{"id":855,"date":"2018-05-23T08:00:09","date_gmt":"2018-05-23T08:00:09","guid":{"rendered":"https:\/\/az.research.umich.edu\/medschool\/document\/limited-data-sets\/"},"modified":"2026-03-13T11:05:58","modified_gmt":"2026-03-13T15:05:58","slug":"limited-data-sets","status":"publish","type":"document","link":"https:\/\/az.research.umich.edu\/medschool\/guidance\/limited-data-sets\/","title":{"rendered":"Limited Data Sets"},"template":"","categories":[24],"tags":[],"content-type":[41],"topic":[42,43,45,66],"update-type":[],"class_list":["post-855","document","type-document","status-publish","hentry","category-institutional-review-boards-irbmed","content-type-guidance","topic-application-types","topic-eresearch-regulatory-management-errm","topic-hipaa-protected-health-information","topic-investigator-study-team-responsibilities"],"acf":{"use_legacy_editor":true,"updated_date":"2020-08-10 14:30:00","update_notice":false,"author":"IRBMED","summary":"Research on coded private information<\/a>, or on non-identifiable information, is not regulated under the\u00a0Common Rule<\/a>.\u00a0\u00a0However,\u00a0HIPAA Privacy Rule<\/a>\u00a0protections apply if a coded<\/a> or non-identifiable data set contains\u00a0Protected Health Information (PHI)<\/a>\u00a0in the form of a \u201cLimited Data Set<\/a>.\u201d","button_links":null,"related_content":[745,752,744,725,877],"legacy_path":"limited-data-sets","legacy_node_id":416,"legacy_related_nids":"285, 293, 284, 248, 1026","legacy_content_section":[{"legacy_section_type":"heading","legacy_heading":"Applicability","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"A HIPAA Limited Data Set (LDS)\u00a0excludes<\/strong>\u00a0direct identifiers but\u00a0may include<\/strong>\u00a0geographic information other than street address<\/a>; dates; and other numbers, characteristics, or codes not listed as direct identifiers.","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"media","legacy_heading":"","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"media-half","legacy_media_file":1354,"legacy_media_url":"https:\/\/az.research.umich.edu\/sites\/default\/files\/media\/embedded\/res_irbmed_LDS-policy-Refs-screenshot.png","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"A table showing data elements permitted in\u00a0de-identified<\/a> data and limited data sets\u00a0is available through the References section of the Michigan Medicine Policy 01-04-342<\/a>\u00a0(level-2 login required)<\/em>.\r\n\r\nHIPAA Privacy Rule\u00a0permits access to PHI in the form of a Limited Data Set\u00a0(LDS)\u00a0if<\/strong>\u00a0the\u00a0covered entity<\/a>\u00a0and the limited data set recipient enter into a data use agreement (DUA). Even if the researchers requesting a limited data are members of the covered entity's workforce, a written\u00a0<\/strong>data use agreement meeting the Privacy Rule's requirements\u00a0must be in place between the covered entity and the limited data set recipient.","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"Required Provisions in the DUA","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"In the DUA, the researchers receiving the LDS provide satisfactory assurances that they will use or disclose the PHI<\/a> in the data set only for specified purposes.\r\n
    \r\n \t
  1. Specific permitted uses and disclosures of the limited data set by the recipient consistent with the purpose for which it was disclosed (a data use agreement cannot authorize the recipient to use or further disclose the information in a way that, if done by the covered entity, would violate the Privacy Rule).<\/li>\r\n \t
  2. Identify who is permitted to use or receive the limited data set.<\/li>\r\n \t
  3. Stipulations that the recipient will\r\n
      \r\n \t
    1. \u00a0Not use or disclose the information other than permitted by the agreement or otherwise required by law.<\/li>\r\n \t
    2. Use appropriate safeguards to prevent the use or disclosure of the information, except as provided for in the agreement, and require the recipient to report to the covered entity any uses or disclosures in violation of the agreement of which the recipient becomes aware.<\/li>\r\n \t
    3. Hold any agent of the recipient (including subcontractors) to the standards, restrictions, and conditions stated in the data use agreement with respect to the information.<\/li>\r\n \t
    4. Not identify the information or contact the individuals.<\/li>\r\n<\/ol>\r\n<\/li>\r\n<\/ol>\r\nMichigan Medicine Policy 01-04-342<\/a>\u00a0on Limited Data Sets (level-2 login required)<\/em> describes implementation of these requirements.\r\n