A covered entity or business associate may not directly or indirectly receive remuneration in exchange for protected health information unless the individual has given a valid authorization under 45 CFR 164.508 that specifies whether the information may be further exchanged for remuneration by the recipient. Exceptions: public health activities, research where the price reflects only preparation and transmittal costs, treatment, the sale or merger of a covered entity (the healthcare operation in paragraph 6(iv) of the definition), payments by a covered entity to its business associate for the associate's work, providing the individual a copy of their own information, and other exchanges the Secretary permits by regulation; the rule applied six months after the final regulations (the 2013 Omnibus Rule).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.