[dekhn]

They asked for permission because if you want to use data a hospital already has stored for another use, you need to contact the patient to get additional consent (you already gave them consent to collect and keep the sample).

See https://www.hhs.gov/ohrp/regulations-and-policy/guidance/faq... under "Should the initial consent ... be repeated or supplemented?" and I think this is the law: (45 CFR 46.116(b)(5)).