Limited Data Set

Definition:  A limited data set is information disclosed by a covered entity to a researcher who has no relationship with the individual whose information is being disclosed. The covered entity is permitted to disclose PHI, with direct identifiers removed, subject to obtaining a data use agreement from the researcher receiving the limited data set. A data use agreement specifies permitted uses and disclosures, specifies who may use or receive the data set, restricts further use and disclosure, and restricts re-identification of the data or contact with the individuals.

Direct identifiers that must be removed from the information for a limited data set are:

  1. Name
  2. Address information (other than city, State, and zip code)
  3. Telephone and fax numbers
  4. E-mail address
  5. Social Security number
  6. Certificate/license number
  7. Vehicle identifiers and serial numbers
  8. URLs and IP addresses
  9. Full face photos and other comparable images
  10. Medical record numbers, health plan beneficiary numbers, and other account numbers
  11. Device identifiers and serial numbers
  12. Biometric identifiers including finger and voice prints

Identifiers that are allowed in the limited data set are:

  1. Admission, discharge and service dates
  2. Birth date
  3. Date of death
  4. Age (including age 90 or over)
  5. Geographical subdivisions such as state, county, city, precinct, and five-digit zip code.

How might this type of information be useful?  Limited Data Sets might be useful if you wish to plan a clinical trial and need only to know whether patients meeting specific inclusion/exclusion criteria were seen over a specified period of time, e.g., within the last year. Limited data sets may not be used to contact subjects (telephone numbers, internet provider addresses, and email addresses are not part of a limited data set).

Access requirements:  In addition to obtaining a waiver of authorization, you will need to complete a Data Use Agreement for a Limited Data Set. (Under the “Research” tab at this link, choose “Data Use Agreement with UW Medicine Workforce.”) Do not change the Data Use Agreement in any way. If you do, your changes will trigger a review by the HIPAA Program Office.