HIPAA Limited Data Set

INSTITUTIONAL REVIEW BOARD HIPAA Limited Data Set OFFICE OF SPONSORED RESEARCH Loma Linda University  11188 Anderson Street  Loma Linda, CA 92350 (909) 558-4531 (voice) / (909) 558-0131 (fax)

A CE may use/disclose a limited data set that meets certain requirements if the CE enters into a data use agreement with the limited data set recipient. A limited data set may be used for the purpose of research, public health, or health care operations. A limited data set is PHI that excludes direct identifiers of the individual or of relatives, employers, or household members of the individual. Limited Data Set Elements Data Use Agreement Elements Excluded Included Purpose Requirements 1. Names 1.ZIP codes 1.Establishes the (a) use the PHI 2. Postal Address info other than 2.Geocodes permitted uses and contained in the set town, city, state and Zip code 3.Dates of birth disclosures of the only as permitted 3. Telephone number 4.Other date data set consistent under the Privacy 4. Fax number info with the purpose of Rule, 5. E-mail address 5.Any other the disclosure (b) limit who can use 6. Social Security Number code not 2.Defines who is or receive the data, 7. Medical Record Number specified at permitted to use or (c) agree not to re- 8. Health Plan Beneficiary Number left receive the data identify the data or 9. Account Number 3.Defines what contact the individual 10. Certificate/License number purpose the data subjects of such data; 11. Vehicle identifiers and serial may be used and numbers including license plate 4.Prohibits the (d) use appropriate numbers recipient from safeguards to prevent 12. Device identifiers and serial identifying or use or disclosure of numbers contacting the data the limited data set 13. Web Universal Resource subject other than as Locaters 5.Data use permitted by the data 14. Internet Protocol address agreements, like use agreement and numbers confidentiality the Privacy Rule, or 15. Biometric identifiers, including agreements, can as required by law. finger and voice prints be used between a 16. Full face photographs and any covered entity and comparable images its workforce for its own research or health care operations purposes 6.Limited data set disclosures are not subject to the data subject’s accounting right, but they are subject to the minimum necessary standard

OSR 4/27/2018