HIPAA Privacy Rule: the limited data set (45 CFR 164.514(e)(1)-(3))
A limited data set is still protected health information. It keeps dates, town, state and ZIP code, and may be shared only for research, public health or health care operations under a data use agreement.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“A limited data set is protected health information that excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual: ... A covered entity may use or disclose a limited data set under paragraph (e)(1) of this section only for the purposes of research, public health, or health care operations.”
Where it was read
Also read from the same source
- HIPAA Privacy Rule: the de-identification standard (45 CFR 164.514(a))
- HIPAA Privacy Rule: the Expert Determination method (45 CFR 164.514(b)(1))
- HIPAA Privacy Rule: the Safe Harbor method, whose identifiers must go (45 CFR 164.514(b)(2)(i))
- HIPAA Safe Harbor: geography and the three-digit ZIP rule (45 CFR 164.514(b)(2)(i)(B))
- HIPAA Safe Harbor: dates and ages over 89 (45 CFR 164.514(b)(2)(i)(C))
- HIPAA Safe Harbor: any other unique number, characteristic or code (45 CFR 164.514(b)(2)(i)(R))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide