# Limited data set

URL: https://sellmydatatoai.net/glossary/limited-data-set

A limited data set is HIPAA health data with 16 direct identifiers removed, shared only for research, public health or operations under a data use agreement.

A limited data set is protected health information from which 16 categories of direct identifiers have been removed, under [45 CFR 164.514(e)](https://www.law.cornell.edu/cfr/text/45/164.514). Names, street addresses, phone numbers, email addresses, account numbers and full-face photos must go, but dates, town or city, state and ZIP code may stay.

## What can a limited data set be used for?

A covered entity may use or disclose a limited data set "only for the purposes of research, public health, or health care operations". The recipient must sign a data use agreement that sets permitted uses, names who may receive the data and commits the recipient to report misuse and "not identify the information or contact the individuals".

## Is a limited data set de-identified?

A limited data set is not de-identified. It is still [protected health information](https://sellmydatatoai.net/glossary/protected-health-information), so HIPAA's limits on sale and use continue to apply. Commercial AI training falls outside the three permitted purposes in most cases, so sellers who want to license health data generally use [HIPAA Safe Harbor](https://sellmydatatoai.net/glossary/hipaa-safe-harbor) or [Expert Determination](https://sellmydatatoai.net/glossary/expert-determination) instead.

Under UK and EU GDPR, data of this kind is pseudonymized personal data, as the [pseudonymization](https://sellmydatatoai.net/glossary/pseudonymization) entry explains.