On this page
A HIPAA limited data set is protected health information with 16 direct identifiers removed, such as names, street addresses, phone numbers, email addresses, web URLs and IP addresses, that a covered entity may use or disclose only for research, public health or health care operations, and only under a data use agreement with the recipient (45 CFR 164.514(e)). Unlike de-identified data, it is still PHI. Curve Compliance, which helps healthcare marketers keep PHI out of ad platforms, checked the rule on eCFR and HHS on November 2, 2026.
Book a call. Website hits carry the visitor's IP address, one of the 16 identifiers (45 CFR 164.514(e)(2)). Curve Compliance replaces browser ad pixels with one script, sends each ad platform only a fixed list of fields and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What a limited data set is
The rule's definition: “A limited data set is protected health information that excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual” (45 CFR 164.514(e)(2)). So the identifiers of family members, employers and household members come out too, not only the patient's. HHS lists the limited data set as one of six ways the Privacy Rule permits use and disclosure without an individual's authorization, and says it “may be used and disclosed for research, health care operations, and public health purposes, provided the recipient enters into a data use agreement promising specified safeguards for the protected health information within the limited data set” (HHS).
A limited data set starts from individually identifiable health information and stays inside HIPAA. See what IIHI is for the layer underneath, and PHI disclosure rules for the other permissions.
The 16 identifiers removed
The limited data set list in 45 CFR 164.514(e)(2) is shorter than the Safe Harbor de-identification list in 45 CFR 164.514(b)(2). Side by side:
| Identifier | Limited data set | Safe Harbor de-identification |
|---|---|---|
| Names | Removed | Removed |
| Street address and other postal address details | Removed | Removed |
| Town or city, state and ZIP code | May stay | Removed below state level, except the first three ZIP digits where that area holds more than 20,000 people (164.514(b)(2)(i)(B)) |
| Dates such as birth, admission, discharge and death | Not on the list, so they may stay | Removed except the year; ages over 89 can appear only as a single 90 or older category (164.514(b)(2)(i)(C)) |
| Telephone and fax numbers | Removed | Removed |
| Email addresses | Removed | Removed |
| Social Security, medical record and health plan beneficiary numbers | Removed | Removed |
| Account and certificate or license numbers | Removed | Removed |
| Vehicle identifiers, including license plates | Removed | Removed |
| Device identifiers and serial numbers | Removed | Removed |
| Web URLs | Removed | Removed |
| IP addresses | Removed | Removed |
| Biometric identifiers, including finger and voice prints | Removed | Removed |
| Full-face photos and comparable images | Removed | Removed |
| Any other unique identifying number, characteristic or code | Not on the list | Removed, apart from a re-identification code that meets 164.514(c) |
The practical difference is dates (including ages over 89), location down to town, city and ZIP code, and other unique codes. A limited data set may keep them; Safe Harbor de-identified data may not. That is why a limited data set is still PHI and why the rule asks for a data use agreement. For how each identifier shows up in website data, see the 18 HIPAA identifiers.
The three permitted purposes
“A covered entity may use or disclose a limited data set under paragraph (e)(1) of this section only for the purposes of research, public health, or health care operations” (45 CFR 164.514(e)(3)(i)). A covered entity may build the set itself, or disclose PHI to a business associate only to create it (45 CFR 164.514(e)(3)(ii)). HHS's research guidance describes the same path for researchers: a data use agreement “pursuant to which the covered entity may disclose a limited data set to the researcher for research, public health, or health care operations” (HHS). Health care operations has a defined meaning; see HIPAA TPO.
The data use agreement
The covered entity needs “satisfactory assurance, in the form of a data use agreement” that the recipient will only use or disclose the information for limited purposes (45 CFR 164.514(e)(4)(i)). The agreement must:
- Set the permitted uses and disclosures, within the three purposes, and never authorize a use the rule would forbid the covered entity to make.
- Say who may use or receive the limited data set.
- Bind the recipient not to use or further disclose the information other than as the agreement permits or as the law requires.
- Bind the recipient to use appropriate safeguards.
- Bind the recipient to report any use or disclosure the agreement does not allow.
- Bind the recipient to pass the same restrictions to any agents it shares the data with.
- Bind the recipient to “Not identify the information or contact the individuals.”
Each item is in 45 CFR 164.514(e)(4)(ii). If the covered entity knows of a pattern of activity that materially breaches the agreement, it must take reasonable steps to cure it and, if those fail, stop disclosing and report the problem to the Secretary (45 CFR 164.514(e)(4)(iii)). A data use agreement is not a business associate agreement, which covers a vendor that handles PHI on your behalf (45 CFR 160.103); see what a BAA is.
Limited data set vs de-identified data
HHS: “Regardless of the method by which de-identification is achieved, the Privacy Rule does not restrict the use or disclosure of de-identified health information, as it is no longer considered protected health information.” The two methods are Expert Determination and Safe Harbor (HHS). A limited data set is the middle ground: more detail than Safe Harbor allows, and the rule's protections still attached.
- Status. A limited data set is PHI. De-identified data is not (HHS).
- Purposes. Research, public health or health care operations only, versus no Privacy Rule limit (45 CFR 164.514(e)(3)).
- Agreement. A data use agreement is required for a limited data set. For de-identified data HHS says nothing prevents a covered entity from asking for one (HHS).
- Accounting. Disclosures of a limited data set are left out of a patient's accounting of disclosures (45 CFR 164.528(a)(1)(viii)).
For the marketing view of de-identification, see de-identified data under HIPAA.
Marketing and limited data sets
Marketing is not one of the three purposes. A limited data set is still PHI, and a covered entity “must obtain an authorization for any use or disclosure of protected health information for marketing,” apart from face-to-face communications and promotional gifts of nominal value (45 CFR 164.508(a)(3)). The data use agreement also bars the recipient from contacting the individuals (45 CFR 164.514(e)(4)(ii)). See the HIPAA Privacy Rule for marketing.
Website data doesn't fit the category anyway. A page view sent to an ad platform carries the visitor's IP address, which is on the removal list (45 CFR 164.514(e)(2)), so it can't be a limited data set. HHS's tracking bulletin says “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures” (HHS). The same page notes that a federal court vacated part of the bulletin on June 20, 2024, the part about IP addresses on unauthenticated public pages about health conditions or providers. See are IP addresses PHI. Which permission fits a given data flow is a question to talk to your counsel about.
How Curve Compliance helps
Curve Compliance works on the data that leaves your website for ad platforms. Curve replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform.
Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II and signs a BAA on every plan (Directory entry), and Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: 45 CFR 164.514; 45 CFR 164.508; 45 CFR 164.528; 45 CFR 160.103; HHS, Summary of the HIPAA Privacy Rule; HHS, HIPAA and Research; HHS, De-identification guidance; HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
What is a HIPAA limited data set?
It is PHI with 16 direct identifiers removed that may be used or disclosed only for research, public health or health care operations, under a data use agreement (45 CFR 164.514(e)). Unlike de-identified data, it is still PHI.
Is a limited data set PHI?
Yes. The rule defines it as “protected health information that excludes” the listed direct identifiers (45 CFR 164.514(e)(2)).
What identifiers can a limited data set keep?
Anything not on the list of 16, including dates such as birth and admission dates, and town or city, state and ZIP code (45 CFR 164.514(e)(2)).
Is de-identified health information subject to the Privacy Rule?
No. HHS says the Privacy Rule does not restrict the use or disclosure of de-identified health information, because it is no longer PHI (HHS).
What is a data use agreement?
The contract a covered entity must have before it uses or discloses a limited data set. It sets the permitted uses, who may receive the data, and binds the recipient to safeguards, reporting and not identifying or contacting the individuals (45 CFR 164.514(e)(4)).
Can a limited data set be used for marketing?
No. It may be used only for research, public health or health care operations (45 CFR 164.514(e)(3)), and marketing uses of PHI need an authorization (45 CFR 164.508(a)(3)).
Do limited data set disclosures go in an accounting of disclosures?
No. Disclosures made as part of a limited data set are one of the exceptions to the accounting requirement (45 CFR 164.528(a)(1)(viii)).
Talk to Curve Compliance
Book a call. Want conversions in your ad platforms without PHI? Curve Compliance strips PHI before data reaches an ad platform, sends conversions server-side and signs a BAA on every plan. Book a call with Curve.