Home : Academic/Research : Health Sciences

Individual health information may be used or disclosed, for the purpose of research, as part of a limited data set when a data use agreement is in place between the holder of the data and the researcher. Before obtaining a limited data set to be used in human subjects research, researchers are required to submit an application to the IRB for review and approval.

REMOVAL OF IDENTIFIERS
The following identifiers for the individual and the individual's relatives, employers or household members must be removed to create a limited data set:

1. Names
2. Postal address information other than town/city, state and zip.
3. Telephone number
4. Fax number
5. Email address
6. Social security number
7. Medical record number
8. Health plan number
9. Account numbers
10. Certificate or license numbers
11. Vehicle identification/serial numbers, including license plate numbers
12. Device identification/serial numbers
13. Universal resource locators
14. Internet protocol addresses
15. Biometric identifiers
16. Full face photographs and comparable images

DATA USE AGREEMENTS
A data use agreement must be in place between the holder of the PHI and the researcher who is the recipient of the limited data set before the limited data set may be obtained. The data use agreement must contain satisfactory assurances that the researcher will only use or disclose the limited data set for research purposes set forth in the data use agreement.

The data use agreement must meet the following requirements:

1. Establish the permitted uses or disclosures of the information by the researcher;
2. Establish who is permitted to use or receive the limited data set;
3. Provide that the researcher will not use or further disclose the information other than as permitted by the agreement or required by law;
4. Provide that the researcher will use appropriate safeguards to prevent the impermissible use or disclosure of the information;
5. Provide that the researcher will report to the holder of the PHI any impermissible use or disclosure of which it becomes aware;
6. Require that the researcher will ensure that any agents to whom the researcher provides the limited data set agree to the same restrictions and conditions;
7. Provide that the researcher will not identify the information or contact the individuals; and
8. Provide that if the attempts to cure a breach or end a violation are unsuccessful, disclosure of data to the researcher will be terminated and the problem will be reported to the Secretary.