Per Section 164.508(a) of Title 45 of the Code of Federal Regulations, the Oklahoma Department of Human Services must obtain a valid authorization for any use or disclosure of protected health information (PHI) to outside entities for: research or marketing purposes.
Okla. Admin. Code § 340:2-8-13