Limited Data Set

To qualify as an LDS, the following direct identifiers must be removed from the protected health information:

• Names
• Postal address information (except town/city, state, and zip code)
• Telephone and fax numbers
• Email addresses
• Social Security numbers
• Medical record numbers
• Health plan beneficiary numbers
• Account numbers
• Certificate/license numbers
• Vehicle identifiers and serial numbers (including license plates)
• Device identifiers and serial numbers
• Web URLs
• IP addresses
• Biometric identifiers (including finger and voice prints)
• Full-face photographic images and comparable images
• Any other unique identifying number, characteristic, or code

Unlike the HIPAA Safe Harbor method, an LDS may retain elements critical for longitudinal research:

• Dates: Admission, discharge, service, date of birth, and date of death may all be included
• Geographic subdivisions: Town, city, state, and 5-digit zip code are permitted
• Age: Age expressed in years, months, days, or hours (including ages over 89, which must be aggregated into a single category of "90 or older" under Safe Harbor)

This retention makes LDS uniquely valuable for temporal analysis and epidemiological studies where time-series data is essential.

Disclosure of an LDS requires a legally binding Data Use Agreement (DUA) between the covered entity and recipient. The DUA must:

• Establish the permitted uses and disclosures of the LDS
• Limit who can use or receive the data
• Require the recipient to not re-identify the information or contact the individuals
• Implement appropriate safeguards to prevent unauthorized use
• Report any unauthorized use or disclosure

A DUA is distinct from a Business Associate Agreement (BAA)—the recipient of an LDS is not necessarily a business associate.

Understanding the spectrum of identifiability is critical for compliance:

• Full PHI: Contains all 18 identifiers; unrestricted clinical use but maximum regulatory burden
• Limited Data Set: Strips 16 direct identifiers but retains dates and geography; requires a DUA for disclosure
• De-identified (Safe Harbor): All 18 identifiers removed; no longer considered PHI and exempt from HIPAA
• De-identified (Expert Determination): A statistician certifies re-identification risk is very small; also exempt

An LDS remains protected health information under HIPAA and is subject to the Privacy Rule's administrative requirements.

The LDS framework enables critical secondary uses of clinical data:

• Clinical research: Retrospective cohort studies requiring temporal analysis of outcomes
• Public health surveillance: Disease trend monitoring across geographic regions
• Healthcare operations: Quality improvement initiatives and population health analytics
• Comparative effectiveness research: Evaluating treatment protocols over time
• Health services research: Analyzing utilization patterns and cost-effectiveness

Without the LDS provision, researchers would face the binary choice of using fully identifiable PHI or losing essential temporal and geographic context.

While an LDS is considered a lower-risk form of PHI, it is not immune to linkage attacks:

• The combination of date of birth, zip code, and gender can uniquely identify a significant percentage of the U.S. population (as demonstrated by Latanya Sweeney's foundational work)
• Retained dates create temporal signatures that may correlate with publicly known events
• Geographic subdivisions combined with rare conditions can narrow the population of interest

Organizations should conduct re-identification risk assessments and implement technical safeguards such as date shifting or geographic generalization when the risk profile warrants additional protection.