# The rules a hospital patient record turns on

> 2 of 9 rules read bear on research uses of hospital patient data, each quoted from its own text, read 10 November 2026.

Sell Hospital Data to AI · https://sellhospitaldatatoai.com/datasets/hospital-patient-data-law/ · computed 2026-11-10

**Rules on research uses:** 2 of 9 rules (9 texts read; 10 named).

## The answers, question by question

- **What it bears on for a hospital's patient records:** research uses and disclosures 2, the medical records a hospital must keep 1, whether the hospital is a HIPAA covered entity 1, selling protected health information 1, the patient's authorisation a sale needs 1, a limited data set and its data use agreement 1, a state's own confidentiality law 1, when a record stops identifying the patient 1
- **Where it applies:** United States, federal 8, a US state 1
- **The rule, in its own words:** stated 9

## Every rule

| Rule | What it bears on for a hospital's patient records | Where it applies | The rule, in its own words |
|---|---|---|---|
| 42 CFR 482.24(b) | the medical records a hospital must keep | United States, federal | Medical records must be retained in their original or legally reproduced form for a… |
| 45 CFR 160.103 | whether the hospital is a HIPAA covered entity | United States, federal | A health care provider who transmits any health information in electronic form in… |
| 45 CFR 164.502(a)(5)(ii) | selling protected health information | United States, federal | where the covered entity or business associate directly or indirectly receives… |
| 45 CFR 164.508(a)(4) | the patient's authorisation a sale needs | United States, federal | Such authorization must state that the disclosure will result in remuneration to the… |
| 45 CFR 164.512(i) | research uses and disclosures | United States, federal | Board approval of a waiver of authorization. The covered entity obtains documentation… |
| 45 CFR 164.514(e) | a limited data set and its data use agreement | United States, federal | A covered entity may use or disclose a limited data set that meets the requirements of… |
| California Civil Code 56.10(d) | a state's own confidentiality law | a US state | shall not intentionally share, sell, use for marketing, or otherwise use medical… |
| HHS de-identification guidance | when a record stops identifying the patient | United States, federal | The guidance explains and answers questions regarding the two methods that can be used to… |
| HHS research guidance | research uses and disclosures | United States, federal | covered entities are permitted to use and disclose protected health information for… |

## The sentence each answer rests on (27)

- 42 CFR 482.24(b), [Condition of participation: medical record services](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24), read 2026-11-10, What it bears on for a hospital's patient records: "Medical records must be retained in their original or legally reproduced form for a period of at least 5 years."
- 42 CFR 482.24(b), [Condition of participation: medical record services](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24), read 2026-11-10, Where it applies: "Medical records must be retained in their original or legally reproduced form for a period of at least 5 years."
- 42 CFR 482.24(b), [Condition of participation: medical record services](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24), read 2026-11-10, The rule, in its own words: "Medical records must be retained in their original or legally reproduced form for a period of at least 5 years."
- 45 CFR 160.103, [Definitions: covered entity](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103), read 2026-11-10, What it bears on for a hospital's patient records: "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter."
- 45 CFR 160.103, [Definitions: covered entity](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103), read 2026-11-10, Where it applies: "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter."
- 45 CFR 160.103, [Definitions: covered entity](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103), read 2026-11-10, The rule, in its own words: "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter."
- 45 CFR 164.502(a)(5)(ii), [Sale of protected health information](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502), read 2026-11-10, What it bears on for a hospital's patient records: "where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information"
- 45 CFR 164.502(a)(5)(ii), [Sale of protected health information](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502), read 2026-11-10, Where it applies: "where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information"
- 45 CFR 164.502(a)(5)(ii), [Sale of protected health information](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502), read 2026-11-10, The rule, in its own words: "where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information"
- 45 CFR 164.508(a)(4), [Authorization required: sale of protected health information](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508), read 2026-11-10, What it bears on for a hospital's patient records: "Such authorization must state that the disclosure will result in remuneration to the covered entity."
- 45 CFR 164.508(a)(4), [Authorization required: sale of protected health information](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508), read 2026-11-10, Where it applies: "Such authorization must state that the disclosure will result in remuneration to the covered entity."
- 45 CFR 164.508(a)(4), [Authorization required: sale of protected health information](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508), read 2026-11-10, The rule, in its own words: "Such authorization must state that the disclosure will result in remuneration to the covered entity."
- 45 CFR 164.512(i), [Uses and disclosures for research purposes](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512), read 2026-11-10, What it bears on for a hospital's patient records: "Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by § 164.508 for use or disclosure of protected health information has been approved"
- 45 CFR 164.512(i), [Uses and disclosures for research purposes](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512), read 2026-11-10, Where it applies: "Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by § 164.508 for use or disclosure of protected health information has been approved"
- 45 CFR 164.512(i), [Uses and disclosures for research purposes](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512), read 2026-11-10, The rule, in its own words: "Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by § 164.508 for use or disclosure of protected health information has been approved"
- 45 CFR 164.514(e), [Limited data set](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-11-10, What it bears on for a hospital's patient records: "A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient"
- 45 CFR 164.514(e), [Limited data set](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-11-10, Where it applies: "A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient"
- 45 CFR 164.514(e), [Limited data set](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-11-10, The rule, in its own words: "A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient"
- California Civil Code 56.10(d), [Confidentiality of Medical Information Act](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10), read 2026-11-10, What it bears on for a hospital's patient records: "shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient"
- California Civil Code 56.10(d), [Confidentiality of Medical Information Act](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10), read 2026-11-10, Where it applies: "shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient"
- California Civil Code 56.10(d), [Confidentiality of Medical Information Act](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10), read 2026-11-10, The rule, in its own words: "shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient"
- HHS de-identification guidance, [Guidance regarding methods for de-identification](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), read 2026-11-10, What it bears on for a hospital's patient records: "The guidance explains and answers questions regarding the two methods that can be used to satisfy the Privacy Rule’s de-identification standard: Expert Determination and Safe Harbor"
- HHS de-identification guidance, [Guidance regarding methods for de-identification](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), read 2026-11-10, Where it applies: "The guidance explains and answers questions regarding the two methods that can be used to satisfy the Privacy Rule’s de-identification standard: Expert Determination and Safe Harbor"
- HHS de-identification guidance, [Guidance regarding methods for de-identification](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), read 2026-11-10, The rule, in its own words: "The guidance explains and answers questions regarding the two methods that can be used to satisfy the Privacy Rule’s de-identification standard: Expert Determination and Safe Harbor"
- HHS research guidance, [HIPAA and Research](https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html), read 2026-11-10, What it bears on for a hospital's patient records: "covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule."
- HHS research guidance, [HIPAA and Research](https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html), read 2026-11-10, Where it applies: "covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule."
- HHS research guidance, [HIPAA and Research](https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html), read 2026-11-10, The rule, in its own words: "covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule."

## Methodology

Each rule's own 45 CFR Parts 160 and 164, HHS de-identification and research guidance, 42 CFR 482.24 and California Civil Code 56.10 were read through estate-fetch and stored whole (sha256 on every row). For every text, three questions were answered from its own words: what it bears on for a hospital's patient records, where it applies, the rule, in its own words. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the text read does not address the question. A rule with several texts reads 'varies' where they disagree. 9 rules, 9 texts.

## Sources

- [eCFR :: 45 CFR 160.103](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103) (read)
- [eCFR :: 45 CFR 164.502](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) (read)
- [eCFR :: 45 CFR 164.508](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508) (read)
- [eCFR :: 45 CFR 164.512](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512) (read)
- [eCFR :: 45 CFR 164.514](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514) (read)
- [Guidance regarding methods for de-identification \| HHS](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html) (read)
- [Research \| HHS](https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html) (read)
- [eCFR :: 42 CFR 482.24](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24) (read)
- [California Civil Code 56.10](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10) (read)
- [RCW 19.373.070](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070) (unread)

## Cite or embed

- 2 of 9 rules read bear on research uses of hospital patient data, each quoted from its own text, read 10 November 2026.
- What it bears on for a hospital's patient records, by rule: research uses and disclosures 2 of 9, the patient's authorisation a sale needs 1 of 9, when a record stops identifying the patient 1 of 9, a limited data set and its data use agreement 1 of 9, the medical records a hospital must keep 1 of 9, selling protected health information 1 of 9, a state's own confidentiality law 1 of 9, whether the hospital is a HIPAA covered entity 1 of 9 (9 rules, read 10 November 2026).
- Where it applies, by rule: United States, federal 8 of 9, a US state 1 of 9 (9 rules, read 10 November 2026).
- The rule, in its own words, by rule: stated 9 of 9 (9 rules, read 10 November 2026).

Cite as: "The rules a hospital patient record turns on", updated 2026-11-10, https://sellhospitaldatatoai.com/datasets/hospital-patient-data-law/.

CSV: https://sellhospitaldatatoai.com/datasets/hospital-patient-data-law.csv
JSON: https://sellhospitaldatatoai.com/datasets/hospital-patient-data-law.json
Embed (plain HTML, static link back): see https://sellhospitaldatatoai.com/datasets/hospital-patient-data-law/#lead