The regulatory framework establishes the duty to inform patients of the ways in which their data will be used