Written and maintained by CASRAI Editorial Board
Last updated
A HIPAA Limited Data Set (LDS), codified at 45 CFR § 164.514(e), is a legally defined subset of Protected Health Information (PHI) from which 16 specified categories of direct facial, contact, and account identifiers have been removed, but which retains full calendar dates (such as birth, admission, discharge, and service dates) and city, state, and 5-digit ZIP code geography. Designed specifically for research, public health, and healthcare operations, a Limited Data Set allows covered entities and clinical data warehouses to share longitudinal, spatiotemporally rich clinical datasets without obtaining individual HIPAA Authorization (45 CFR § 164.508) or an IRB Waiver of Authorization (45 CFR § 164.512(i)), provided the sender and recipient execute a compliant Data Use Agreement (DUA) under 45 CFR § 164.514(e)(4).
What Is a HIPAA Limited Data Set Under 45 CFR § 164.514(e)?
When the U.S. Department of Health and Human Services (HHS) finalized modifications to the HIPAA Privacy Rule in 2002, epidemiologists, health services researchers, and multi-site clinical registries demonstrated that full Safe Harbor de-identification under 45 CFR § 164.514(b)(2) (the 18 HIPAA identifiers) stripped away the exact date intervals (length of stay, time-to-readmission, seasonal incidence, exact age in neonates and older adults >89) and 5-digit ZIP code geocodes required for valid longitudinal research.
To resolve this barrier, HHS created the Limited Data Set (45 CFR § 164.514(e)) as a middle tier between fully identifiable PHI and Safe Harbor de-identified data (see Limited Data Set vs. De-Identified Data for a side-by-side regulatory comparison):
- Legal Status Remains PHI: Unlike a dataset de-identified via Safe Harbor or Expert Determination under 45 CFR § 164.514(b), a Limited Data Set is still Protected Health Information (PHI) under the HIPAA Privacy and Security Rules.
- Three Permitted Purposes Only (45 CFR § 164.514(e)(3)(i)): A covered entity (or its business associate if authorized by its BAA) may use or disclose a Limited Data Set solely for research, public health, or healthcare operations.
- No Individual Authorization or IRB HIPAA Waiver Required: Because the 16 direct contact and account identifiers are stripped and the recipient signs a legally binding Data Use Agreement, the covered entity does not need signed patient HIPAA Authorizations or an IRB/Privacy Board Waiver of Authorization under 45 CFR § 164.512(i) to release the dataset.
- Exempt From Accounting of Disclosures (45 CFR § 164.528(a)(1)(viii)): Disclosures of a Limited Data Set made pursuant to a valid DUA are explicitly exempt from the 6-year HIPAA Accounting of Disclosures tracking requirement.
- Minimum Necessary Standard Applies: Under 45 CFR § 164.502(b) and § 164.514(d) (HIPAA Minimum Necessary Standard), the covered entity must limit the data elements included in the Limited Data Set to the minimum necessary to accomplish the specified research, public health, or healthcare operations purpose.
The 16 Excluded Direct Identifiers vs. Retained Elements in a Limited Data Set
Under 45 CFR § 164.514(e)(2), a dataset qualifies as a Limited Data Set only after all 16 direct identifiers of the individual—and of the individual’s relatives, employers, or household members—have been stripped. The table below contrasts the 16 direct identifiers excluded from an LDS against the additional geographic and temporal elements permitted in an LDS but prohibited under Safe Harbor de-identification (45 CFR § 164.514(b)(2)):
| # | Identifier Category | HIPAA Limited Data Set Rule (45 CFR § 164.514(e)(2)) | HIPAA Safe Harbor Rule (45 CFR § 164.514(b)(2)) |
|---|---|---|---|
| 1 | Names | MUST REMOVE | MUST REMOVE |
| 2 | Postal Address / Geography | MUST REMOVE street address, PO Box, and apartment number; MAY RETAIN town or city, State, and 5-digit or 9-digit ZIP code | MUST REMOVE all subdivisions smaller than a State (only first 3 digits of ZIP allowed if combined population > 20,000) |
| 3 | Telephone Numbers | MUST REMOVE | MUST REMOVE |
| 4 | Fax Numbers | MUST REMOVE | MUST REMOVE |
| 5 | Electronic Mail (Email) Addresses | MUST REMOVE | MUST REMOVE |
| 6 | Social Security Numbers (SSNs) | MUST REMOVE | MUST REMOVE |
| 7 | Medical Record Numbers (MRNs) | MUST REMOVE | MUST REMOVE |
| 8 | Health Plan Beneficiary Numbers | MUST REMOVE | MUST REMOVE |
| 9 | Account Numbers | MUST REMOVE (including encounter/billing account numbers) | MUST REMOVE |
| 10 | Certificate / License Numbers | MUST REMOVE | MUST REMOVE |
| 11 | Vehicle Identifiers & Serial Numbers | MUST REMOVE (including license plate numbers and VINs) | MUST REMOVE |
| 12 | Device Identifiers & Serial Numbers | MUST REMOVE (including UDI serial/lot numbers) | MUST REMOVE |
| 13 | Web URLs | MUST REMOVE | MUST REMOVE |
| 14 | IP Address Numbers | MUST REMOVE | MUST REMOVE |
| 15 | Biometric Identifiers | MUST REMOVE (including finger, retinal, and voice prints) | MUST REMOVE |
| 16 | Full-Face Photographs & Comparable Images | MUST REMOVE | MUST REMOVE |
| 17 | Dates (Birth, Death, Admission, Discharge, Service) & Ages > 89 | PERMITTED IN LDS: Full calendar dates (MM/DD/YYYY) and exact ages (including ages > 89) may be retained | MUST REMOVE all elements of dates (except year) and aggregate all ages over 89 into a single 90+ category |
| 18 | Any Other Unique Identifying Number, Characteristic, or Code | PERMITTED IN LDS (Other than #1–16): Study-specific pseudonymous linkage codes and indirect clinical traits may be retained | MUST REMOVE (except non-derived re-identification code held solely by covered entity under § 164.514(c)) |
How Study Subject IDs and Honest Brokers Work With an LDS
Because Medical Record Numbers (MRNs) and patient account numbers must be stripped under item #7 and #9 of 45 CFR § 164.514(e)(2), longitudinal clinical research studies rely on an institutional Honest Broker or research data warehouse extract pipeline to replace each patient’s MRN with a random or cryptographically generated study subject ID before delivering the Limited Data Set to investigators. In multi-center research networks—such as the PCORnet Common Data Model, the OMOP Common Data Model (OHDSI), and the NIH N3C (National COVID Cohort Collaborative) Limited Data Set tier—retaining real encounter dates and 5-digit patient ZIP codes within an LDS allows investigators to link social determinants of health (SDOH) census-tract/ZCTA indices and compute exact survival and readmission intervals.
Mandatory Data Use Agreement (DUA) Checklist Under 45 CFR § 164.514(e)(4)
Under 45 CFR § 164.514(e)(4)(i), a covered entity may use or disclose a Limited Data Set only if the covered entity obtains satisfactory assurance, in the form of a written Data Use Agreement (DUA) between the covered entity and the Limited Data Set recipient, that the recipient will use or disclose the PHI only for limited purposes. Even when a covered entity’s own internal workforce creates and analyzes an LDS for internal research without individual authorization, institutional policy or a streamlined internal DUA must enforce the same standards.
Use the verification checklist below to audit a HIPAA Limited Data Set Data Use Agreement against every statutory requirement of 45 CFR § 164.514(e)(4)(ii):
- Permitted Uses and Disclosures Clause (§ 164.514(e)(4)(ii)(A)):
- Does the DUA explicitly state the permitted uses and disclosures of the Limited Data Set by the recipient, consistent with the three permissible purposes (research, public health, or healthcare operations) under § 164.514(e)(3)?
- Does the DUA prohibit the recipient from using or further disclosing the Limited Data Set in any manner that would violate the HIPAA Privacy Rule if done by the covered entity itself?
- Authorized Users and Recipients Clause (§ 164.514(e)(4)(ii)(B)):
- Does the DUA identify who is permitted to use or receive the Limited Data Set (by named Principal Investigator, research team, or institutional class of users)?
- Restriction on Further Use or Disclosure (§ 164.514(e)(4)(ii)(C)(1)):
- Does the recipient covenant not to use or further disclose the information other than as permitted by the Data Use Agreement or as otherwise required by law?
- Administrative, Physical, and Technical Safeguards (§ 164.514(e)(4)(ii)(C)(2)):
- Does the recipient agree to use appropriate safeguards to prevent use or disclosure of the information other than as provided for by the Data Use Agreement?
- Unauthorized Disclosure / Incident Reporting (§ 164.514(e)(4)(ii)(C)(3)):
- Does the DUA require the recipient to report to the covered entity any use or disclosure of the information not provided for by its DUA of which the recipient becomes aware?
- Agent and Subcontractor Flow-Down Obligation (§ 164.514(e)(4)(ii)(C)(4)):
- Does the DUA require the recipient to ensure that any agents, including a subcontractor, to whom it provides the Limited Data Set agree to the exact same restrictions and conditions that apply to the recipient with respect to such information?
- Strict Prohibition on Re-Identification or Contacting Individuals (§ 164.514(e)(4)(ii)(C)(5)):
- Does the DUA contain an explicit covenant that the recipient will not identify the information or contact the individuals?
Compliance Enforcement, Breach Analysis, and Common Rule Interaction
- Covered Entity Duty Upon Discovering a DUA Violation (45 CFR § 164.514(e)(4)(iii)): A covered entity is in non-compliance with the HIPAA Privacy Rule if it knows of a pattern of activity or practice of the Limited Data Set recipient that constitutes a material breach or violation of the DUA, unless the covered entity takes reasonable steps to cure the breach or end the violation, and—if such steps are unsuccessful—discontinues disclosure of PHI to the recipient and reports the problem to the Secretary of HHS (OCR).
- HIPAA Breach Notification Rule Interaction (45 CFR § 164.402): Under the HITECH Breach Notification Rule, an impermissible use or disclosure of PHI is presumed to be a reportable breach unless the covered entity demonstrates a low probability that the PHI has been compromised based on a four-factor risk assessment (nature and extent of PHI involved, unauthorized person who used/received the PHI, whether the PHI was actually acquired/viewed, and mitigation extent). Because an LDS lacks the 16 direct identifiers, security incidents involving an uncompromised LDS require a documented 4-factor risk assessment under 45 CFR § 164.402 rather than an automatic exemption.
- Common Rule IRB Review (45 CFR § 46.102(e) & § 46.104): Satisfying the HIPAA Limited Data Set rule (45 CFR § 164.514(e)) addresses HIPAA Privacy Rule compliance, not Common Rule human-subjects protection. Because an LDS contains full birth/service dates and ZIP codes, an IRB must still determine whether the secondary research qualifies for an exemption under 45 CFR § 46.104(d)(4) (secondary research use of identifiable private information) or expedited IRB review.
Frequently Asked Questions
What is a HIPAA Limited Data Set?
A HIPAA Limited Data Set (45 CFR § 164.514(e)) is Protected Health Information (PHI) that has been stripped of 16 direct facial, contact, and account identifiers (such as names, street addresses, phone numbers, email addresses, SSNs, and medical record numbers) of the patient and their relatives, employers, or household members, while retaining full calendar dates (birth, admission, discharge, service dates) and town/city, State, and 5-digit ZIP code geography. It may be disclosed for research, public health, or healthcare operations under a written Data Use Agreement (DUA) without individual patient HIPAA Authorization.
How does a HIPAA Limited Data Set differ from Safe Harbor de-identified data?
Safe Harbor de-identification (45 CFR § 164.514(b)(2)) requires removing 18 categories of identifiers—including all date elements except the year, ages over 89, and 5-digit ZIP codes—rendering the resulting dataset no longer subject to HIPAA. A Limited Data Set (45 CFR § 164.514(e)) removes 16 direct identifiers but allows full dates (MM/DD/YYYY), exact ages over 89, and city, state, and 5-digit ZIP codes to remain in the dataset; consequently, an LDS remains regulated PHI and requires a signed Data Use Agreement (DUA).
What are the mandatory clauses required in a HIPAA Data Use Agreement (DUA)?
Under 45 CFR § 164.514(e)(4)(ii), a HIPAA Data Use Agreement must specify the permitted uses and disclosures (limited to research, public health, or healthcare operations), identify who is authorized to use or receive the dataset, and bind the recipient to five obligations: (1) not use or disclose the data except as permitted by the DUA or required by law, (2) implement appropriate safeguards, (3) report any unauthorized use or disclosure to the covered entity, (4) flow down the same restrictions to any agents or subcontractors, and (5) never re-identify the data or contact the individuals.
