The literal question, answered from the rule
Can you sell medical records? HIPAA's sale rule and de-identification
A covered practice cannot sell identifiable medical records without each patient's authorisation, but records de-identified to HIPAA's standard are no longer protected health information.
Ask about our old records Tell us who holds the charts and the years they cover, and we will answer against the 14 documents on this board.
What HIPAA treats as a sale
Under 45 CFR 164.502(a)(5)(ii)(B), a sale of protected health information is a disclosure where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient in exchange for the information. A sale needs an authorisation that states the disclosure will result in remuneration.
De-identified records are different
164.514 sets the standard: health information that does not identify an individual, and with respect to which there is no reasonable basis to believe it can be used to identify one, is not individually identifiable health information. Old charts carry names, dates and free-text notes, so de-identifying them is real work rather than a deletion of a few columns.
What a limited data set may be used for
164.514(e) allows a limited data set only for the purposes of research, public health or health care operations, under a data use agreement with the recipient.
Who says it takes records
The board of organisations taking record-level data quotes each one's own page on whose records it takes, the patient's own or a provider's, and what it does with them.