The rules a physical therapy record licence turns on
1 of 9 rules read set out how a record stops being protected health information, each quoted from its own text, read 10 November 2026.
What it concerns
Whose rule
In its own text
Each rule, answer by answer
Read across a row for one rule's answers, and open any of them for the quoted sentence, its text and the read date. A "not stated" cell means the text does not speak to that question.
| Rule | What it concerns | Whose rule | In its own text |
|---|---|---|---|
| 42 CFR 410.61 | the record Medicare requires | federal regulation or HHS guidance | must be furnished under a written plan of treatment that meets the requirements of… |
| 45 CFR 160.103 | who and what HIPAA covers | federal regulation or HHS guidance | Health care provider means a provider of services (as defined in section 1861(u) of the… |
| 45 CFR 164.502(a)(5)(ii) | payment for protected health information | federal regulation or HHS guidance | For the sale, transfer, merger, or consolidation of all or part of the covered entity and… |
| 45 CFR 164.504(e) | what a business associate may do | federal regulation or HHS guidance | Not use or further disclose the information other than as permitted or required by the… |
| 45 CFR 164.508(a)(4) | the patient authorisation a sale needs | federal regulation or HHS guidance | Such authorization must state that the disclosure will result in remuneration to the… |
| 45 CFR 164.514(b) and (e) | a limited data set and its agreement | federal regulation or HHS guidance | if the covered entity enters into a data use agreement with the limited data set recipient |
| California Civil Code 56.10 | a state bar on selling medical information | California statute | shall not disclose medical information regarding a patient of the provider of health care… |
| HHS business associate guidance | what a business associate may do | federal regulation or HHS guidance | the researcher may be a business associate with respect to such services, but not for the… |
| HHS de-identification guidance | how data stops being PHI | federal regulation or HHS guidance | Regardless of the method by which de-identification is achieved, the Privacy Rule does… |
The source sentence behind every answer (27)
- 42 CFR 410.61, Plan of treatment requirements for outpatient rehabilitation services, read 2026-11-10, What it concerns:
must be furnished under a written plan of treatment that meets the requirements of paragraphs (b) through (e) of this section
- 42 CFR 410.61, Plan of treatment requirements for outpatient rehabilitation services, read 2026-11-10, Whose rule:
must be furnished under a written plan of treatment that meets the requirements of paragraphs (b) through (e) of this section
- 42 CFR 410.61, Plan of treatment requirements for outpatient rehabilitation services, read 2026-11-10, In its own text:
must be furnished under a written plan of treatment that meets the requirements of paragraphs (b) through (e) of this section
- 45 CFR 160.103, Definitions, read 2026-11-10, What it concerns:
Health care provider means a provider of services (as defined in section 1861(u) of the Act
- 45 CFR 160.103, Definitions, read 2026-11-10, Whose rule:
Health care provider means a provider of services (as defined in section 1861(u) of the Act
- 45 CFR 160.103, Definitions, read 2026-11-10, In its own text:
Health care provider means a provider of services (as defined in section 1861(u) of the Act
- 45 CFR 164.502(a)(5)(ii), Uses and disclosures of protected health information: General rules, read 2026-11-10, What it concerns:
For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence
- 45 CFR 164.502(a)(5)(ii), Uses and disclosures of protected health information: General rules, read 2026-11-10, Whose rule:
For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence
- 45 CFR 164.502(a)(5)(ii), Uses and disclosures of protected health information: General rules, read 2026-11-10, In its own text:
For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence
- 45 CFR 164.504(e), Uses and disclosures: Organizational requirements, read 2026-11-10, What it concerns:
Not use or further disclose the information other than as permitted or required by the contract or as required by law
- 45 CFR 164.504(e), Uses and disclosures: Organizational requirements, read 2026-11-10, Whose rule:
Not use or further disclose the information other than as permitted or required by the contract or as required by law
- 45 CFR 164.504(e), Uses and disclosures: Organizational requirements, read 2026-11-10, In its own text:
Not use or further disclose the information other than as permitted or required by the contract or as required by law
- 45 CFR 164.508(a)(4), Uses and disclosures for which an authorization is required, read 2026-11-10, What it concerns:
Such authorization must state that the disclosure will result in remuneration to the covered entity.
- 45 CFR 164.508(a)(4), Uses and disclosures for which an authorization is required, read 2026-11-10, Whose rule:
Such authorization must state that the disclosure will result in remuneration to the covered entity.
- 45 CFR 164.508(a)(4), Uses and disclosures for which an authorization is required, read 2026-11-10, In its own text:
Such authorization must state that the disclosure will result in remuneration to the covered entity.
- 45 CFR 164.514(b) and (e), Other requirements relating to uses and disclosures of protected health information, read 2026-11-10, What it concerns:
if the covered entity enters into a data use agreement with the limited data set recipient
- 45 CFR 164.514(b) and (e), Other requirements relating to uses and disclosures of protected health information, read 2026-11-10, Whose rule:
if the covered entity enters into a data use agreement with the limited data set recipient
- 45 CFR 164.514(b) and (e), Other requirements relating to uses and disclosures of protected health information, read 2026-11-10, In its own text:
if the covered entity enters into a data use agreement with the limited data set recipient
- California Civil Code 56.10, Confidentiality of Medical Information Act, read 2026-11-10, What it concerns:
shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization
- California Civil Code 56.10, Confidentiality of Medical Information Act, read 2026-11-10, Whose rule:
shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization
- California Civil Code 56.10, Confidentiality of Medical Information Act, read 2026-11-10, In its own text:
shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization
- HHS business associate guidance, Business Associates Frequently Asked Questions, read 2026-11-10, What it concerns:
the researcher may be a business associate with respect to such services, but not for the researcher’s own research activities
- HHS business associate guidance, Business Associates Frequently Asked Questions, read 2026-11-10, Whose rule:
the researcher may be a business associate with respect to such services, but not for the researcher’s own research activities
- HHS business associate guidance, Business Associates Frequently Asked Questions, read 2026-11-10, In its own text:
the researcher may be a business associate with respect to such services, but not for the researcher’s own research activities
- HHS de-identification guidance, Guidance Regarding Methods for De-identification of Protected Health Information, read 2026-11-10, What it concerns:
Regardless of the method by which de-identification is achieved, the Privacy Rule does not restrict the use or disclosure of de-identified health information, as it is no longer considered protected health information.
- HHS de-identification guidance, Guidance Regarding Methods for De-identification of Protected Health Information, read 2026-11-10, Whose rule:
Regardless of the method by which de-identification is achieved, the Privacy Rule does not restrict the use or disclosure of de-identified health information, as it is no longer considered protected health information.
- HHS de-identification guidance, Guidance Regarding Methods for De-identification of Protected Health Information, read 2026-11-10, In its own text:
Regardless of the method by which de-identification is achieved, the Privacy Rule does not restrict the use or disclosure of de-identified health information, as it is no longer considered protected health information.
Read and excluded
We read 2 named documents that turned out not to be what this board asks about; why is given for each below. They count toward the reading, not the answers.
- eCFR :: 45 CFR 164.530 -- Administrative requirements.: 45 CFR 164.530 sets a covered entity's documentation duties and retention of its policies, not what may happen to a patient record leaving the practice
- Code of Ethics for the Physical Therapist | APTA: the stored read of APTA's Code of Ethics page carries the site's navigation and footer, not the code's text
How this was built
Each rule's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics were read through estate-fetch and stored whole (sha256 on every row).
For every text, three questions were answered from its own words: what it concerns, whose rule, in its own text.
Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the text read does not address the question.
A rule with several texts reads 'varies' where they disagree.
9 rules, 9 texts.
Source list (11)
- eCFR :: 45 CFR 164.502 -- Uses and disclosures of protected health information: General rules. (from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment)
- eCFR :: 45 CFR 164.508 -- Uses and disclosures for which an authorization is required. (from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment)
- eCFR :: 45 CFR 164.514 -- Other requirements relating to uses and disclosures of protected health information. (from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment)
- eCFR :: 45 CFR 160.103 -- Definitions. (from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment)
- eCFR :: 45 CFR 164.504 -- Uses and disclosures: Organizational requirements. (from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment)
- eCFR :: 45 CFR 164.530 -- Administrative requirements. (read, set aside)
- Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance (from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment)
- Business Associates Frequently Asked Questions (FAQs) | HHS.gov (from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment)
- California Code, CIV 56.10 (from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment)
- eCFR :: 42 CFR 410.61 -- Plan of treatment requirements for outpatient rehabilitation services. (from the publisher's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics; reproduced for comment)
- Code of Ethics for the Physical Therapist | APTA (read, set aside)
Use this figure
1 of 9 rules read set out how a record stops being protected health information, each quoted from its own text, read 10 November 2026.
What it concerns, by rule: what a business associate may do 2 of 9, the patient authorisation a sale needs 1 of 9, how data stops being PHI 1 of 9, who and what HIPAA covers 1 of 9, a limited data set and its agreement 1 of 9, the record Medicare requires 1 of 9, payment for protected health information 1 of 9, a state bar on selling medical information 1 of 9 (9 rules, read 10 November 2026).
Whose rule, by rule: federal regulation or HHS guidance 8 of 9, California statute 1 of 9 (9 rules, read 10 November 2026).
In its own text, by rule: stated 9 of 9 (9 rules, read 10 November 2026).
Citation: "The rules a physical therapy record licence turns on", updated 2026-11-10, https://sellphysicaltherapydatatoai.com/datasets/physical-therapy-data-law/.
CSV download (27 answers, worked out 2026-11-10)
Questions this data answers
Which rules decide whether a US physical therapy practice may license its records: the HIPAA ban on selling PHI and the authorisation it needs, de-identification by Safe Harbor or expert determination, the limited data set and its data use agreement, a business associate's limits, California's CMIA, the Medicare plan-of-care record, and the APTA's ethics on confidentiality?
1 of 9 rules read set out how a record stops being protected health information, each quoted from its own text, read 10 November 2026.