Direct comparison
Limited Data Set vs. De-Identified Data
How a HIPAA Limited Data Set differs from fully de-identified data: which identifiers each retains, whether a DUA is required, and when to request which.
Side-by-side comparison
| Dimension | Limited Data Set | De-Identified Data |
|---|---|---|
| Governing regulation | 45 CFR 164.514(e) | 45 CFR 164.514(a)-(b) -- Safe Harbor at 164.514(b)(2), or Expert Determination at 164.514(b)(1) |
| Legal status under HIPAA | Still protected health information (PHI) -- a reduced-identifiability subset of PHI, not exempt from the Privacy Rule | No longer PHI -- falls entirely outside the Privacy Rule's scope once properly de-identified |
| Identifiers removed | 16 direct identifiers per 164.514(e)(2): names, postal address other than town/city/state/ZIP, phone, fax, email, SSN, medical record numbers, health plan beneficiary numbers, account numbers, certificate/license numbers, vehicle and device identifiers/serial numbers, URLs, IP addresses, biometric identifiers, full-face photographs | All 18 Safe Harbor categories at 164.514(b)(2) -- the 16 above, plus all elements of dates and any other unique identifying number, characteristic, or code -- or a documented expert determination that re-identification risk is very small |
| Identifiers retained | All elements of dates (birth date, admission, discharge, death, etc.) and geographic subdivisions down to town, city, state, and five-digit ZIP code | Under Safe Harbor: only year (no month or day), and geography no smaller than state, with a narrow three-digit ZIP exception for large population areas. Expert Determination may retain more detail if the expert's documented analysis supports a very low re-identification risk |
| How it's produced | Direct-identifier stripping limited to the (e)(2) list -- a defined, fixed checklist | Either the fixed Safe Harbor checklist (all 18 categories removed, no actual knowledge the remainder could identify someone), or a qualified expert applying generally accepted statistical and scientific methods, with the analysis documented |
| Contract required to share it | Yes -- a Data Use Agreement (DUA) under 164.514(e)(4) must be in place with the recipient before disclosure | No -- because it is no longer PHI, HIPAA does not require authorization, a DUA, or an IRB/Privacy Board waiver to share it |
| Permitted uses under HIPAA | Research, public health, or health care operations only, per 164.514(e)(3) | No HIPAA-specific use restriction -- once de-identified, the data can be used or shared for any purpose as far as the Privacy Rule is concerned |
| Accounting of disclosures | Exempt from the 164.528(a)(1) accounting-of-disclosures requirement, but the DUA remains a required governance record | Not applicable -- accounting of disclosures only governs PHI |
| Relative re-identification risk | Higher than de-identified data -- retained dates and small-area geography make re-identification more feasible, which is why the DUA's access restrictions, safeguards, and no-re-identification clause do the remaining protective work | Designed to be very low, either by the fixed Safe Harbor checklist or a documented statistical determination |
| Typical research use case | Multi-site registries, longitudinal or time-series studies that need exact dates or fine-grained geography, shared with a known, accountable recipient under a controlled DUA | Public or broadly shared secondary-analysis datasets where the recipient and downstream use can't be tracked or restricted |
Common questions
FAQ
Is a Limited Data Set the same as de-identified data?+
No. A Limited Data Set is still PHI under HIPAA -- it retains dates and detailed geographic information that Safe Harbor de-identification (45 CFR 164.514(b)(2)) requires removing. It carries a narrower set of protections instead: a signed Data Use Agreement and restricted permitted purposes, rather than falling outside the Privacy Rule entirely.
Do I need a Data Use Agreement for de-identified data?+
No. A DUA is a 164.514(e)(4) requirement specific to Limited Data Sets. Data that has been properly de-identified under Safe Harbor or Expert Determination is no longer PHI, so HIPAA does not require a DUA, authorization, or an IRB/Privacy Board waiver to disclose it.
Which one should I request for my study?+
It depends on what your analysis needs. If you need exact dates or fine geographic detail -- common in longitudinal or geospatial research -- you will likely need a Limited Data Set under a DUA. If your analysis doesn't depend on those fields, request de-identified data instead, since it comes without a DUA, authorization, or HIPAA use restriction.
Can de-identified data be re-identified later?+
Attempting to re-identify data de-identified under Safe Harbor or Expert Determination, or using a code or key that could link it back to identifiers, takes it back into PHI status under HIPAA. A Limited Data Set is a different concept -- it is deliberately never fully de-identified in the first place, which is exactly why it still requires a DUA.
Going deeper
