HIPAA limited data sets: what they include and when you can use them

What a limited data set is

45 CFR 164.514(e)(2) (opens in a new tab) defines it: "A limited data set is protected health information that excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual." The key words are "is protected health information." Everything you know from what is PHI still applies, including safeguards and breach rules.

What makes it different is the permission. Normally, sharing PHI for research needs each patient's authorization or a waiver approved by an IRB or privacy board (opens in a new tab). A limited data set can go out under a data use agreement instead, because the most obvious identifiers are gone. That is why research offices use it heavily and why most small practices rarely need it.

What must be removed and what may stay

The 16 direct identifiers that must come out, as listed in 164.514(e)(2):

1. Names
2. Postal address information, other than town or city, State, and zip code
3. Telephone numbers
4. Fax numbers
5. Electronic mail addresses
6. Social security numbers
7. Medical record numbers
8. Health plan beneficiary numbers
9. Account numbers
10. Certificate/license numbers
11. Vehicle identifiers and serial numbers, including license plate numbers
12. Device identifiers and serial numbers
13. Web Universal Resource Locators (URLs)
14. Internet Protocol (IP) address numbers
15. Biometric identifiers, including finger and voice prints
16. Full face photographic images and any comparable images

Compare that list with the HIPAA identifiers used for de-identification. Two categories are absent here: geography above street level and dates. A limited data set may therefore keep town or city, state, the full five-digit ZIP code, birth dates, admission and discharge dates, dates of service and ages. The catch-all for "any other unique identifying number, characteristic, or code" is also absent, but the recipient still promises not to identify anyone.

Permitted purposes: research, public health, health care operations

Section 164.514(e)(3)(i) (opens in a new tab) is short: a covered entity "may use or disclose a limited data set under paragraph (e)(1) of this section only for the purposes of research, public health, or health care operations."

For a small practice, realistic examples are:

• Research: a university study of outcomes for a procedure your practice performs.
• Public health: a registry or public health project that needs visit dates and ZIP codes but not names.
• Health care operations: quality improvement or business-planning analysis, as defined in 164.501 (opens in a new tab), for example a consultant benchmarking your no-show rate by ZIP code.

You may create the data set yourself or have a business associate build it for you. Within a permitted purpose, still share only the fields the project needs; the minimum necessary standard explains how to scope requests. One administrative bonus: disclosures of a limited data set are excluded from the accounting of disclosures patients can request under 164.528 (opens in a new tab).

The data use agreement and what it must say

Under 164.514(e)(4), you may use or disclose a limited data set only if you obtain "satisfactory assurance, in the form of a data use agreement," from the recipient. The agreement must:

• Establish the permitted uses and disclosures, within the three purposes, and not authorize anything that would violate the Privacy Rule if your practice did it.
• Establish who may use or receive the data.
• Bind the recipient to:
  1. not use or disclose the data beyond the agreement or as required by law;
  2. use appropriate safeguards;
  3. report any use or disclosure the agreement doesn't allow;
  4. make its agents agree to the same restrictions; and
  5. "Not identify the information or contact the individuals."

The duties continue after signing. If you learn of a pattern of activity that materially breaches the agreement, you must take reasonable steps to cure it. If that fails, you must stop disclosing to the recipient and report the problem to HHS. Have counsel draft or review any data use agreement, and involve them in any research or data-sharing arrangement.

Why limited data sets aren't a marketing workaround

The question comes up because a limited data set keeps ZIP codes, ages and visit dates: exactly what an ad audience or a mailing campaign would want. The rule closes the door three ways.

1. Marketing isn't a listed purpose. Only research, public health and health care operations qualify.
2. The recipient can't contact anyone. The mandatory "not identify ... or contact the individuals" clause rules out outreach.
3. Marketing has its own rule. 45 CFR 164.508(a)(3) (opens in a new tab) requires authorization "for any use or disclosure of protected health information for marketing," apart from face-to-face communications and promotional gifts of nominal value. It applies "notwithstanding any provision of this subpart," the limited data set rule included.

If a campaign genuinely needs patient data, the route is a signed marketing authorization. If it only needs performance numbers, use aggregates. Medfy follows the second route: patient data stays in separate, encrypted HIPAA databases in the US or Canada, marketing uses aggregate numbers only, and ad platforms never receive patient data. More in Medfy's HIPAA safeguards. For a read on what your current site and ads expose, try the free marketing audit.

Limited data set vs de-identified data

If you need data you can use freely, aim for de-identified data. If you need dates or ZIP codes for a study, a limited data set with a data use agreement is the right tool.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

What identifiers can a limited data set include?

Fewer than full PHI, more than de-identified data. A limited data set must drop 16 direct identifiers, including names, street addresses, phone numbers, emails, record and account numbers, URLs, IP addresses and full-face photos. It may keep town or city, state, five-digit ZIP code, dates such as birth and service dates, and ages. Everything else that remains is still protected health information. Confirm your data set with your compliance officer or attorney.

Do you need a data use agreement for a limited data set?

Yes. Under 45 CFR 164.514(e)(4), a covered entity may use or disclose a limited data set only after the recipient signs a data use agreement. It must set the permitted uses, name who may use or receive the data, and bind the recipient to safeguards, breach reporting, the same terms for its agents, and a promise not to identify or contact individuals. Have counsel draft or review it.

Can a limited data set be used for marketing?

No. The regulation allows limited data sets only for research, public health and health care operations, and every data use agreement must forbid the recipient from identifying or contacting the individuals. Marketing that uses PHI generally needs each patient's written authorization instead. For campaign reporting, use aggregate or properly de-identified numbers. Confirm any data-sharing arrangement with your compliance officer or attorney.

Is a limited data set still PHI?

Yes. The regulation defines a limited data set as protected health information that excludes certain direct identifiers, so HIPAA still applies to it. The difference is that you may share it for the three permitted purposes under a data use agreement instead of an authorization. Data that has been fully de-identified under Safe Harbor or an Expert Determination is the version that leaves HIPAA's scope.