Key takeaway
Hold patient-level records until the responsible health privacy reviewer has identified the applicable route. “Research,” a business-associate agreement and removed names answer different questions.
Establish which records and actors HIPAA actually reaches
Start with a specific record holder and proposed disclosure. Is the holder a HIPAA covered entity or a business associate? Is the material protected health information in that setting? Who wants to receive it and for whose purpose? Health-related information is not a single universal category, and an answer about one actor cannot simply be carried across to another.
Section 164.502 restricts covered entities’ and business associates’ uses and disclosures to permitted or required routes. HHS describes distinct research routes, including individual authorization, qualified waiver processes and limited data sets subject to conditions. A recipient describing its project as research has not demonstrated one of those routes. A business associate’s operational access also does not establish authority to build a separate commercial record product.
Request a written agenda from the responsible privacy and legal team before asking an engineer for a patient sample. Identify the proposed fields, originating relationship, receiving entity, purpose, money flow and onward use. Keep sensitive contents out of the commercial introduction itself. Category-level information can support an initial conversation while the release question remains open.
A completed hold record for an attractive but incomplete proposal
Hypothetical example: a software vendor serving a clinic has appointment records and care-related support notes. A separate company asks for a paid training license. The vendor points to its business-associate agreement and proposes deleting patient names. Neither statement demonstrates authority for the new recipient’s training use. The review below deliberately produces a hold rather than a price estimate or a promised pathway.
The reviewer can use this artifact to separate workstreams. An authorization route would need the relevant authorization evidence; a claimed de-identification route would need its own method and documentation; a research waiver is a different inquiry. Preparing all three indiscriminately wastes time and risks copying records before the review owner has chosen a defensible scope.
| Question | Illustrative evidence | Recorded status |
|---|---|---|
| Holder and capacity | Vendor says it acts for a covered clinic | Confirm actual role, contract and origin; no independent right inferred. |
| New disclosure | Paid access for a separate company’s model training | Define receiving entity, fields, outputs and onward use. |
| Remuneration | Recipient would pay for the records | Assess sale-of-PHI provisions and any applicable conditions. |
| Research route | Project title says research; no waiver or authorization file | Route not established by the label. |
| De-identification | Names removed; dates and narrative remain | No completed Safe Harbor or Expert Determination evidence. |
| Decision and owner | Clinic privacy lead and qualified counsel | Hold patient-level sample and license pending a documented route. |
Keep payment, limited data sets and de-identification separate
The current rule’s sale definition concerns direct or indirect remuneration from the recipient for PHI disclosure, with specified exceptions. Its research exception has conditions, including a reasonable cost-based preparation and transmission limitation. The HHS audit protocol explains the remuneration statement required where sale authorization is needed. Those are substantive review questions; calling the payment a referral, preparation charge or license does not settle their treatment.
A limited data set is not automatically de-identified. HHS describes its allowed purposes and data use agreement requirements separately. For HIPAA de-identification, HHS identifies Safe Harbor and Expert Determination methods. The reviewer should require evidence for the chosen method rather than accepting a claim that names were removed. A fictional example or technical masking exercise cannot certify real records.
The useful handoff is a narrow, dated question list with the responsible institutional owner, not an upload. Use rights review for the missing authority and due diligence for recipient questions. VOID’s referral process is not a promise to hold health-record inventory, obtain HIPAA clearance or certify anonymisation. This US federal guide does not resolve state health laws, other federal restrictions, research ethics, non-US rules or the treatment of a particular record. The eCFR page read on 10 October displayed a 7 October version cutoff; confirm current text and the transaction’s full rules before acting.
Use this review agenda with your legal and privacy advisers. Requirements depend on the records, jurisdictions and intended use.