The rules a hospital patient record turns on
2 of 9 rules read bear on research uses of hospital patient data, each quoted from its own text, read 10 November 2026.
What it bears on for a hospital's patient records
Where it applies
The rule, in its own words
Every answer from every rule
Each row is one rule. Click an answer to see the sentence behind it, quoted from the text with the date we read it. Where it says "not stated", the text we read is silent on that question.
| Rule | What it bears on for a hospital's patient records | Where it applies | The rule, in its own words |
|---|---|---|---|
| 42 CFR 482.24(b) | the medical records a hospital must keep | United States, federal | Medical records must be retained in their original or legally reproduced form for a… |
| 45 CFR 160.103 | whether the hospital is a HIPAA covered entity | United States, federal | A health care provider who transmits any health information in electronic form in… |
| 45 CFR 164.502(a)(5)(ii) | selling protected health information | United States, federal | where the covered entity or business associate directly or indirectly receives… |
| 45 CFR 164.508(a)(4) | the patient's authorisation a sale needs | United States, federal | Such authorization must state that the disclosure will result in remuneration to the… |
| 45 CFR 164.512(i) | research uses and disclosures | United States, federal | Board approval of a waiver of authorization. The covered entity obtains documentation… |
| 45 CFR 164.514(e) | a limited data set and its data use agreement | United States, federal | A covered entity may use or disclose a limited data set that meets the requirements of… |
| California Civil Code 56.10(d) | a state's own confidentiality law | a US state | shall not intentionally share, sell, use for marketing, or otherwise use medical… |
| HHS de-identification guidance | when a record stops identifying the patient | United States, federal | The guidance explains and answers questions regarding the two methods that can be used to… |
| HHS research guidance | research uses and disclosures | United States, federal | covered entities are permitted to use and disclose protected health information for… |
Each answer in its source's own words (27 quotes)
- 42 CFR 482.24(b), Condition of participation: medical record services, read 2026-11-10, What it bears on for a hospital's patient records:
Medical records must be retained in their original or legally reproduced form for a period of at least 5 years.
- 42 CFR 482.24(b), Condition of participation: medical record services, read 2026-11-10, Where it applies:
Medical records must be retained in their original or legally reproduced form for a period of at least 5 years.
- 42 CFR 482.24(b), Condition of participation: medical record services, read 2026-11-10, The rule, in its own words:
Medical records must be retained in their original or legally reproduced form for a period of at least 5 years.
- 45 CFR 160.103, Definitions: covered entity, read 2026-11-10, What it bears on for a hospital's patient records:
A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.
- 45 CFR 160.103, Definitions: covered entity, read 2026-11-10, Where it applies:
A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.
- 45 CFR 160.103, Definitions: covered entity, read 2026-11-10, The rule, in its own words:
A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.
- 45 CFR 164.502(a)(5)(ii), Sale of protected health information, read 2026-11-10, What it bears on for a hospital's patient records:
where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information
- 45 CFR 164.502(a)(5)(ii), Sale of protected health information, read 2026-11-10, Where it applies:
where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information
- 45 CFR 164.502(a)(5)(ii), Sale of protected health information, read 2026-11-10, The rule, in its own words:
where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information
- 45 CFR 164.508(a)(4), Authorization required: sale of protected health information, read 2026-11-10, What it bears on for a hospital's patient records:
Such authorization must state that the disclosure will result in remuneration to the covered entity.
- 45 CFR 164.508(a)(4), Authorization required: sale of protected health information, read 2026-11-10, Where it applies:
Such authorization must state that the disclosure will result in remuneration to the covered entity.
- 45 CFR 164.508(a)(4), Authorization required: sale of protected health information, read 2026-11-10, The rule, in its own words:
Such authorization must state that the disclosure will result in remuneration to the covered entity.
- 45 CFR 164.512(i), Uses and disclosures for research purposes, read 2026-11-10, What it bears on for a hospital's patient records:
Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by § 164.508 for use or disclosure of protected health information has been approved
- 45 CFR 164.512(i), Uses and disclosures for research purposes, read 2026-11-10, Where it applies:
Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by § 164.508 for use or disclosure of protected health information has been approved
- 45 CFR 164.512(i), Uses and disclosures for research purposes, read 2026-11-10, The rule, in its own words:
Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by § 164.508 for use or disclosure of protected health information has been approved
- 45 CFR 164.514(e), Limited data set, read 2026-11-10, What it bears on for a hospital's patient records:
A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient
- 45 CFR 164.514(e), Limited data set, read 2026-11-10, Where it applies:
A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient
- 45 CFR 164.514(e), Limited data set, read 2026-11-10, The rule, in its own words:
A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient
- California Civil Code 56.10(d), Confidentiality of Medical Information Act, read 2026-11-10, What it bears on for a hospital's patient records:
shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient
- California Civil Code 56.10(d), Confidentiality of Medical Information Act, read 2026-11-10, Where it applies:
shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient
- California Civil Code 56.10(d), Confidentiality of Medical Information Act, read 2026-11-10, The rule, in its own words:
shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient
- HHS de-identification guidance, Guidance regarding methods for de-identification, read 2026-11-10, What it bears on for a hospital's patient records:
The guidance explains and answers questions regarding the two methods that can be used to satisfy the Privacy Rule’s de-identification standard: Expert Determination and Safe Harbor
- HHS de-identification guidance, Guidance regarding methods for de-identification, read 2026-11-10, Where it applies:
The guidance explains and answers questions regarding the two methods that can be used to satisfy the Privacy Rule’s de-identification standard: Expert Determination and Safe Harbor
- HHS de-identification guidance, Guidance regarding methods for de-identification, read 2026-11-10, The rule, in its own words:
The guidance explains and answers questions regarding the two methods that can be used to satisfy the Privacy Rule’s de-identification standard: Expert Determination and Safe Harbor
- HHS research guidance, HIPAA and Research, read 2026-11-10, What it bears on for a hospital's patient records:
covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule.
- HHS research guidance, HIPAA and Research, read 2026-11-10, Where it applies:
covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule.
- HHS research guidance, HIPAA and Research, read 2026-11-10, The rule, in its own words:
covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule.
The method in full
Each rule's own 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10 were read through estate-fetch and stored whole (sha256 on every row).
For every text, three questions were answered from its own words: what it bears on for a hospital's patient records, where it applies, the rule, in its own words.
Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the text read does not address the question.
A rule with several texts reads 'varies' where they disagree.
9 rules, 9 texts.
1 named document waits to be read; it is left out of every count.
Source list (10)
- eCFR :: 45 CFR 160.103 (quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10)
- eCFR :: 45 CFR 164.502 (quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10)
- eCFR :: 45 CFR 164.508 (quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10)
- eCFR :: 45 CFR 164.512 (quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10)
- eCFR :: 45 CFR 164.514 (quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10)
- Guidance regarding methods for de-identification | HHS (quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10)
- Research | HHS (quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10)
- eCFR :: 42 CFR 482.24 (quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10)
- California Civil Code 56.10 (quoted for reporting from the publisher's 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10)
- RCW 19.373.070 (not yet read)
Quote this figure or put it on your site
2 of 9 rules read bear on research uses of hospital patient data, each quoted from its own text, read 10 November 2026.
What it bears on for a hospital's patient records, by rule: research uses and disclosures 2 of 9, the patient's authorisation a sale needs 1 of 9, when a record stops identifying the patient 1 of 9, a limited data set and its data use agreement 1 of 9, the medical records a hospital must keep 1 of 9, selling protected health information 1 of 9, a state's own confidentiality law 1 of 9, whether the hospital is a HIPAA covered entity 1 of 9 (9 rules, read 10 November 2026).
Where it applies, by rule: United States, federal 8 of 9, a US state 1 of 9 (9 rules, read 10 November 2026).
The rule, in its own words, by rule: stated 9 of 9 (9 rules, read 10 November 2026).
Suggested citation: "The rules a hospital patient record turns on", updated 2026-11-10, https://sellhospitaldatatoai.com/datasets/hospital-patient-data-law/.
Get the CSV (27 answers, compiled 2026-11-10)
Questions this data answers
Which rules decide whether a US hospital may license patient data to AI: the covered entity definition, the sale ban and authorisation, research disclosures, de-identification and limited data sets, the hospital's medical record duties, and California's and Washington's state rules?
2 of 9 rules read bear on research uses of hospital patient data, each quoted from its own text, read 10 November 2026.