By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Limited Data Set
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
A limited data set is a specific category of protected health information under the HIPAA Privacy Rule. It has the direct identifiers removed, such as names, street addresses, and record numbers, but it may keep certain details, such as dates and some geographic information, that are often essential for research and analysis.
The HIMSS Dictionary describes a limited data set as health information with identifiers stripped out. It notes that the information remains protected but may be used without the person’s authorization for research, public health, and health care operations.
The key condition is a data use agreement (DUA) between the covered entity and the recipient.
| Feature | Limited Data Set | De-Identified Data |
|---|---|---|
| Still PHI under HIPAA? | Yes | No |
| Direct identifiers | Removed | Removed, along with other identifiers |
| Dates | May include dates such as admission, discharge, service, birth, and death | Only year for dates related to the individual (under Safe Harbor) |
| Geography | May include city, state, and ZIP code | Generally limited to state, with narrow ZIP exceptions |
| Permitted purposes | Research, public health, health care operations | Any purpose |
| Agreement required | Data use agreement | None under HIPAA |
Direct identifiers that must be removed include names; postal address information other than town or city, state, and ZIP code; telephone and fax numbers; email addresses; Social Security, medical record, health plan, and account numbers; certificate and license numbers; vehicle and device identifiers; web addresses and IP addresses; biometric identifiers; and full-face photographs and comparable images.
⚠️ Exam Alert: A limited data set is still PHI and requires a data use agreement. De-identified data is not PHI. An authorization is the individual’s written permission, which a limited data set does not require for its permitted purposes. Remember which elements may stay in a limited data set: dates, city, state, ZIP code, and ages.
🌐 Why It Matters: Real-World Healthcare IT Context
Many valuable analyses depend on details that full de-identification removes. Readmission studies need admission and discharge dates. Infection surveillance needs dates of onset. Community health analyses need ZIP codes. Age in days or months matters in neonatal research. The limited data set lets organizations share those details for approved purposes while removing information that directly identifies people.
The data use agreement is what makes this possible. Under HIPAA’s regulations, the agreement must establish the permitted uses and disclosures of the data, identify who may use or receive it, and require the recipient to use appropriate safeguards, report uses or disclosures not provided for by the agreement, ensure that any agents agree to the same restrictions, and not identify the information or contact the individuals.
Limited data sets are common in multi-site research, quality collaboratives, registries, and public health partnerships. They are also used internally for health care operations, such as quality improvement analyses that need dates but not names.
Organizations should also think about how limited data sets are stored and tracked after they leave. Recipients may keep data for years, combine it with other data sets, or share it with collaborators. A good program records each data set’s contents, recipient, purpose, agreement terms, and expiration, and follows up when projects end to confirm that data was returned or destroyed as the agreement requires.
Re-identification risk is real. Dates and ZIP codes, combined with other information, can sometimes identify individuals, which is why the agreement prohibits re-identification and why organizations apply minimum necessary principles to decide which fields to include.
Common limited data set mistakes:
- Leaving direct identifiers in free-text fields or attachments
- Sharing without a signed data use agreement
- Including more fields than the project needs
- Confusing a limited data set with de-identified data
- Allowing recipients to share data further without the same restrictions
- Losing track of where data sets have been sent
Good practices:
- A governance process that reviews each request and selects the right data type
- Standard data use agreement templates reviewed by privacy and legal teams
- Automated extraction that removes direct identifiers consistently
- Minimum necessary review of every field included
- Secure transfer and storage of data sets
- Inventory and expiration tracking for shared data sets
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses encounter limited data sets most often when leading or supporting quality improvement and research projects.
At the Bedside
Nursing documentation, such as fall assessments, pressure injury staging, catheter days, and pain scores, frequently appears in limited data sets used for quality collaboratives and research. Accurate timing of documentation matters because dates are among the details these data sets keep.
Patients may ask how their information is used for research. Nurses can explain that organizations use protected processes and agreements, and refer detailed questions to the research or privacy office.
Dates are often the reason a limited data set is needed. A project measuring time from admission to first mobility, or from catheter insertion to removal, depends on exact dates and sometimes times, which de-identified data would remove.
In Clinical Workflow
When a nurse wants data for a project, choosing the right category saves time and protects patients. If the question can be answered with de-identified data, that is usually simplest. If the project needs dates of admission, procedure, or event, a limited data set under a data use agreement may be appropriate. If the project needs to contact patients or link to identifiable records, other HIPAA pathways and research review will be required.
Working with the organization’s data governance or research office early helps nurses design requests that fit these rules and avoids delays.
In EHR Implementation (Go-Live Perspective)
After an Epic Go-Live, reporting and research teams rebuild extract processes that create limited data sets from the new system. Mapping legacy and new data correctly keeps research and quality collaboratives running without gaps.
At-the-elbow support analysts and super users should avoid copying patient-identifiable screens into informal tip sheets or shared documents. Using training patients for examples keeps support materials free of PHI.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Limited data sets appear in privacy and research questions:
| CAHIMS Domain | How Limited Data Sets Appear |
|---|---|
| Healthcare & Technology Environments | HIPAA Privacy Rule; research and public health uses |
| Clinical Informatics | Quality improvement and research projects using clinical data |
| Healthcare Information & Systems Management | Data extraction, identifier removal, secure transfer |
| Management & Leadership | Data use agreements, governance, minimum necessary, compliance |
Key Terms to Know Alongside Limited Data Set
- Data Use Agreement (DUA) — a contract governing how a limited data set may be used and protected
- De-identified Data — data that meets HIPAA de-identification standards and is no longer PHI
- Direct Identifier — information that directly identifies a person, such as a name or medical record number
- Health Care Operations — activities such as quality assessment, training, and business management
- Re-identification — linking data back to the individuals it describes
- Minimum Necessary — limiting PHI to the least amount needed for a purpose
HIMSS Organizational Position
HIMSS addresses limited data sets as part of privacy, data governance, and responsible secondary use of health data, and engages on HIPAA privacy policy through its public policy work. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- eCFR — 45 CFR 164.514, Other Requirements Relating to Uses and Disclosures (Limited Data Set) https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514
- HHS — HIPAA and Research https://www.hhs.gov/hipaa/for-professionals/special-topics/research/index.html
- HHS — Guidance Regarding Methods for De-identification https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html
- HHS — Minimum Necessary Requirement https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html
- HHS — Summary of the HIPAA Privacy Rule https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html
- Safran et al. (2007), JAMIA — Toward a National Framework for the Secondary Use of Health Data https://pubmed.ncbi.nlm.nih.gov/17077452/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply