# The rules a physical therapy record licence turns on

> 1 of 9 rules read set out how a record stops being protected health information, each quoted from its own text, read 10 November 2026.

Sell Physical Therapy Data to AI · https://sellphysicaltherapydatatoai.com/datasets/physical-therapy-data-law/ · computed 2026-11-10

**Rules on how data stops being PHI:** 1 of 9 rules (9 texts read; 11 named).

## The answers, question by question

- **What it concerns:** what a business associate may do 2, the record Medicare requires 1, who and what HIPAA covers 1, payment for protected health information 1, the patient authorisation a sale needs 1, a limited data set and its agreement 1, a state bar on selling medical information 1, how data stops being PHI 1
- **Whose rule:** federal regulation or HHS guidance 8, California statute 1
- **In its own text:** stated 9

## Every rule

| Rule | What it concerns | Whose rule | In its own text |
|---|---|---|---|
| 42 CFR 410.61 | the record Medicare requires | federal regulation or HHS guidance | must be furnished under a written plan of treatment that meets the requirements of… |
| 45 CFR 160.103 | who and what HIPAA covers | federal regulation or HHS guidance | Health care provider means a provider of services (as defined in section 1861(u) of the… |
| 45 CFR 164.502(a)(5)(ii) | payment for protected health information | federal regulation or HHS guidance | For the sale, transfer, merger, or consolidation of all or part of the covered entity and… |
| 45 CFR 164.504(e) | what a business associate may do | federal regulation or HHS guidance | Not use or further disclose the information other than as permitted or required by the… |
| 45 CFR 164.508(a)(4) | the patient authorisation a sale needs | federal regulation or HHS guidance | Such authorization must state that the disclosure will result in remuneration to the… |
| 45 CFR 164.514(b) and (e) | a limited data set and its agreement | federal regulation or HHS guidance | if the covered entity enters into a data use agreement with the limited data set recipient |
| California Civil Code 56.10 | a state bar on selling medical information | California statute | shall not disclose medical information regarding a patient of the provider of health care… |
| HHS business associate guidance | what a business associate may do | federal regulation or HHS guidance | the researcher may be a business associate with respect to such services, but not for the… |
| HHS de-identification guidance | how data stops being PHI | federal regulation or HHS guidance | Regardless of the method by which de-identification is achieved, the Privacy Rule does… |

## The sentence each answer rests on (27)

- 42 CFR 410.61, [Plan of treatment requirements for outpatient rehabilitation services](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-410/subpart-B/section-410.61), read 2026-11-10, What it concerns: "must be furnished under a written plan of treatment that meets the requirements of paragraphs (b) through (e) of this section"
- 42 CFR 410.61, [Plan of treatment requirements for outpatient rehabilitation services](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-410/subpart-B/section-410.61), read 2026-11-10, Whose rule: "must be furnished under a written plan of treatment that meets the requirements of paragraphs (b) through (e) of this section"
- 42 CFR 410.61, [Plan of treatment requirements for outpatient rehabilitation services](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-410/subpart-B/section-410.61), read 2026-11-10, In its own text: "must be furnished under a written plan of treatment that meets the requirements of paragraphs (b) through (e) of this section"
- 45 CFR 160.103, [Definitions](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103), read 2026-11-10, What it concerns: "Health care provider means a provider of services (as defined in section 1861(u) of the Act"
- 45 CFR 160.103, [Definitions](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103), read 2026-11-10, Whose rule: "Health care provider means a provider of services (as defined in section 1861(u) of the Act"
- 45 CFR 160.103, [Definitions](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103), read 2026-11-10, In its own text: "Health care provider means a provider of services (as defined in section 1861(u) of the Act"
- 45 CFR 164.502(a)(5)(ii), [Uses and disclosures of protected health information: General rules](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502), read 2026-11-10, What it concerns: "For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence"
- 45 CFR 164.502(a)(5)(ii), [Uses and disclosures of protected health information: General rules](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502), read 2026-11-10, Whose rule: "For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence"
- 45 CFR 164.502(a)(5)(ii), [Uses and disclosures of protected health information: General rules](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502), read 2026-11-10, In its own text: "For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence"
- 45 CFR 164.504(e), [Uses and disclosures: Organizational requirements](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504), read 2026-11-10, What it concerns: "Not use or further disclose the information other than as permitted or required by the contract or as required by law"
- 45 CFR 164.504(e), [Uses and disclosures: Organizational requirements](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504), read 2026-11-10, Whose rule: "Not use or further disclose the information other than as permitted or required by the contract or as required by law"
- 45 CFR 164.504(e), [Uses and disclosures: Organizational requirements](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504), read 2026-11-10, In its own text: "Not use or further disclose the information other than as permitted or required by the contract or as required by law"
- 45 CFR 164.508(a)(4), [Uses and disclosures for which an authorization is required](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508), read 2026-11-10, What it concerns: "Such authorization must state that the disclosure will result in remuneration to the covered entity."
- 45 CFR 164.508(a)(4), [Uses and disclosures for which an authorization is required](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508), read 2026-11-10, Whose rule: "Such authorization must state that the disclosure will result in remuneration to the covered entity."
- 45 CFR 164.508(a)(4), [Uses and disclosures for which an authorization is required](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508), read 2026-11-10, In its own text: "Such authorization must state that the disclosure will result in remuneration to the covered entity."
- 45 CFR 164.514(b) and (e), [Other requirements relating to uses and disclosures of protected health information](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-11-10, What it concerns: "if the covered entity enters into a data use agreement with the limited data set recipient"
- 45 CFR 164.514(b) and (e), [Other requirements relating to uses and disclosures of protected health information](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-11-10, Whose rule: "if the covered entity enters into a data use agreement with the limited data set recipient"
- 45 CFR 164.514(b) and (e), [Other requirements relating to uses and disclosures of protected health information](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-11-10, In its own text: "if the covered entity enters into a data use agreement with the limited data set recipient"
- California Civil Code 56.10, [Confidentiality of Medical Information Act](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10), read 2026-11-10, What it concerns: "shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization"
- California Civil Code 56.10, [Confidentiality of Medical Information Act](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10), read 2026-11-10, Whose rule: "shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization"
- California Civil Code 56.10, [Confidentiality of Medical Information Act](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10), read 2026-11-10, In its own text: "shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization"
- HHS business associate guidance, [Business Associates Frequently Asked Questions](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html), read 2026-11-10, What it concerns: "the researcher may be a business associate with respect to such services, but not for the researcher’s own research activities"
- HHS business associate guidance, [Business Associates Frequently Asked Questions](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html), read 2026-11-10, Whose rule: "the researcher may be a business associate with respect to such services, but not for the researcher’s own research activities"
- HHS business associate guidance, [Business Associates Frequently Asked Questions](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html), read 2026-11-10, In its own text: "the researcher may be a business associate with respect to such services, but not for the researcher’s own research activities"
- HHS de-identification guidance, [Guidance Regarding Methods for De-identification of Protected Health Information](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), read 2026-11-10, What it concerns: "Regardless of the method by which de-identification is achieved, the Privacy Rule does not restrict the use or disclosure of de-identified health information, as it is no longer considered protected health information."
- HHS de-identification guidance, [Guidance Regarding Methods for De-identification of Protected Health Information](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), read 2026-11-10, Whose rule: "Regardless of the method by which de-identification is achieved, the Privacy Rule does not restrict the use or disclosure of de-identified health information, as it is no longer considered protected health information."
- HHS de-identification guidance, [Guidance Regarding Methods for De-identification of Protected Health Information](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), read 2026-11-10, In its own text: "Regardless of the method by which de-identification is achieved, the Privacy Rule does not restrict the use or disclosure of de-identified health information, as it is no longer considered protected health information."

## Read and set aside

- [eCFR :: 45 CFR 164.530 -- Administrative requirements.](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530): 45 CFR 164.530 sets a covered entity's documentation duties and retention of its policies, not what may happen to a patient record leaving the practice
- [Code of Ethics for the Physical Therapist \| APTA](https://www.apta.org/apta-and-you/leadership-and-governance/policies/code-of-ethics-for-the-physical-therapist): the stored read of APTA's Code of Ethics page carries the site's navigation and footer, not the code's text

## Methodology

Each rule's own 45 CFR Parts 160 and 164, the HHS guidance on de-identification and business associates, California Civil Code 56.10, 42 CFR 410.61 and the APTA Code of Ethics were read through estate-fetch and stored whole (sha256 on every row). For every text, three questions were answered from its own words: what it concerns, whose rule, in its own text. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the text read does not address the question. A rule with several texts reads 'varies' where they disagree. 9 rules, 9 texts.

## Sources

- [eCFR :: 45 CFR 164.502 -- Uses and disclosures of protected health information: General rules.](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) (read)
- [eCFR :: 45 CFR 164.508 -- Uses and disclosures for which an authorization is required.](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508) (read)
- [eCFR :: 45 CFR 164.514 -- Other requirements relating to uses and disclosures of protected health information.](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514) (read)
- [eCFR :: 45 CFR 160.103 -- Definitions.](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103) (read)
- [eCFR :: 45 CFR 164.504 -- Uses and disclosures: Organizational requirements.](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504) (read)
- [eCFR :: 45 CFR 164.530 -- Administrative requirements.](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530) (not-terms)
- [Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html) (read)
- [Business Associates Frequently Asked Questions (FAQs) \| HHS.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html) (read)
- [California Code, CIV 56.10](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10) (read)
- [eCFR :: 42 CFR 410.61 -- Plan of treatment requirements for outpatient rehabilitation services.](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-410/subpart-B/section-410.61) (read)
- [Code of Ethics for the Physical Therapist \| APTA](https://www.apta.org/apta-and-you/leadership-and-governance/policies/code-of-ethics-for-the-physical-therapist) (not-terms)

## Cite or embed

- 1 of 9 rules read set out how a record stops being protected health information, each quoted from its own text, read 10 November 2026.
- What it concerns, by rule: what a business associate may do 2 of 9, the patient authorisation a sale needs 1 of 9, how data stops being PHI 1 of 9, who and what HIPAA covers 1 of 9, a limited data set and its agreement 1 of 9, the record Medicare requires 1 of 9, payment for protected health information 1 of 9, a state bar on selling medical information 1 of 9 (9 rules, read 10 November 2026).
- Whose rule, by rule: federal regulation or HHS guidance 8 of 9, California statute 1 of 9 (9 rules, read 10 November 2026).
- In its own text, by rule: stated 9 of 9 (9 rules, read 10 November 2026).

Cite as: "The rules a physical therapy record licence turns on", updated 2026-11-10, https://sellphysicaltherapydatatoai.com/datasets/physical-therapy-data-law/.

CSV: https://sellphysicaltherapydatatoai.com/datasets/physical-therapy-data-law.csv
JSON: https://sellphysicaltherapydatatoai.com/datasets/physical-therapy-data-law.json
Embed (plain HTML, static link back): see https://sellphysicaltherapydatatoai.com/datasets/physical-therapy-data-law/#lead