SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-auth-sale-of-phi

Can a covered entity sell patients' PHI to a data company without the patients' authorization?

No, a sale of PHI needs authorization.

Start playing free

  1. Yes, if names are kept private
  2. Yes, once the records are six years old
  3. No, any sale of PHI needs authorization ✔

Why: Disclosing PHI in exchange for payment is a sale of PHI, which needs the patient's authorization. The authorization must say the covered entity will be paid.

Huh, didn't know that: A covered entity can't combine an authorization with other documents into a compound form, except in limited cases like research.

The dad joke
I don't trust stairs. They're always up to something.
Like this card?
Play the game

References

Answer: No, any sale of PHI needs authorization. Disclosing PHI in exchange for payment is a sale of PHI, which needs the patient's authorization. The authorization must say the covered entity will be paid.

  1. 45 CFR 164.508 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
    a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information
    Checked 2026-10-10.
  2. 45 CFR 164.508 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
    Such authorization must state that the disclosure will result in remuneration to the covered entity.
    Checked 2026-10-10.
  3. 45 CFR 164.508 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
    may not be combined with any other document to create a compound authorization
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat does a covered entity generally need before disclosing a patient's psychotherapy notes?Work SkillsWhich of these is NOT part of a patient's psychotherapy notes under HIPAA?Work SkillsA drug company pays a clinic to mail its patients ads for a new product. What does the clinic need?

That's stuff everyone should know.