What is a Limited Data Set Under HIPAA?

A limited data set under HIPAA is a set of identifiable healthcare information that the HIPAA Privacy Rule permits covered entities to share with certain entities for research purposes, public health activities, and healthcare operations without obtaining prior authorization from patients, if certain conditions are met.

In contrast to de-identified protected health information, which is no longer classed as PHI under HIPAA Rules, a limited data set under HIPAA is still identifiable protected information. Therefore it is still subject to HIPAA Privacy Rule regulations.

A HIPAA limited data set can only be shared with entities that have signed a data use agreement with the covered entity. The data use agreement allows the covered entity to obtain satisfactory assurances that the PHI will only be used for specific purposes, that the PHI will not be disclosed by the entity with which it is shared, and that the requirements of the HIPAA Privacy Rule will be followed.

The data use agreement, which must be accepted prior to the limited data set being shared, should outline the following:

  • Allowable uses and disclosures
  • Approved recipients and users of the data
  • An agreement that the data will not be used to contact individuals or re-identify them
  • Require safeguards to be implemented to ensure the confidentiality of data and prevent prohibited uses and disclosures
  • State the discovery of improper uses and disclosures must be reported back to the covered entity
  • State that any subcontractors who are required to access or use the data also enter into a data use agreement and agree to comply with its requirements.

In all cases, the HIPAA minimum necessary standard applies, and information in the data set must be limited to only the information necessary to perform the purpose for which it is disclosed.

What Information Must be Removed From a Limited Data Set Under HIPAA?

Under HIPAA Rules, a limited data set cannot contain any of the following HIPAA identifiers:

  • Names
  • Street addresses or postal address information with the exception of town/city, state and zip code
  • Phone/Fax numbers
  • E-mail addresses
  • Social Security numbers
  • Medical records numbers
  • Health plan beneficiary numbers
  • Other account numbers
  • Certificate and license numbers
  • Vehicle identifiers and serial numbers, including license plates
  • Device identifiers and serial numbers
  • URLs and IP addresses
  • Biometric identifiers such as fingerprints, retinal scans and voice prints
  • Full face photos and comparable images

Author: Steve Alder has many years of experience as a journalist, and comes from a background in market research. He is a specialist on legal and regulatory affairs, and has several years of experience writing about HIPAA. Steve holds a B.Sc. from the University of Liverpool.