Send Feedback
 
ORA FAQs
Show 
			email this page Print this record feedback
What is a Limited-Data Set?

Some studies may need to retain a limited number of identifiers and, thus, not meet the strict HIPAA definition of "de-identified data." However, these studies may present only minimal potential for identifying participants based on the data set. In such circumstances, HIPAA permits use of a "Limited Data Set" for research purposes. A Limited Data Set is PHI that excludes "direct identifiers" of the individual, relatives of the individual, employers, or household members.
A limited data set must exclude all direct identifiers such as:
         1. Names
         2. Street Addresses or P.O. Box Numbers
         3. Phone and Fax Numbers
         4. Email Addresses
         5. Social Security Numbers
         6. Medical Record Numbers
         7. Health Plan Numbers
         8. Account Numbers
         9. Certificate/Licenses Numbers 
        10. Vehicle Identifiers/License Plates
        11. Device Identifiers
        12. Web URLS
        13. Internet Protocols (IP)
        14. Full Face Photos

A limited data set may include one or more of the following:
        1. Towns
        2. Cities
        3. States
        4. Zip Code and their equivalent geocodes. (Note that a zip code cannot be used if the area composing the zip code has less than 20,000 citizens.)
        5. Dates including birth and death
        6. Other unique identifying numbers, characteristics, or codes that are not expressly excluded. (Medical record numbers and pathology numbers are excluded.)
        7. Relevant medical information
A Limited Data Set may be used only for purposes of research, public health, or health care operations. Under the Privacy Rule, use or disclosure of limited data sets for research purposes requires a “Data Use Agreement.”


« Return to previous FAQs page