026-11-10, https://sellhospitaldatatoai.com/datasets/hospital-patient-data-law/.",
 "national": {
  "n": 9,
  "unit": "rules",
  "documents": 9,
  "published_sources": 9,
  "named_sources": 10
 },
 "board": {
  "type": "clauses",
  "noun": {
   "one": "rule",
   "many": "rules"
  },
  "document": {
   "one": "text",
   "many": "texts"
  },
  "fields": [
   {
    "id": "bears_on",
    "label": "What it bears on for a hospital's patient records",
    "counts": {
     "records-duty": 1,
     "who-is-covered": 1,
     "sale": 1,
     "authorisation": 1,
     "research": 2,
     "limited-data-set": 1,
     "state-law": 1,
     "de-identification": 1
    },
    "values": [
     {
      "value": "who-is-covered",
      "text": "whether the hospital is a HIPAA covered entity"
     },
     {
      "value": "sale",
      "text": "selling protected health information"
     },
     {
      "value": "authorisation",
      "text": "the patient's authorisation a sale needs"
     },
     {
      "value": "research",
      "text": "research uses and disclosures"
     },
     {
      "value": "de-identification",
      "text": "when a record stops identifying the patient"
     },
     {
      "value": "limited-data-set",
      "text": "a limited data set and its data use agreement"
     },
     {
      "value": "records-duty",
      "text": "the medical records a hospital must keep"
     },
     {
      "value": "state-law",
      "text": "a state's own confidentiality law"
     }
    ]
   },
   {
    "id": "jurisdiction",
    "label": "Where it applies",
    "counts": {
     "us-federal": 8,
     "us-state": 1
    },
    "values": [
     {
      "value": "us-federal",
      "text": "United States, federal"
     },
     {
      "value": "us-state",
      "text": "a US state"
     }
    ]
   },
   {
    "id": "text",
    "label": "The rule, in its own words",
    "counts": {
     "stated": 9
    },
    "values": [
     {
      "value": "stated",
      "text": "stated"
     }
    ],
    "clause": true
   }
  ],
  "lead": {
   "type": "share",
   "field": "bears_on",
   "value": "research",
   "n": 2,
   "of": 9,
   "label": "Rules on research uses"
  },
  "vendors": [
   {
    "name": "42 CFR 482.24(b)",
    "answers": {
     "bears_on": {
      "value": "records-duty",
      "text": "the medical records a hospital must keep",
      "documents": [
       {
        "document": "Condition of participation: medical record services",
        "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24",
        "value": "records-duty",
        "quote": "Medical records must be retained in their original or legally reproduced form for a period of at least 5 years."
       }
      ]
     },
     "jurisdiction": {
      "value": "us-federal",
      "text": "United States, federal",
      "documents": [
       {
        "document": "Condition of participation: medical record services",
        "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24",
        "value": "us-federal",
        "quote": "Medical records must be retained in their original or legally reproduced form for a period of at least 5 years."
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "Medical records must be retained in their original or legally reproduced form for a…",
      "documents": [
       {
        "document": "Condition of participation: medical record services",
        "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24",
        "value": "stated",
        "quote": "Medical records must be retained in their original or legally reproduced form for a period of at least 5 years."
       }
      ]
     }
    }
   },
   {
    "name": "45 CFR 160.103",
    "answers": {
     "bears_on": {
      "value": "who-is-covered",
      "text": "whether the hospital is a HIPAA covered entity",
      "documents": [
       {
        "document": "Definitions: covered entity",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103",
        "value": "who-is-covered",
        "quote": "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter."
       }
      ]
     },
     "jurisdiction": {
      "value": "us-federal",
      "text": "United States, federal",
      "documents": [
       {
        "document": "Definitions: covered entity",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103",
        "value": "us-federal",
        "quote": "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter."
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "A health care provider who transmits any health information in electronic form in…",
      "documents": [
       {
        "document": "Definitions: covered entity",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103",
        "value": "stated",
        "quote": "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter."
       }
      ]
     }
    }
   },
   {
    "name": "45 CFR 164.502(a)(5)(ii)",
    "answers": {
     "bears_on": {
      "value": "sale",
      "text": "selling protected health information",
      "documents": [
       {
        "document": "Sale of protected health information",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
        "value": "sale",
        "quote": "where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information"
       }
      ]
     },
     "jurisdiction": {
      "value": "us-federal",
      "text": "United States, federal",
      "documents": [
       {
        "document": "Sale of protected health information",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
        "value": "us-federal",
        "quote": "where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information"
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "where the covered entity or business associate directly or indirectly receives…",
      "documents": [
       {
        "document": "Sale of protected health information",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
        "value": "stated",
        "quote": "where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information"
       }
      ]
     }
    }
   },
   {
    "name": "45 CFR 164.508(a)(4)",
    "answers": {
     "bears_on": {
      "value": "authorisation",
      "text": "the patient's authorisation a sale needs",
      "documents": [
       {
        "document": "Authorization required: sale of protected health information",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508",
        "value": "authorisation",
        "quote": "Such authorization must state that the disclosure will result in remuneration to the covered entity."
       }
      ]
     },
     "jurisdiction": {
      "value": "us-federal",
      "text": "United States, federal",
      "documents": [
       {
        "document": "Authorization required: sale of protected health information",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508",
        "value": "us-federal",
        "quote": "Such authorization must state that the disclosure will result in remuneration to the covered entity."
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "Such authorization must state that the disclosure will result in remuneration to the…",
      "documents": [
       {
        "document": "Authorization required: sale of protected health information",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508",
        "value": "stated",
        "quote": "Such authorization must state that the disclosure will result in remuneration to the covered entity."
       }
      ]
     }
    }
   },
   {
    "name": "45 CFR 164.512(i)",
    "answers": {
     "bears_on": {
      "value": "research",
      "text": "research uses and disclosures",
      "documents": [
       {
        "document": "Uses and disclosures for research purposes",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512",
        "value": "research",
        "quote": "Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by § 164.508 for use or disclosure of protected health information has been approved"
       }
      ]
     },
     "jurisdiction": {
      "value": "us-federal",
      "text": "United States, federal",
      "documents": [
       {
        "document": "Uses and disclosures for research purposes",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512",
        "value": "us-federal",
        "quote": "Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by § 164.508 for use or disclosure of protected health information has been approved"
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "Board approval of a waiver of authorization. The covered entity obtains documentation…",
      "documents": [
       {
        "document": "Uses and disclosures for research purposes",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512",
        "value": "stated",
        "quote": "Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by § 164.508 for use or disclosure of protected health information has been approved"
       }
      ]
     }
    }
   },
   {
    "name": "45 CFR 164.514(e)",
    "answers": {
     "bears_on": {
      "value": "limited-data-set",
      "text": "a limited data set and its data use agreement",
      "documents": [
       {
        "document": "Limited data set",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514",
        "value": "limited-data-set",
        "quote": "A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient"
       }
      ]
     },
     "jurisdiction": {
      "value": "us-federal",
      "text": "United States, federal",
      "documents": [
       {
        "document": "Limited data set",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514",
        "value": "us-federal",
        "quote": "A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient"
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "A covered entity may use or disclose a limited data set that meets the requirements of…",
      "documents": [
       {
        "document": "Limited data set",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514",
        "value": "stated",
        "quote": "A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient"
       }
      ]
     }
    }
   },
   {
    "name": "California Civil Code 56.10(d)",
    "answers": {
     "bears_on": {
      "value": "state-law",
      "text": "a state's own confidentiality law",
      "documents": [
       {
        "document": "Confidentiality of Medical Information Act",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10",
        "value": "state-law",
        "quote": "shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient"
       }
      ]
     },
     "jurisdiction": {
      "value": "us-state",
      "text": "a US state",
      "documents": [
       {
        "document": "Confidentiality of Medical Information Act",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10",
        "value": "us-state",
        "quote": "shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient"
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "shall not intentionally share, sell, use for marketing, or otherwise use medical…",
      "documents": [
       {
        "document": "Confidentiality of Medical Information Act",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10",
        "value": "stated",
        "quote": "shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient"
       }
      ]
     }
    }
   },
   {
    "name": "HHS de-identification guidance",
    "answers": {
     "bears_on": {
      "value": "de-identification",
      "text": "when a record stops identifying the patient",
      "documents": [
       {
        "document": "Guidance regarding methods for de-identification",
        "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html",
        "value": "de-identification",
        "quote": "The guidance explains and answers questions regarding the two methods that can be used to satisfy the Privacy Rule’s de-identification standard: Expert Determination and Safe Harbor"
       }
      ]
     },
     "jurisdiction": {
      "value": "us-federal",
      "text": "United States, federal",
      "documents": [
       {
        "document": "Guidance regarding methods for de-identification",
        "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html",
        "value": "us-federal",
        "quote": "The guidance explains and answers questions regarding the two methods that can be used to satisfy the Privacy Rule’s de-identification standard: Expert Determination and Safe Harbor"
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "The guidance explains and answers questions regarding the two methods that can be used to…",
      "documents": [
       {
        "document": "Guidance regarding methods for de-identification",
        "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html",
        "value": "stated",
        "quote": "The guidance explains and answers questions regarding the two methods that can be used to satisfy the Privacy Rule’s de-identification standard: Expert Determination and Safe Harbor"
       }
      ]
     }
    }
   },
   {
    "name": "HHS research guidance",
    "answers": {
     "bears_on": {
      "value": "research",
      "text": "research uses and disclosures",
      "documents": [
       {
        "document": "HIPAA and Research",
        "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html",
        "value": "research",
        "quote": "covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule."
       }
      ]
     },
     "jurisdiction": {
      "value": "us-federal",
      "text": "United States, federal",
      "documents": [
       {
        "document": "HIPAA and Research",
        "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html",
        "value": "us-federal",
        "quote": "covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule."
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "covered entities are permitted to use and disclose protected health information for…",
      "documents": [
       {
        "document": "HIPAA and Research",
        "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html",
        "value": "stated",
        "quote": "covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule."
       }
      ]
     }
    }
   }
  ]
 },
 "subject_kind": "rule",
 "rows": [
  {
   "subject": "42 CFR 482.24(b)",
   "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24",
   "document": "Condition of participation: medical record services",
   "question": "bears_on",
   "answer": "records-duty",
   "answer_text": "the medical records a hospital must keep",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Medical records must be retained in their original or legally reproduced form for a period of at least 5 years.",
   "text_sha256": "fb1a923027cfc509d4c8c17ee1e578a7a84109eb235389b55bae5a1a15ac8413"
  },
  {
   "subject": "42 CFR 482.24(b)",
   "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24",
   "document": "Condition of participation: medical record services",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "United States, federal",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Medical records must be retained in their original or legally reproduced form for a period of at least 5 years.",
   "text_sha256": "fb1a923027cfc509d4c8c17ee1e578a7a84109eb235389b55bae5a1a15ac8413"
  },
  {
   "subject": "42 CFR 482.24(b)",
   "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24",
   "document": "Condition of participation: medical record services",
   "question": "text",
   "answer": "stated",
   "answer_text": "Medical records must be retained in their original or legally reproduced form for a…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Medical records must be retained in their original or legally reproduced form for a period of at least 5 years.",
   "text_sha256": "fb1a923027cfc509d4c8c17ee1e578a7a84109eb235389b55bae5a1a15ac8413"
  },
  {
   "subject": "45 CFR 160.103",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103",
   "document": "Definitions: covered entity",
   "question": "bears_on",
   "answer": "who-is-covered",
   "answer_text": "whether the hospital is a HIPAA covered entity",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.",
   "text_sha256": "6452027a5e10c65b9109067e105e75e8e10ead90b4d5f4469240bc2a26a185d3"
  },
  {
   "subject": "45 CFR 160.103",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103",
   "document": "Definitions: covered entity",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "United States, federal",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.",
   "text_sha256": "6452027a5e10c65b9109067e105e75e8e10ead90b4d5f4469240bc2a26a185d3"
  },
  {
   "subject": "45 CFR 160.103",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103",
   "document": "Definitions: covered entity",
   "question": "text",
   "answer": "stated",
   "answer_text": "A health care provider who transmits any health information in electronic form in…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.",
   "text_sha256": "6452027a5e10c65b9109067e105e75e8e10ead90b4d5f4469240bc2a26a185d3"
  },
  {
   "subject": "45 CFR 164.502(a)(5)(ii)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
   "document": "Sale of protected health information",
   "question": "bears_on",
   "answer": "sale",
   "answer_text": "selling protected health information",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information",
   "text_sha256": "6779c13fa7034bb24ae4d560a30b8390a99df4319a1dd665e7082cf91fb9d55a"
  },
  {
   "subject": "45 CFR 164.502(a)(5)(ii)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
   "document": "Sale of protected health information",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "United States, federal",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information",
   "text_sha256": "6779c13fa7034bb24ae4d560a30b8390a99df4319a1dd665e7082cf91fb9d55a"
  },
  {
   "subject": "45 CFR 164.502(a)(5)(ii)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
   "document": "Sale of protected health information",
   "question": "text",
   "answer": "stated",
   "answer_text": "where the covered entity or business associate directly or indirectly receives…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information",
   "text_sha256": "6779c13fa7034bb24ae4d560a30b8390a99df4319a1dd665e7082cf91fb9d55a"
  },
  {
   "subject": "45 CFR 164.508(a)(4)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508",
   "document": "Authorization required: sale of protected health information",
   "question": "bears_on",
   "answer": "authorisation",
   "answer_text": "the patient's authorisation a sale needs",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Such authorization must state that the disclosure will result in remuneration to the covered entity.",
   "text_sha256": "2eb75db2b4f3219cecfcad4f96ff0d51522f59ba760c8c6fc05918136191aa86"
  },
  {
   "subject": "45 CFR 164.508(a)(4)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508",
   "document": "Authorization required: sale of protected health information",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "United States, federal",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Such authorization must state that the disclosure will result in remuneration to the covered entity.",
   "text_sha256": "2eb75db2b4f3219cecfcad4f96ff0d51522f59ba760c8c6fc05918136191aa86"
  },
  {
   "subject": "45 CFR 164.508(a)(4)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508",
   "document": "Authorization required: sale of protected health information",
   "question": "text",
   "answer": "stated",
   "answer_text": "Such authorization must state that the disclosure will result in remuneration to the…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Such authorization must state that the disclosure will result in remuneration to the covered entity.",
   "text_sha256": "2eb75db2b4f3219cecfcad4f96ff0d51522f59ba760c8c6fc05918136191aa86"
  },
  {
   "subject": "45 CFR 164.512(i)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512",
   "document": "Uses and disclosures for research purposes",
   "question": "bears_on",
   "answer": "research",
   "answer_text": "research uses and disclosures",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by § 164.508 for use or disclosure of protected health information has been approved",
   "text_sha256": "0f9e18a5b057033753a3485b794c493eccd7221f07dc10b7e84fa0068f8e540d"
  },
  {
   "subject": "45 CFR 164.512(i)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512",
   "document": "Uses and disclosures for research purposes",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "United States, federal",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by § 164.508 for use or disclosure of protected health information has been approved",
   "text_sha256": "0f9e18a5b057033753a3485b794c493eccd7221f07dc10b7e84fa0068f8e540d"
  },
  {
   "subject": "45 CFR 164.512(i)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512",
   "document": "Uses and disclosures for research purposes",
   "question": "text",
   "answer": "stated",
   "answer_text": "Board approval of a waiver of authorization. The covered entity obtains documentation…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by § 164.508 for use or disclosure of protected health information has been approved",
   "text_sha256": "0f9e18a5b057033753a3485b794c493eccd7221f07dc10b7e84fa0068f8e540d"
  },
  {
   "subject": "45 CFR 164.514(e)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514",
   "document": "Limited data set",
   "question": "bears_on",
   "answer": "limited-data-set",
   "answer_text": "a limited data set and its data use agreement",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient",
   "text_sha256": "50cac8573b1f8ba07a0fdebd4d7025f07bc7803d7639444bfc6e2564311f0fc3"
  },
  {
   "subject": "45 CFR 164.514(e)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514",
   "document": "Limited data set",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "United States, federal",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient",
   "text_sha256": "50cac8573b1f8ba07a0fdebd4d7025f07bc7803d7639444bfc6e2564311f0fc3"
  },
  {
   "subject": "45 CFR 164.514(e)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514",
   "document": "Limited data set",
   "question": "text",
   "answer": "stated",
   "answer_text": "A covered entity may use or disclose a limited data set that meets the requirements of…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient",
   "text_sha256": "50cac8573b1f8ba07a0fdebd4d7025f07bc7803d7639444bfc6e2564311f0fc3"
  },
  {
   "subject": "California Civil Code 56.10(d)",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10",
   "document": "Confidentiality of Medical Information Act",
   "question": "bears_on",
   "answer": "state-law",
   "answer_text": "a state's own confidentiality law",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient",
   "text_sha256": "f361bf74f08a35a8436e16e506190de89de954d1ab0d66bb6116ade484e5fdeb"
  },
  {
   "subject": "California Civil Code 56.10(d)",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10",
   "document": "Confidentiality of Medical Information Act",
   "question": "jurisdiction",
   "answer": "us-state",
   "answer_text": "a US state",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient",
   "text_sha256": "f361bf74f08a35a8436e16e506190de89de954d1ab0d66bb6116ade484e5fdeb"
  },
  {
   "subject": "California Civil Code 56.10(d)",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10",
   "document": "Confidentiality of Medical Information Act",
   "question": "text",
   "answer": "stated",
   "answer_text": "shall not intentionally share, sell, use for marketing, or otherwise use medical…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient",
   "text_sha256": "f361bf74f08a35a8436e16e506190de89de954d1ab0d66bb6116ade484e5fdeb"
  },
  {
   "subject": "HHS de-identification guidance",
   "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html",
   "document": "Guidance regarding methods for de-identification",
   "question": "bears_on",
   "answer": "de-identification",
   "answer_text": "when a record stops identifying the patient",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "The guidance explains and answers questions regarding the two methods that can be used to satisfy the Privacy Rule’s de-identification standard: Expert Determination and Safe Harbor",
   "text_sha256": "2df345c13930248ae79dea73406191ac045a0e2113fb26bd85e58fb1c20d2498"
  },
  {
   "subject": "HHS de-identification guidance",
   "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html",
   "document": "Guidance regarding methods for de-identification",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "United States, federal",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "The guidance explains and answers questions regarding the two methods that can be used to satisfy the Privacy Rule’s de-identification standard: Expert Determination and Safe Harbor",
   "text_sha256": "2df345c13930248ae79dea73406191ac045a0e2113fb26bd85e58fb1c20d2498"
  },
  {
   "subject": "HHS de-identification guidance",
   "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html",
   "document": "Guidance regarding methods for de-identification",
   "question": "text",
   "answer": "stated",
   "answer_text": "The guidance explains and answers questions regarding the two methods that can be used to…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "The guidance explains and answers questions regarding the two methods that can be used to satisfy the Privacy Rule’s de-identification standard: Expert Determination and Safe Harbor",
   "text_sha256": "2df345c13930248ae79dea73406191ac045a0e2113fb26bd85e58fb1c20d2498"
  },
  {
   "subject": "HHS research guidance",
   "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html",
   "document": "HIPAA and Research",
   "question": "bears_on",
   "answer": "research",
   "answer_text": "research uses and disclosures",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule.",
   "text_sha256": "23a70cc35ae5ba9cd801abf72e8151e4c2e54c1e2bb98c539eaa5498078afac0"
  },
  {
   "subject": "HHS research guidance",
   "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html",
   "document": "HIPAA and Research",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "United States, federal",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule.",
   "text_sha256": "23a70cc35ae5ba9cd801abf72e8151e4c2e54c1e2bb98c539eaa5498078afac0"
  },
  {
   "subject": "HHS research guidance",
   "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html",
   "document": "HIPAA and Research",
   "question": "text",
   "answer": "stated",
   "answer_text": "covered entities are permitted to use and disclose protected health information for…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule.",
   "text_sha256": "23a70cc35ae5ba9cd801abf72e8151e4c2e54c1e2bb98c539eaa5498078afac0"
  }
 ],
 "sources": [
  {
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103",
   "label": "eCFR :: 45 CFR 160.103",
   "license": "quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
   "label": "eCFR :: 45 CFR 164.502",
   "license": "quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508",
   "label": "eCFR :: 45 CFR 164.508",
   "license": "quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512",
   "label": "eCFR :: 45 CFR 164.512",
   "license": "quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514",
   "label": "eCFR :: 45 CFR 164.514",
   "license": "quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html",
   "label": "Guidance regarding methods for de-identification | HHS",
   "license": "quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html",
   "label": "Research | HHS",
   "license": "quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24",
   "label": "eCFR :: 42 CFR 482.24",
   "license": "quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10",
   "label": "California Civil Code 56.10",
   "license": "quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070",
   "label": "RCW 19.373.070",
   "license": "quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10",
   "class": "primary-government",
   "status": "unread"
  }
 ],
 "methodology": "Each rule's own 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10 were read through estate-fetch and stored whole (sha256 on every row). For every text, three questions were answered from its own words: what it bears on for a hospital's patient records, where it applies, the rule, in its own words. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the text read does not address the question. A rule with several texts reads 'varies' where they disagree. 9 rules, 9 texts.",
 "embed": "<figure style=\"margin:0;padding:16px;border:1px solid #d0d0d0;background:#ffffff\"><blockquote style=\"margin:0 0 8px;background:#ffffff\">2 of 9 rules read bear on research uses of hospital patient data, each quoted from its own text, read 10 November 2026.</blockquote><figcaption style=\"background:#ffffff\"><a href=\"https://sellhospitaldatatoai.com/datasets/hospital-patient-data-law/\" style=\"background:#ffffff\">The rules a hospital patient record turns on, sellhospitaldatatoai.com</a></figcaption></figure>"
}