Limited Data Sets of Protected Health Information and Data Use Agreements Under the HIPAA Privacy Rule

Layout for printing
Policy Number:
UW-115
Old Policy Number:
5.2
Responsible Office:
Office of Compliance

University Policy

Rationale/​Purpose:

In enacting HIPAA, Congress mandated the establishment of federal standards for the privacy of individually identifiable health information. Under the patchwork of laws existing prior to adoption of HIPAA and the Privacy Rule, personal health information could be distributed—without either notice or authorization—for reasons that had nothing to do with a patient's medical treatment or health care reimbursement. For example, unless otherwise forbidden by state or local law, without the Privacy Rule patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient's application for a home mortgage or a credit card, or to an employer who could use it in personnel decisions. The Privacy Rule establishes a federal floor of safeguards to protect the confidentiality of medical information. State laws that provide stronger privacy protections apply over and above the federal privacy standards.

Definitions:
Business associate
A person or entity not affiliated with UW–Madison that performs or assists in performing, for or on behalf of any unit in the UW–Madison health care component (UW HCC), business support functions/services that involve the use of protected health information (PHI).
Data use agreement
An agreement between the entity that shares or discloses protected health information and the recipient of the protected health information by which recipient agree only to use or disclose the protected health information for limited purposes as further described below.
Health care operations
Any of a number of business and administrative activities, including:
  • Conducting quality assessment and improvement activities.
  • Reviewing the competence or qualifications of health care professionals.
  • Conducting training programs.
  • Accreditation.
  • Credentialing.
  • Conducting or arranging for medical review, legal services, and auditing functions.
  • Business planning and development.
  • Business management and general administrative activities.

Health care operations do not include research and many fundraising and marketing activities. See UW-107 Uses and Disclosures of Protected Health Information for Marketing and UW-108 Uses and Disclosures of Protected Health Information for Fundraising for more information.

Public health activities
The activities of public health authorities who are legally authorized to receive protected health information for the purpose of preventing or controlling disease, injury, or disability. This would include, for example, the reporting of a disease or injury; reporting vital events, such as births or deaths; and conducting public health surveillance, investigations, or interventions.
Public health authority
An agency or authority of the U.S. government, a state, a territory, a political subdivision of a state or territory, or Indian tribe that is responsible for public health matters as part of its official mandate, as well as a person or entity acting under a grant of authority from, or under a contract with, a public health agency.
Protected health information (PHI)
Is health information or health care payment information, including demographic information, which identifies the patient or can be used to identify the patient. Protected health information does not include student records held by educational institutions or employment records held by employers.
Research
A systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.
UW–Madison health care component (UW HCC)
Those units of UW–Madison that have been designated by the university as part of its health care component under HIPAA. See UW-100 Designation of UW–Madison Health Care Component for a listing of these units.
Scope:

Applies to all members of the UW HCC.

Policy:

Policy Summary

A limited data set (commonly referred to as an “LDS”) is protected health information that excludes certain direct identifiers and can be used or disclosed without an individual’s authorization when other compliance steps are taken. The UW HCC units may use or disclose a limited data set of protected health information only for the purposes of public health activities, research, or health care operations. Such use or disclosure requires a data use agreement between the entities sharing and receiving the limited data set. This document describes how a limited data of protected health information set may be created, and how it may further be used or disclosed under the HIPAA Privacy Rule.

Policy Detail

  1. Use or Disclosure of PHI to Create a Limited Data Set of Protected Health Information

    1. A UW HCC unit may use or disclose a limited data set of protected health information—without authorization from the individuals whose limited identifiers comprise the limited data set—only for the purposes of research, public health activities, or health care operations.
    2. A UW HCC unit may use protected health information to create a limited data set of protected health information, whether or not it is to be used by the UW HCC unit or disclosed to another entity or individual.
    3. A UW HCC unit may disclose protected health information to a business associate in order to create a limited data set of protected health information, whether or not it is to be used by the UW HCC unit or disclosed to another entity or individual. Additional requirements apply before disclosing protected health information to a business associate. (See UW-116 Managing Arrangements of Business Associates with the University of Wisconsin-Madison).

  2. Procedures for Creating a Limited Data Set

    1. The following limited identifiers may be included in a limited data set of protected health information:
      1. Dates (such as admission date, discharge date, service date, date of birth, date of death)
      2. Ages (in years, months, days, or hours)
      3. Town/City, state, 5-digit zip code (but not street name or number, or 9-digit zip code)*

      4. Other numbers, characteristics, or codes not listed as direct identifiers under HIPAA

        *Whether a data set that includes other geocoding or other identifiers not listed above may qualify as a limited data set of protected health information will depend upon the circumstances. 9-digit zip codes and geocoding information which allow specificity of location to a “street” level may not be included in a limited data set of protected health information (see Federal Register, Vol. 67, No. 157, at 53235).

    2. The following direct identifiers of an individual or the individual’s relatives, employers, or household members must be removed in order for a data set to meet HIPAA’s definition of a limited data set of protected health information:
      1. Name
      2. Address or location information more specific than 5-digit zip code
      3. Phone numbers
      4. Fax numbers
      5. E-mail addresses
      6. Social security number
      7. Medical record number
      8. Health plan beneficiary number
      9. Account numbers
      10. Certificate/license numbers
      11. Vehicle identifiers and serial numbers
      12. Device identifiers and serial numbers
      13. URLs
      14. Internet protocol (IP) address numbers
      15. Biometric identifiers (e.g., fingerprints)
      16. Full-face photographic and any comparable images

  3. Data Use Agreements

    1. The UW HCC unit may use or disclose a limited data set of protected health information only if it obtains satisfactory assurance, in the form of a data use agreement, that the data recipient will only use or disclose the limited data set of protected health information for specified purposes. Similarly, a UW HCC unit may receive a limited data set of protected health information from another covered entity if it provides satisfactory assurance to the covered entity, in the form of a data use agreement, that the covered entity’s limited data set of protected health information will only be used or disclosed for specified purposes.
    2. In order to comply with the requirements of HIPAA, the data use agreement must:
      1. Establish the permitted uses and disclosures of the limited data set of protected health information by the recipient, which may be for research, public health activities or health care operations only.
      2. Establish who is permitted to use or receive the limited data set of protected health information.
      3. Provide that the recipient of the limited data set of protected health information will:
        1. Not use or further disclose the information other than as permitted by the data use agreement or as otherwise required by law;
        2. Use appropriate safeguards to prevent use or disclosure of the information other than as provided for by the data use agreement;
        3. Report to the UW HCC unit any use or disclosure of the information not provided for by its data use agreement of which it becomes aware;
        4. Ensure that any agents, including a subcontractor, to whom it provides the LDS of PHI, agree to the same restrictions and conditions that apply to the recipient with respect to such information; and
        5. Not identify the information or contact the individuals.
    3. Data Use Agreement Templates
      1. UW HCC units are encouraged to utilize approved templates to create data use agreements. Templates are available through a number of offices at UW–Madison, including the Office of Compliance and the Office of Research and Sponsored Programs (RSP).
      2. When a UW HCC unit receives a limited data set of protected health information from another institution, that other institution may prefer to use their institutional template to create a data use agreement; using other institutions’ templates is acceptable so long as the resulting data use agreements meet the requirements of HIPAA stated above in Section III.B. of this policy.
    4. Signature Authority for Data Use Agreements at UW–Madison
      1. Data Use Agreements must be executed by an individual with the authority to sign contracts on behalf of UW–Madison. Generally, researchers do not have authority to sign contracts on behalf of UW–Madison; researchers should contact their department administrator or other department leadership with any questions regarding the execution of a Data Use Agreement.

  4. Compliance

    A UW HCC unit is not in compliance with this policy or with HIPAA regulations if the UW HCC unit knows of a pattern of activity or practice of the recipient of a limited data set of protected health information that constitutes a material breach or violation of the data use agreement, unless the UW HCC unit took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful:

    1. Discontinues disclosure of the protected health information to the recipient; and
    2. Reports the problem to the UW–Madison HIPAA privacy officer, who shall report the problem to the Secretary of the Department of Health and Human Services.

Consequences for Noncompliance

Failing to comply with this policy may result in discipline for the individual(s) responsible for such noncompliance.

Further, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s noncompliance may result in institutional noncompliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into corrective action plans and resolution agreements. Failure to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties. 

Supporting Tools

UW–Madison Office of Compliance data use agreement templates may be found at: https://compliance.wisc.edu/policies-and-forms/.

RSP Data Use Agreement templates may be found at: https://www.rsp.wisc.edu/contracts/dtua.cfm. 

Related UW-Madison Policies:
Related UW–Madison Documents, Web Pages, or Other Resources:
External References:

Policy Administration

Approval Authority:
Vice Chancellor for Legal Affairs
Policy Manager:
HIPAA Privacy Officer
Contact:
HIPAA Privacy Officer -- Jack Talaska, JACK.TALASKA@WISC.EDU, (608) 265-4077
Effective Date:
04-14-2003
Revised Dates:

09-22-2014: Effective date of the revised policy: 09-22-2014.
03-26-2020: Effective date of the revised policy: 03-26-2020.
11-09-2020: Effective date of the revised policy: 11-09-2020.

Retrieved:
10-09-2024 06:00:28