Limited data set
By Gareth HoyleLast updated How we research
A limited data set is HIPAA health data with 16 direct identifiers removed, shared only for research, public health or operations under a data use agreement.
A limited data set is protected health information from which 16 categories of direct identifiers have been removed, under 45 CFR 164.514(e). Names, street addresses, phone numbers, email addresses, account numbers and full-face photos must go, but dates, town or city, state and ZIP code may stay.
What can a limited data set be used for?
A covered entity may use or disclose a limited data set "only for the purposes of research, public health, or health care operations". The recipient must sign a data use agreement that sets permitted uses, names who may receive the data and commits the recipient to report misuse and "not identify the information or contact the individuals".
Is a limited data set de-identified?
A limited data set is not de-identified. It is still protected health information, so HIPAA's limits on sale and use continue to apply. Commercial AI training falls outside the three permitted purposes in most cases, so sellers who want to license health data generally use HIPAA Safe Harbor or Expert Determination instead.
Under UK and EU GDPR, data of this kind is pseudonymized personal data, as the pseudonymization entry explains.