Creating a Limited Data Set

When it is not feasible to create or use a de-identified data set for research purposes, the Health Information Privacy & Compliance Office and the IRB recommend the use of a Limited Data Set.  A Limited Data Set must be used in connection with a Data Use Agreement.  To create a Limited Data Set in accordance with HIPAA, the following identifiers of the individual and the individual's relatives, employers and household members must be removed:

  • Names;

  • Postal address information, other than town or city, State, and zip code;

  • Telephone numbers;

  • Fax numbers;

  • Electronic mail addresses;

  • Social security numbers;

  • Medical record numbers;

  • Health plan beneficiary numbers;

  • Account numbers;

  • Certificate/license numbers;

  • Vehicle identifiers and serial numbers, including license plate numbers;

  • Device identifiers and serial numbers;

  • Web Universal Resource Locators (URLs);

  • Internet Protocol (IP) address numbers;

  • Biometric identifiers, including finger and voice prints; and

  • Full face photographic images and any comparable images