Laws in the US require that you have a Business Associate Agreement - a BAA. This needs to clearly outline what data you need access to and the valid reasons for doing so.
This is an agreement you need so that the hospital can share data with you.
Roles: Legal