Written and maintained by CASRAI Editorial Board
Last updated
A HIPAA Data Use Agreement (DUA) is a mandatory statutory contract governed by the HIPAA Privacy Rule at 45 CFR § 164.514(e)(4) that enables a HIPAA Covered Entity (or its Business Associate, when authorized) to disclose a Limited Data Set (LDS) for research, public health, or health care operations without obtaining individual patient HIPAA Authorizations (45 CFR § 164.508) or an Institutional Review Board (IRB) / Privacy Board Waiver of Authorization (45 CFR § 164.512(i)).
In clinical epidemiology, health services research, and multi-center registry studies, fully de-identified Safe Harbor datasets (45 CFR § 164.514(b)(2)) are often scientifically unusable because Safe Harbor strips all dates (except year) and 5-digit ZIP codes—making it impossible to calculate exact hospital length of stay, 30-day readmission intervals, seasonal viral exposure windows, or neighborhood-level social determinants of health. A Limited Data Set governed by a HIPAA DUA solves this research bottleneck by stripping 16 direct facial identifiers while preserving exact clinical dates and city/state/ZIP-code geography.
What Is a Limited Data Set (LDS) Under 45 CFR § 164.514(e)(2)?
Crucially, a Limited Data Set is still Protected Health Information (PHI) under HIPAA; it is not de-identified data. Under 45 CFR § 164.514(e)(2), an LDS is PHI that excludes the following 16 direct identifiers of the individual or of relatives, employers, or household members of the individual, while retaining specific indirect temporal and geographic elements:
| Data Category | Must Be Stripped from a Limited Data Set (16 Excluded Direct Identifiers) | Permitted to Remain in a Limited Data Set Under a DUA |
|---|---|---|
| Names & Direct Contact | (1) Names; (2) Postal address information (street address, PO Box); (3) Telephone numbers; (4) Fax numbers; (5) Electronic mail addresses | Encrypted, non-derivative study subject pseudonyms assigned by an honest broker (provided they are not derived from SSN/MRN and the key is not shared) |
| Geographic Subdivisions | Street name, house/apartment number, and geocodes (latitude/longitude) corresponding to a street address | Town, city, state, and full 5-digit (or 9-digit) ZIP code |
| Dates & Age Elements | None excluded under LDS rules (unlike Safe Harbor, which strips month/day and caps ages >89) | All elements of dates directly related to an individual: birth date, admission date, discharge date, service dates, and date of death, plus exact age in years, months, days, or hours |
| Government & Clinical IDs | (6) Social Security numbers; (7) Medical record numbers (MRNs); (8) Health plan beneficiary numbers; (9) Account numbers; (10) Certificate/license numbers | Encounter-level or patient-level random research sequence numbers generated specifically for the research extract |
| Device, Vehicle & Digital IDs | (11) Vehicle identifiers/serial numbers/license plates; (12) Device identifiers and serial numbers; (13) Web URLs; (14) IP addresses | Device model/class, UDI Device Identifier (DI) portion (excluding Production Identifier serial/lot numbers), and structured clinical observations |
| Biometrics & Images | (15) Biometric identifiers (finger and voice prints); (16) Full-face photographic images and any comparable images | De-identified medical imaging pixel arrays (DICOM headers scrubbed of the 16 direct identifiers and burned-in text) |
Mandatory Statutory Checklist: Required Provisions of a HIPAA DUA (45 CFR § 164.514(e)(4)(ii))
Under 45 CFR § 164.514(e)(4)(i), a covered entity may use or disclose a Limited Data Set only if the covered entity obtains satisfactory assurance, in the form of a written Data Use Agreement, that the Limited Data Set recipient will only use or disclose the PHI for limited purposes. Every compliant HIPAA DUA must satisfy all items in the following regulatory checklist:
- [ ] 1. Permitted Uses and Disclosures (§ 164.514(e)(4)(ii)(A)): Explicitly state the specific purposes for which the Limited Data Set recipient is permitted to use or disclose the data. By statute, these purposes must be limited to research, public health, or health care operations. The DUA may not authorize any use or disclosure that would violate the HIPAA Privacy Rule if performed directly by the covered entity.
- [ ] 2. Authorized Recipients and Users (§ 164.514(e)(4)(ii)(B)): Identify by name, role, principal investigator (PI), or specific institutional research group who is permitted to use or receive the Limited Data Set.
- [ ] 3. Prohibition on Unauthorized Use or Further Disclosure (§ 164.514(e)(4)(ii)(C)(1)): Require the recipient to agree not to use or further disclose the Limited Data Set other than as permitted by the Data Use Agreement or as otherwise required by law.
- [ ] 4. Administrative, Physical, and Technical Safeguards (§ 164.514(e)(4)(ii)(C)(2)): Require the recipient to use appropriate safeguards (such as encryption at rest and in transit, role-based access controls, and secure research enclaves) to prevent use or disclosure of the information other than as provided for by the DUA.
- [ ] 5. Breach and Unauthorized Disclosure Reporting (§ 164.514(e)(4)(ii)(C)(3)): Require the recipient to report to the covered entity any use or disclosure of the Limited Data Set not provided for by its DUA of which the recipient becomes aware.
- [ ] 6. Subcontractor and Agent Flow-Down (§ 164.514(e)(4)(ii)(C)(4)): Require the recipient to ensure that any agents (including subcontractors or collaborating sub-site statisticians) to whom it provides the Limited Data Set agree to the same restrictions and conditions that apply to the primary recipient.
- [ ] 7. Strict Prohibition on Re-Identification or Contacting Individuals (§ 164.514(e)(4)(ii)(C)(5)): Explicitly require that the recipient will not identify the information or contact the individuals (neither linking the LDS with external voter/commercial databases to re-identify patients nor contacting patients or their families for follow-up recruitment).
HIPAA Data Use Agreement (DUA) vs. Business Associate Agreement (BAA)
Research administrators and privacy officers frequently must determine whether a data transfer requires a Data Use Agreement (45 CFR § 164.514(e)), a Business Associate Agreement (45 CFR § 164.504(e)), or both:
| Comparison Dimension | HIPAA Data Use Agreement (DUA) | HIPAA Business Associate Agreement (BAA) |
|---|---|---|
| CFR Citation | 45 CFR § 164.514(e)(4) | 45 CFR § 164.504(e) |
| Core Relationship | Covered entity shares an LDS with a recipient (e.g., an external academic university, research registry, or public health agency) for the recipient’s research, public health, or health care operations | A third-party vendor or service provider creates, receives, maintains, or transmits PHI on behalf of the covered entity to perform a covered function or service (45 CFR § 160.103) |
| Permissible PHI Scope | Strictly restricted to a Limited Data Set (16 direct identifiers stripped) | Covers fully identifiable PHI (including names, MRNs, SSNs, street addresses) as well as Limited Data Sets |
| Research Use Allowed? | Yes (Research is one of the three primary statutory purposes of a DUA) | No (Creating or analyzing data for an independent external research study is not a Business Associate function, though a BA may strip identifiers to create an LDS on behalf of a covered entity) |
| Re-Identification & Patient Contact | Strictly prohibited by statute (§ 164.514(e)(4)(ii)(C)(5)) | Permitted when patient contact is part of the contracted service performed on behalf of the covered entity (e.g., care management or billing) |
| Accounting of Disclosures (45 CFR § 164.528) | Exempt: Disclosures of a Limited Data Set under a DUA are explicitly exempt from the 6-year HIPAA Accounting of Disclosures requirement (§ 164.528(a)(1)(viii)) | Subject to Accounting of Disclosures if disclosed outside treatment, payment, health care operations, or other statutory exemptions |
EHR Research Data Warehouse Workflows and Multi-Center Templates (FDP DTUA)
In academic health centers and multi-institutional networks—such as PCORnet, the Observational Health Data Sciences and Informatics (OHDSI / OMOP) network, and NIH clinical data coordinating centers—executing bespoke bilateral DUAs historically delayed multi-site studies by months. Two standardized frameworks streamline DUA execution and informatics extraction:
- Federal Demonstration Partnership (FDP) Data Transfer and Use Agreement (DTUA): Developed by the Federal Demonstration Partnership in collaboration with more than 200 U.S. research universities and academic medical centers, the FDP DTUA provides a standardized, pre-negotiated base agreement with modular attachments for (1) De-identified Data, (2) Limited Data Sets under HIPAA 45 CFR § 164.514(e), and (3) Personally Identifiable Information, preventing line-by-line legal renegotiation of statutory HIPAA clauses.
- Automated EHR Cohort Extraction and Honest Broker Gatekeeping: Within clinical data warehouses and cloud FHIR R4 stores, research informatics pipelines enforce DUA compliance programmatically. When an investigator requests an LDS cohort, an institutional Honest Broker system verifies the executed DUA and IRB determination number, executes SQL/FHIR de-identification views that drop the 16 direct identifiers while retaining admission/discharge timestamps and 5-digit ZIP codes, and provisions the dataset inside an audited, non-exportable Virtual Research Desktop Environment (VRDE). Contrast this research-specific bilateral/consortium contract with nationwide treatment networks governed by the eHealth Exchange DURSA.
Frequently Asked Questions
What is a HIPAA Data Use Agreement and how is it used in clinical research and healthcare?
A HIPAA Data Use Agreement (DUA) is a legally binding contract required under 45 CFR § 164.514(e)(4) before a HIPAA Covered Entity may disclose a Limited Data Set (LDS) to an internal or external recipient for research, public health, or health care operations without obtaining individual patient HIPAA Authorizations or an IRB Waiver of Authorization.
What standards or regulatory requirements govern a HIPAA Data Use Agreement?
Under 45 CFR § 164.514(e)(4)(ii), a HIPAA DUA must establish the permitted uses and disclosures of the Limited Data Set (restricted strictly to research, public health, or health care operations), designate who may receive or use the data, require appropriate safeguards, mandate reporting of unauthorized disclosures, flow down identical restrictions to subcontractors/agents, and explicitly prohibit the recipient from re-identifying the data or contacting the individuals.
How does a HIPAA Data Use Agreement integrate with EHR and health informatics workflows?
In academic medical center informatics workflows, an honest broker or research data warehouse extracts EHR cohorts into an OMOP CDM, PCORnet, or HL7 FHIR Bulk Data ($export) Limited Data Set by stripping the 16 direct facial identifiers specified in 45 CFR § 164.514(e)(2) while preserving exact clinical dates (birth, admission, discharge, service, death) and geographic granularity (city, state, 5-digit ZIP code), releasing the extract only after verifying an executed DUA and IRB determination in the institutional compliance tracking system.
