HIPAA Glossary · Privacy Rule concepts
Sale of PHI
Receiving remuneration in exchange for PHI, prohibited without specific authorisation subject to narrow exceptions.
Context
Defined at §164.502(a)(5)(ii). The HITECH Act prohibited the sale of PHI without the individual's authorisation, with narrow exceptions for public health, research, treatment, business associate activities, and legally required disclosures. Secondary-use arrangements with vendors that look like data sales are a frequent compliance trap.
Related terms
- Authorisation — The signed, specific permission required for uses and disclosures beyond what the Privacy Rule permits.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.