User login


Sale of Protected Health Information (PHI)

Effective Date:    November 2018


Policy Statement

The Columbia University Healthcare Component (CUHC) shall
not directly or indirectly receive remuneration, including non-financial benefits such as in-kind benefits, in exchange for any Protected Health Information (PHI), unless patient authorization is obtained or an applicable exception applies.


Reason(s) for the Policy

Subject to certain exceptions, the Health Insurance
Portability and Accountability Act of 1996 (“HIPAA”) prohibits the Sale of PHI.  This Policy describes the procedures the CUHC shall follow in order to ensure that any remuneration in exchange for PHI is conducted in compliance with applicable law, including HIPAA.


Primary Guidance to Which This Policy Responds

HIPAA Rules 45 CFR 164.502(a)(5)(ii), 164.508(a)(4)


Responsible University Office & Officer

Office of HIPAA Compliance, Privacy Officer



To see the full text of this policy, please use the link on the right.