Creating a Limited Data Set

When it is not feasible to create or use a de-identified data set for research purposes, the Health Information Privacy & Compliance Office and the IRB recommend the use of a Limited Data Set.  A Limited Data Set must be used in connection with a Data Use Agreement, which is available on the IRB's website.  To create a Limited Data Set in accordance with HIPAA, the following identifiers of the individual and the individual's relatives, employers and household members must be removed:

  • Names;
  • Postal address information, other than town or city, State, and zip code;
  • Telephone numbers;
  • Fax numbers;
  • Electronic mail addresses;
  • Social security numbers;
  • Medical record numbers;
  • Health plan beneficiary numbers;
  • Account numbers;
  • Certificate/license numbers;
  • Vehicle identifiers and serial numbers, including license plate numbers;
  • Device identifiers and serial numbers;
  • Web Universal Resource Locators (URLs);
  • Internet Protocol (IP) address numbers;
  • Biometric identifiers, including finger and voice prints; and
  • Full face photographic images and any comparable images