&gt; I can see your point, but almost all clinical research already involves a consent process where the patient is told the benefits and risks of participating; signing away a license to a subset of their medical data could simply be included in the consent.<p>You don&#x27;t need to get consent if the PHI is de-indentified and the data was obtained through a regular course of treatment (not a study). This is really important because hospitals can publish anonymized case reviews for rare disorders or perform chart reviews on patient outcomes (drug X produced Y outcome in Z patients with [some condition]). I read through a lot of these papers on a daily basis and can&#x27;t imagine the state of medical literature if consent was needed for publishing this clinical data. Retrospective chart reviews are typically exempt from human subject regulations.<p>More info:
<a href="http:&#x2F;&#x2F;wichita.kumc.edu&#x2F;Documents&#x2F;wichita&#x2F;researchcompliance&#x2F;Guidelines%20for%20Retrospective%20Chart%20Reviews.pdf" rel="nofollow">http:&#x2F;&#x2F;wichita.kumc.edu&#x2F;Documents&#x2F;wichita&#x2F;researchcompliance...</a><p>The cases of unauthorized cell lineages predate HIPAA and other health laws that would make such actions illegal today.