HIPAA Privacy Rule: what a data use agreement must say (45 CFR 164.514(e)(4))
The data use agreement limits the recipient's uses, binds its agents and forbids identifying the data or contacting the people in it; it is a condition of a limited data set, not a route out of HIPAA.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“A covered entity may use or disclose a limited data set under paragraph (e)(1) of this section only if the covered entity obtains satisfactory assurance, in the form of a data use agreement that meets the requirements of this section, that the limited data set recipient will only use or disclose the protected health information for limited purposes.”
Where it was read
Also read from the same source
- HIPAA Privacy Rule: the de-identification standard (45 CFR 164.514(a))
- HIPAA Privacy Rule: the Expert Determination method (45 CFR 164.514(b)(1))
- HIPAA Privacy Rule: the Safe Harbor method, whose identifiers must go (45 CFR 164.514(b)(2)(i))
- HIPAA Safe Harbor: geography and the three-digit ZIP rule (45 CFR 164.514(b)(2)(i)(B))
- HIPAA Safe Harbor: dates and ages over 89 (45 CFR 164.514(b)(2)(i)(C))
- HIPAA Safe Harbor: any other unique number, characteristic or code (45 CFR 164.514(b)(2)(i)(R))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide