HHS OCR guidance on de-identification (2012): data use agreements for de-identified data (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.9)
HIPAA does not require a contract for de-identified data, but a holder may and usually should ask the buyer to sign one banning re-identification.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“The Privacy Rule does not limit how a covered entity may disclose information that has been de-identified. However, nothing prevents a covered entity from asking a recipient of de-identified information to enter into a data use agreement, such as is required for release of a limited data set under the Privacy Rule. This agreement may prohibit re-identification.”
Where it was read
Also read from the same source
- HHS OCR guidance on de-identification (2012): who is an expert (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.2)
- HHS OCR guidance on de-identification (2012): how an expert works (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.6)
- HHS OCR guidance on de-identification (2012): no fixed numerical risk level (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.3)
- HHS OCR guidance on de-identification (2012): methods and results documented (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.6)
- HHS OCR guidance on de-identification (2012): time-limited determinations (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.4)
- HHS OCR guidance on de-identification (2012): what actual knowledge means (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.6)
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide