{
 "name": "The rules a physical therapy record licence turns on",
 "title": "The rules a physical therapy record licence turns on",
 "kind": "terms-board",
 "url": "https://sellphysicaltherapydatatoai.com/datasets/physical-therapy-data-law/",
 "csv": "https://sellphysicaltherapydatatoai.com/datasets/physical-therapy-data-law.csv",
 "markdown": "https://sellphysicaltherapydatatoai.com/datasets/physical-therapy-data-law/index.md",
 "computed_at": "2026-11-10",
 "license": "https://sellphysicaltherapydatatoai.com/terms",
 "headline": "1 of 9 rules read set out how a record stops being protected health information, each quoted from its own text, read 10 November 2026.",
 "quotes": [
  "1 of 9 rules read set out how a record stops being protected health information, each quoted from its own text, read 10 November 2026.",
  "What it concerns, by rule: what a business associate may do 2 of 9, the patient authorisation a sale needs 1 of 9, how data stops being PHI 1 of 9, who and what HIPAA covers 1 of 9, a limited data set and its agreement 1 of 9, the record Medicare requires 1 of 9, payment for protected health information 1 of 9, a state bar on selling medical information 1 of 9 (9 rules, read 10 November 2026).",
  "Whose rule, by rule: federal regulation or HHS guidance 8 of 9, California statute 1 of 9 (9 rules, read 10 November 2026).",
  "In its own text, by rule: stated 9 of 9 (9 rules, read 10 November 2026)."
 ],
 "citation": "\"The rules a physical therapy record licence turns on\", updated 2026-11-10, https://sellphysicaltherapydatatoai.com/datasets/physical-therapy-data-law/.",
 "national": {
  "n": 9,
  "unit": "rules",
  "documents": 9,
  "published_sources": 9,
  "named_sources": 11
 },
 "board": {
  "type": "clauses",
  "noun": {
   "one": "rule",
   "many": "rules"
  },
  "document": {
   "one": "text",
   "many": "texts"
  },
  "fields": [
   {
    "id": "concerns",
    "label": "What it concerns",
    "counts": {
     "plan-of-care": 1,
     "definitions": 1,
     "sale-of-phi": 1,
     "business-associate": 2,
     "authorization": 1,
     "limited-data-set": 1,
     "state-bar": 1,
     "de-identification": 1
    },
    "values": [
     {
      "value": "sale-of-phi",
      "text": "payment for protected health information"
     },
     {
      "value": "authorization",
      "text": "the patient authorisation a sale needs"
     },
     {
      "value": "de-identification",
      "text": "how data stops being PHI"
     },
     {
      "value": "limited-data-set",
      "text": "a limited data set and its agreement"
     },
     {
      "value": "business-associate",
      "text": "what a business associate may do"
     },
     {
      "value": "definitions",
      "text": "who and what HIPAA covers"
     },
     {
      "value": "state-bar",
      "text": "a state bar on selling medical information"
     },
     {
      "value": "plan-of-care",
      "text": "the record Medicare requires"
     },
     {
      "value": "ethics",
      "text": "the profession's own duty of confidence"
     }
    ]
   },
   {
    "id": "level",
    "label": "Whose rule",
    "counts": {
     "federal": 8,
     "california": 1
    },
    "values": [
     {
      "value": "federal",
      "text": "federal regulation or HHS guidance"
     },
     {
      "value": "california",
      "text": "California statute"
     },
     {
      "value": "profession",
      "text": "the American Physical Therapy Association"
     }
    ]
   },
   {
    "id": "text",
    "label": "In its own text",
    "counts": {
     "stated": 9
    },
    "values": [
     {
      "value": "stated",
      "text": "stated"
     }
    ],
    "clause": true
   }
  ],
  "lead": {
   "type": "share",
   "field": "concerns",
   "value": "de-identification",
   "n": 1,
   "of": 9,
   "label": "Rules on how data stops being PHI"
  },
  "vendors": [
   {
    "name": "42 CFR 410.61",
    "answers": {
     "concerns": {
      "value": "plan-of-care",
      "text": "the record Medicare requires",
      "documents": [
       {
        "document": "Plan of treatment requirements for outpatient rehabilitation services",
        "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-410/subpart-B/section-410.61",
        "value": "plan-of-care",
        "quote": "must be furnished under a written plan of treatment that meets the requirements of paragraphs (b) through (e) of this section"
       }
      ]
     },
     "level": {
      "value": "federal",
      "text": "federal regulation or HHS guidance",
      "documents": [
       {
        "document": "Plan of treatment requirements for outpatient rehabilitation services",
        "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-410/subpart-B/section-410.61",
        "value": "federal",
        "quote": "must be furnished under a written plan of treatment that meets the requirements of paragraphs (b) through (e) of this section"
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "must be furnished under a written plan of treatment that meets the requirements of…",
      "documents": [
       {
        "document": "Plan of treatment requirements for outpatient rehabilitation services",
        "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-410/subpart-B/section-410.61",
        "value": "stated",
        "quote": "must be furnished under a written plan of treatment that meets the requirements of paragraphs (b) through (e) of this section"
       }
      ]
     }
    }
   },
   {
    "name": "45 CFR 160.103",
    "answers": {
     "concerns": {
      "value": "definitions",
      "text": "who and what HIPAA covers",
      "documents": [
       {
        "document": "Definitions",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103",
        "value": "definitions",
        "quote": "Health care provider means a provider of services (as defined in section 1861(u) of the Act"
       }
      ]
     },
     "level": {
      "value": "federal",
      "text": "federal regulation or HHS guidance",
      "documents": [
       {
        "document": "Definitions",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103",
        "value": "federal",
        "quote": "Health care provider means a provider of services (as defined in section 1861(u) of the Act"
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "Health care provider means a provider of services (as defined in section 1861(u) of the…",
      "documents": [
       {
        "document": "Definitions",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103",
        "value": "stated",
        "quote": "Health care provider means a provider of services (as defined in section 1861(u) of the Act"
       }
      ]
     }
    }
   },
   {
    "name": "45 CFR 164.502(a)(5)(ii)",
    "answers": {
     "concerns": {
      "value": "sale-of-phi",
      "text": "payment for protected health information",
      "documents": [
       {
        "document": "Uses and disclosures of protected health information: General rules",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
        "value": "sale-of-phi",
        "quote": "For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence"
       }
      ]
     },
     "level": {
      "value": "federal",
      "text": "federal regulation or HHS guidance",
      "documents": [
       {
        "document": "Uses and disclosures of protected health information: General rules",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
        "value": "federal",
        "quote": "For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence"
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "For the sale, transfer, merger, or consolidation of all or part of the covered entity and…",
      "documents": [
       {
        "document": "Uses and disclosures of protected health information: General rules",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
        "value": "stated",
        "quote": "For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence"
       }
      ]
     }
    }
   },
   {
    "name": "45 CFR 164.504(e)",
    "answers": {
     "concerns": {
      "value": "business-associate",
      "text": "what a business associate may do",
      "documents": [
       {
        "document": "Uses and disclosures: Organizational requirements",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504",
        "value": "business-associate",
        "quote": "Not use or further disclose the information other than as permitted or required by the contract or as required by law"
       }
      ]
     },
     "level": {
      "value": "federal",
      "text": "federal regulation or HHS guidance",
      "documents": [
       {
        "document": "Uses and disclosures: Organizational requirements",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504",
        "value": "federal",
        "quote": "Not use or further disclose the information other than as permitted or required by the contract or as required by law"
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "Not use or further disclose the information other than as permitted or required by the…",
      "documents": [
       {
        "document": "Uses and disclosures: Organizational requirements",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504",
        "value": "stated",
        "quote": "Not use or further disclose the information other than as permitted or required by the contract or as required by law"
       }
      ]
     }
    }
   },
   {
    "name": "45 CFR 164.508(a)(4)",
    "answers": {
     "concerns": {
      "value": "authorization",
      "text": "the patient authorisation a sale needs",
      "documents": [
       {
        "document": "Uses and disclosures for which an authorization is required",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508",
        "value": "authorization",
        "quote": "Such authorization must state that the disclosure will result in remuneration to the covered entity."
       }
      ]
     },
     "level": {
      "value": "federal",
      "text": "federal regulation or HHS guidance",
      "documents": [
       {
        "document": "Uses and disclosures for which an authorization is required",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508",
        "value": "federal",
        "quote": "Such authorization must state that the disclosure will result in remuneration to the covered entity."
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "Such authorization must state that the disclosure will result in remuneration to the…",
      "documents": [
       {
        "document": "Uses and disclosures for which an authorization is required",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508",
        "value": "stated",
        "quote": "Such authorization must state that the disclosure will result in remuneration to the covered entity."
       }
      ]
     }
    }
   },
   {
    "name": "45 CFR 164.514(b) and (e)",
    "answers": {
     "concerns": {
      "value": "limited-data-set",
      "text": "a limited data set and its agreement",
      "documents": [
       {
        "document": "Other requirements relating to uses and disclosures of protected health information",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514",
        "value": "limited-data-set",
        "quote": "if the covered entity enters into a data use agreement with the limited data set recipient"
       }
      ]
     },
     "level": {
      "value": "federal",
      "text": "federal regulation or HHS guidance",
      "documents": [
       {
        "document": "Other requirements relating to uses and disclosures of protected health information",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514",
        "value": "federal",
        "quote": "if the covered entity enters into a data use agreement with the limited data set recipient"
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "if the covered entity enters into a data use agreement with the limited data set recipient",
      "documents": [
       {
        "document": "Other requirements relating to uses and disclosures of protected health information",
        "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514",
        "value": "stated",
        "quote": "if the covered entity enters into a data use agreement with the limited data set recipient"
       }
      ]
     }
    }
   },
   {
    "name": "California Civil Code 56.10",
    "answers": {
     "concerns": {
      "value": "state-bar",
      "text": "a state bar on selling medical information",
      "documents": [
       {
        "document": "Confidentiality of Medical Information Act",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10",
        "value": "state-bar",
        "quote": "shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization"
       }
      ]
     },
     "level": {
      "value": "california",
      "text": "California statute",
      "documents": [
       {
        "document": "Confidentiality of Medical Information Act",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10",
        "value": "california",
        "quote": "shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization"
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "shall not disclose medical information regarding a patient of the provider of health care…",
      "documents": [
       {
        "document": "Confidentiality of Medical Information Act",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10",
        "value": "stated",
        "quote": "shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization"
       }
      ]
     }
    }
   },
   {
    "name": "HHS business associate guidance",
    "answers": {
     "concerns": {
      "value": "business-associate",
      "text": "what a business associate may do",
      "documents": [
       {
        "document": "Business Associates Frequently Asked Questions",
        "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html",
        "value": "business-associate",
        "quote": "the researcher may be a business associate with respect to such services, but not for the researcher’s own research activities"
       }
      ]
     },
     "level": {
      "value": "federal",
      "text": "federal regulation or HHS guidance",
      "documents": [
       {
        "document": "Business Associates Frequently Asked Questions",
        "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html",
        "value": "federal",
        "quote": "the researcher may be a business associate with respect to such services, but not for the researcher’s own research activities"
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "the researcher may be a business associate with respect to such services, but not for the…",
      "documents": [
       {
        "document": "Business Associates Frequently Asked Questions",
        "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html",
        "value": "stated",
        "quote": "the researcher may be a business associate with respect to such services, but not for the researcher’s own research activities"
       }
      ]
     }
    }
   },
   {
    "name": "HHS de-identification guidance",
    "answers": {
     "concerns": {
      "value": "de-identification",
      "text": "how data stops being PHI",
      "documents": [
       {
        "document": "Guidance Regarding Methods for De-identification of Protected Health Information",
        "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html",
        "value": "de-identification",
        "quote": "Regardless of the method by which de-identification is achieved, the Privacy Rule does not restrict the use or disclosure of de-identified health information, as it is no longer considered protected health information."
       }
      ]
     },
     "level": {
      "value": "federal",
      "text": "federal regulation or HHS guidance",
      "documents": [
       {
        "document": "Guidance Regarding Methods for De-identification of Protected Health Information",
        "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html",
        "value": "federal",
        "quote": "Regardless of the method by which de-identification is achieved, the Privacy Rule does not restrict the use or disclosure of de-identified health information, as it is no longer considered protected health information."
       }
      ]
     },
     "text": {
      "value": "stated",
      "text": "Regardless of the method by which de-identification is achieved, the Privacy Rule does…",
      "documents": [
       {
        "document": "Guidance Regarding Methods for De-identification of Protected Health Information",
        "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html",
        "value": "stated",
        "quote": "Regardless of the method by which de-identification is achieved, the Privacy Rule does not restrict the use or disclosure of de-identified health information, as it is no longer considered protected health information."
       }
      ]
     }
    }
   }
  ]
 },
 "subject_kind": "rule",
 "rows": [
  {
   "subject": "42 CFR 410.61",
   "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-410/subpart-B/section-410.61",
   "document": "Plan of treatment requirements for outpatient rehabilitation services",
   "question": "concerns",
   "answer": "plan-of-care",
   "answer_text": "the record Medicare requires",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "must be furnished under a written plan of treatment that meets the requirements of paragraphs (b) through (e) of this section",
   "text_sha256": "3b9d2f0176649dd7f6b62f6a58020693877368252d63af7873cb6f0a918a3433"
  },
  {
   "subject": "42 CFR 410.61",
   "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-410/subpart-B/section-410.61",
   "document": "Plan of treatment requirements for outpatient rehabilitation services",
   "question": "level",
   "answer": "federal",
   "answer_text": "federal regulation or HHS guidance",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "must be furnished under a written plan of treatment that meets the requirements of paragraphs (b) through (e) of this section",
   "text_sha256": "3b9d2f0176649dd7f6b62f6a58020693877368252d63af7873cb6f0a918a3433"
  },
  {
   "subject": "42 CFR 410.61",
   "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-410/subpart-B/section-410.61",
   "document": "Plan of treatment requirements for outpatient rehabilitation services",
   "question": "text",
   "answer": "stated",
   "answer_text": "must be furnished under a written plan of treatment that meets the requirements of…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "must be furnished under a written plan of treatment that meets the requirements of paragraphs (b) through (e) of this section",
   "text_sha256": "3b9d2f0176649dd7f6b62f6a58020693877368252d63af7873cb6f0a918a3433"
  },
  {
   "subject": "45 CFR 160.103",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103",
   "document": "Definitions",
   "question": "concerns",
   "answer": "definitions",
   "answer_text": "who and what HIPAA covers",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Health care provider means a provider of services (as defined in section 1861(u) of the Act",
   "text_sha256": "6452027a5e10c65b9109067e105e75e8e10ead90b4d5f4469240bc2a26a185d3"
  },
  {
   "subject": "45 CFR 160.103",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103",
   "document": "Definitions",
   "question": "level",
   "answer": "federal",
   "answer_text": "federal regulation or HHS guidance",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Health care provider means a provider of services (as defined in section 1861(u) of the Act",
   "text_sha256": "6452027a5e10c65b9109067e105e75e8e10ead90b4d5f4469240bc2a26a185d3"
  },
  {
   "subject": "45 CFR 160.103",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103",
   "document": "Definitions",
   "question": "text",
   "answer": "stated",
   "answer_text": "Health care provider means a provider of services (as defined in section 1861(u) of the…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Health care provider means a provider of services (as defined in section 1861(u) of the Act",
   "text_sha256": "6452027a5e10c65b9109067e105e75e8e10ead90b4d5f4469240bc2a26a185d3"
  },
  {
   "subject": "45 CFR 164.502(a)(5)(ii)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
   "document": "Uses and disclosures of protected health information: General rules",
   "question": "concerns",
   "answer": "sale-of-phi",
   "answer_text": "payment for protected health information",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence",
   "text_sha256": "6779c13fa7034bb24ae4d560a30b8390a99df4319a1dd665e7082cf91fb9d55a"
  },
  {
   "subject": "45 CFR 164.502(a)(5)(ii)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
   "document": "Uses and disclosures of protected health information: General rules",
   "question": "level",
   "answer": "federal",
   "answer_text": "federal regulation or HHS guidance",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence",
   "text_sha256": "6779c13fa7034bb24ae4d560a30b8390a99df4319a1dd665e7082cf91fb9d55a"
  },
  {
   "subject": "45 CFR 164.502(a)(5)(ii)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
   "document": "Uses and disclosures of protected health information: General rules",
   "question": "text",
   "answer": "stated",
   "answer_text": "For the sale, transfer, merger, or consolidation of all or part of the covered entity and…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence",
   "text_sha256": "6779c13fa7034bb24ae4d560a30b8390a99df4319a1dd665e7082cf91fb9d55a"
  },
  {
   "subject": "45 CFR 164.504(e)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504",
   "document": "Uses and disclosures: Organizational requirements",
   "question": "concerns",
   "answer": "business-associate",
   "answer_text": "what a business associate may do",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Not use or further disclose the information other than as permitted or required by the contract or as required by law",
   "text_sha256": "e1677425551b7c62726592dea1451968a074b8c731e2c16d379174706ef6dd6c"
  },
  {
   "subject": "45 CFR 164.504(e)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504",
   "document": "Uses and disclosures: Organizational requirements",
   "question": "level",
   "answer": "federal",
   "answer_text": "federal regulation or HHS guidance",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Not use or further disclose the information other than as permitted or required by the contract or as required by law",
   "text_sha256": "e1677425551b7c62726592dea1451968a074b8c731e2c16d379174706ef6dd6c"
  },
  {
   "subject": "45 CFR 164.504(e)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504",
   "document": "Uses and disclosures: Organizational requirements",
   "question": "text",
   "answer": "stated",
   "answer_text": "Not use or further disclose the information other than as permitted or required by the…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Not use or further disclose the information other than as permitted or required by the contract or as required by law",
   "text_sha256": "e1677425551b7c62726592dea1451968a074b8c731e2c16d379174706ef6dd6c"
  },
  {
   "subject": "45 CFR 164.508(a)(4)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508",
   "document": "Uses and disclosures for which an authorization is required",
   "question": "concerns",
   "answer": "authorization",
   "answer_text": "the patient authorisation a sale needs",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Such authorization must state that the disclosure will result in remuneration to the covered entity.",
   "text_sha256": "2eb75db2b4f3219cecfcad4f96ff0d51522f59ba760c8c6fc05918136191aa86"
  },
  {
   "subject": "45 CFR 164.508(a)(4)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508",
   "document": "Uses and disclosures for which an authorization is required",
   "question": "level",
   "answer": "federal",
   "answer_text": "federal regulation or HHS guidance",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Such authorization must state that the disclosure will result in remuneration to the covered entity.",
   "text_sha256": "2eb75db2b4f3219cecfcad4f96ff0d51522f59ba760c8c6fc05918136191aa86"
  },
  {
   "subject": "45 CFR 164.508(a)(4)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508",
   "document": "Uses and disclosures for which an authorization is required",
   "question": "text",
   "answer": "stated",
   "answer_text": "Such authorization must state that the disclosure will result in remuneration to the…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Such authorization must state that the disclosure will result in remuneration to the covered entity.",
   "text_sha256": "2eb75db2b4f3219cecfcad4f96ff0d51522f59ba760c8c6fc05918136191aa86"
  },
  {
   "subject": "45 CFR 164.514(b) and (e)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514",
   "document": "Other requirements relating to uses and disclosures of protected health information",
   "question": "concerns",
   "answer": "limited-data-set",
   "answer_text": "a limited data set and its agreement",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "if the covered entity enters into a data use agreement with the limited data set recipient",
   "text_sha256": "50cac8573b1f8ba07a0fdebd4d7025f07bc7803d7639444bfc6e2564311f0fc3"
  },
  {
   "subject": "45 CFR 164.514(b) and (e)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514",
   "document": "Other requirements relating to uses and disclosures of protected health information",
   "question": "level",
   "answer": "federal",
   "answer_text": "federal regulation or HHS guidance",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "if the covered entity enters into a data use agreement with the limited data set recipient",
   "text_sha256": "50cac8573b1f8ba07a0fdebd4d7025f07bc7803d7639444bfc6e2564311f0fc3"
  },
  {
   "subject": "45 CFR 164.514(b) and (e)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514",
   "document": "Other requirements relating to uses and disclosures of protected health information",
   "question": "text",
   "answer": "stated",
   "answer_text": "if the covered entity enters into a data use agreement with the limited data set recipient",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "if the covered entity enters into a data use agreement with the limited data set recipient",
   "text_sha256": "50cac8573b1f8ba07a0fdebd4d7025f07bc7803d7639444bfc6e2564311f0fc3"
  },
  {
   "subject": "California Civil Code 56.10",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10",
   "document": "Confidentiality of Medical Information Act",
   "question": "concerns",
   "answer": "state-bar",
   "answer_text": "a state bar on selling medical information",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization",
   "text_sha256": "f361bf74f08a35a8436e16e506190de89de954d1ab0d66bb6116ade484e5fdeb"
  },
  {
   "subject": "California Civil Code 56.10",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10",
   "document": "Confidentiality of Medical Information Act",
   "question": "level",
   "answer": "california",
   "answer_text": "California statute",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization",
   "text_sha256": "f361bf74f08a35a8436e16e506190de89de954d1ab0d66bb6116ade484e5fdeb"
  },
  {
   "subject": "California Civil Code 56.10",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10",
   "document": "Confidentiality of Medical Information Act",
   "question": "text",
   "answer": "stated",
   "answer_text": "shall not disclose medical information regarding a patient of the provider of health care…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization",
   "text_sha256": "f361bf74f08a35a8436e16e506190de89de954d1ab0d66bb6116ade484e5fdeb"
  },
  {
   "subject": "HHS business associate guidance",
   "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html",
   "document": "Business Associates Frequently Asked Questions",
   "question": "concerns",
   "answer": "business-associate",
   "answer_text": "what a business associate may do",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "the researcher may be a business associate with respect to such services, but not for the researcher’s own research activities",
   "text_sha256": "e280bcfa4c0b25f73798a16959c989b846852c642a91448f589f07cf86a6cd1e"
  },
  {
   "subject": "HHS business associate guidance",
   "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html",
   "document": "Business Associates Frequently Asked Questions",
   "question": "level",
   "answer": "federal",
   "answer_text": "federal regulation or HHS guidance",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "the researcher may be a business associate with respect to such services, but not for the researcher’s own research activities",
   "text_sha256": "e280bcfa4c0b25f73798a16959c989b846852c642a91448f589f07cf86a6cd1e"
  },
  {
   "subject": "HHS business associate guidance",
   "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html",
   "document": "Business Associates Frequently Asked Questions",
   "question": "text",
   "answer": "stated",
   "answer_text": "the researcher may be a business associate with respect to such services, but not for the…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "the researcher may be a business associate with respect to such services, but not for the researcher’s own research activities",
   "text_sha256": "e280bcfa4c0b25f73798a16959c989b846852c642a91448f589f07cf86a6cd1e"
  },
  {
   "subject": "HHS de-identification guidance",
   "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html",
   "document": "Guidance Regarding Methods for De-identification of Protected Health Information",
   "question": "concerns",
   "answer": "de-identification",
   "answer_text": "how data stops being PHI",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Regardless of the method by which de-identification is achieved, the Privacy Rule does not restrict the use or disclosure of de-identified health information, as it is no longer considered protected health information.",
   "text_sha256": "09e5a15f694cccbc0c4879fb399a120ac8e2add220daf3e27d609ac8d1ffa299"
  },
  {
   "subject": "HHS de-identification guidance",
   "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html",
   "document": "Guidance Regarding Methods for De-identification of Protected Health Information",
   "question": "level",
   "answer": "federal",
   "answer_text": "federal regulation or HHS guidance",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Regardless of the method by which de-identification is achieved, the Privacy Rule does not restrict the use or disclosure of de-identified health information, as it is no longer considered protected health information.",
   "text_sha256": "09e5a15f694cccbc0c4879fb399a120ac8e2add220daf3e27d609ac8d1ffa299"
  },
  {
   "subject": "HHS de-identification guidance",
   "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html",
   "document": "Guidance Regarding Methods for De-identification of Protected Health Information",
   "question": "text",
   "answer": "stated",
   "answer_text": "Regardless of the method by which de-identification is achieved, the Privacy Rule does…",
   "status": "stated",
   "retrieved_at": "2026-11-10",
   "quote": "Regardless of the method by which de-identification is achieved, the Privacy Rule does not restrict the use or disclosure of de-identified health information, as it is no longer considered protected health information.",
   "text_sha256": "09e5a15f694cccbc0c4879fb399a120ac8e2add220daf3e27d609ac8d1ffa299"
  }
 ],
 "sources": [
  {
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
   "label": "eCFR :: 45 CFR 164.502 -- Uses and disclosures of protected health information: General rules.",
   "license": "from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508",
   "label": "eCFR :: 45 CFR 164.508 -- Uses and disclosures for which an authorization is required.",
   "license": "from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514",
   "label": "eCFR :: 45 CFR 164.514 -- Other requirements relating to uses and disclosures of protected health information.",
   "license": "from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103",
   "label": "eCFR :: 45 CFR 160.103 -- Definitions.",
   "license": "from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504",
   "label": "eCFR :: 45 CFR 164.504 -- Uses and disclosures: Organizational requirements.",
   "license": "from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530",
   "label": "eCFR :: 45 CFR 164.530 -- Administrative requirements.",
   "license": "from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment",
   "class": "primary-government",
   "status": "not-terms",
   "why": "45 CFR 164.530 sets a covered entity's documentation duties and retention of its policies, not what may happen to a patient record leaving the practice"
  },
  {
   "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html",
   "label": "Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance",
   "license": "from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html",
   "label": "Business Associates Frequently Asked Questions (FAQs) | HHS.gov",
   "license": "from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10",
   "label": "California Code, CIV 56.10",
   "license": "from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-410/subpart-B/section-410.61",
   "label": "eCFR :: 42 CFR 410.61 -- Plan of treatment requirements for outpatient rehabilitation services.",
   "license": "from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.apta.org/apta-and-you/leadership-and-governance/policies/code-of-ethics-for-the-physical-therapist",
   "label": "Code of Ethics for the Physical Therapist | APTA",
   "license": "from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment",
   "class": "primary-government",
   "status": "not-terms",
   "why": "the stored read of APTA's Code of Ethics page carries the site's navigation and footer, not the code's text"
  }
 ],
 "methodology": "Each rule's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics were read through estate-fetch and stored whole (sha256 on every row). For every text, three questions were answered from its own words: what it concerns, whose rule, in its own text. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the text read does not address the question. A rule with several texts reads 'varies' where they disagree. 9 rules, 9 texts.",
 "embed": "<figure style=\"margin:0;padding:16px;border:1px solid #d0d0d0;background:#ffffff\"><blockquote style=\"margin:0 0 8px;background:#ffffff\">1 of 9 rules read set out how a record stops being protected health information, each quoted from its own text, read 10 November 2026.</blockquote><figcaption style=\"background:#ffffff\"><a href=\"https://sellphysicaltherapydatatoai.com/datasets/physical-therapy-data-law/\" style=\"background:#ffffff\">The rules a physical therapy record licence turns on, sellphysicaltherapydatatoai.com</a></figcaption></figure>"
}