HIPAA limited data sets, and where direct identifiers hide in real records

A HIPAA limited data set is protected health information with 16 direct identifiers removed, belonging to the patient and to their relatives, employers and household members. Names, street addresses, phone numbers, Social Security numbers and medical record numbers are among them. Unlike Safe Harbor, a limited data set may keep full dates, ages over 89 and the city, state and five-digit ZIP code. A covered entity may use or disclose one only for research, public health or health care operations, and only under a data use agreement.

The list is shorter than Safe Harbor's, so it sounds like the easier job. In practice the data keeps most of the record, and one direct identifier left anywhere in it, from a nursing note to a label barcode, puts the patient's name back next to their dates and diagnosis.

What a limited data set keeps, and what it removes

The list is in 45 CFR 164.514(e)(2). Here it is beside Safe Harbor's.

The rule names only what must come out. When HHS adopted it in 2002, it explained that the county, precinct and geocodes may stay too, and that it left out Safe Harbor's catch-all because the data use agreement already limits the recipient. It relies on the minimum necessary standard instead: birth dates should go out only when the study needs them.

The data use agreement

Section 164.514(e)(4) sets out what the agreement must do, and HHS's research guidance summarizes the same terms. It must:

• set the permitted uses and disclosures, which can't include anything the covered entity itself couldn't do;
• say who may use or receive the data;
• bind the recipient to use appropriate safeguards and to report any use or disclosure the agreement doesn't allow;
• hold the recipient's agents, subcontractors included, to the same terms;
• forbid the recipient to identify the information or contact the individuals.

For research, the agreement takes the place of the patient's authorization or an IRB waiver. If the covered entity learns of a material breach of it, it must take reasonable steps to cure it, and if that fails, stop the disclosures and report the problem to HHS.

Still protected health information

A limited data set is not de-identified, so the Privacy Rule keeps applying to it. It gets one break: disclosures of one are left out of a patient's right to an accounting of disclosures under 45 CFR 164.528(a)(1)(viii).

Breach notification gives none. The 2009 interim breach rule exempted limited data sets with no birth dates or ZIP codes, and the 2013 Omnibus Rule removed that exception. After any impermissible use or disclosure of one, the entity must run the breach risk assessment to show that notification isn't required. HHS suggested encrypting limited data sets instead, since encrypted data that meets its guidance needs no notification.

Where direct identifiers hide in real records

Clinical notes are full of them. The 2014 i2b2/UTHealth de-identification corpus, 1,304 clinical records describing 296 patients, held 28,872 identifiers. Most were dates, which a limited data set may keep. But annotators also tagged 2,195 mentions of patient names, 1,033 medical record numbers, 524 phone numbers and 352 street addresses, all of them direct identifiers. In the shared task that used the corpus, the median of 22 automated systems found 81.6% of the HIPAA identifiers in the test records, and the best found 93.9%.

Address lines

A limited data set may keep "Erie, PA 16509" but not "1420 Wexford Drive" on the line above it. On a scanned intake form both sit in one box, so the split has to happen inside an image. HHS chose the words "postal address information" so that a street name on its own counts too: "a home visit on Wexford Drive" in a social work note is a direct identifier.

Relatives and contacts in free text

Nursing and social work notes are full of the people around the patient: "Son Daniel is the emergency contact." His name is a direct identifier, and so is an employer in an occupational history ("retired bookkeeper, Lakeshore Mutual").

Labels, wristbands and barcodes

Specimen labels, wristband images and requisition stickers print the medical record number twice: once as text and once in a barcode. The barcode isn't in the text layer, so removing "MRN 00731158" from the text leaves the same number readable by any phone camera.

Device serials and equipment notes

Device identifiers and serial numbers stay on the list, even though some commenters wanted them kept for recalls. They hide in plain prose: "Home CPAP, SN 23161894072, to be resumed."

Scanned cards and photos

Intake packets carry copies of insurance cards and driver's licenses: a health plan number, a license number and often a face photo on one image. Clinical photos taken for wound or burn care sometimes include the face.

The file itself

A filename such as holloway_e_mrn00731158.pdf is an identifier. So are author fields in the document properties, comments and form-field values. Portal printouts and audit logs add web addresses and IP addresses, which are on the list too.

A checklist before a limited data set leaves

• A data use agreement covers this recipient and this purpose: research, public health or health care operations.
• Names of the patient, relatives, employers and household members are gone, in notes as well as headers.
• Street addresses and street names are gone; only the city, state, ZIP code or other geographic codes remain.
• Phone and fax numbers, email addresses, URLs and IP addresses are gone.
• Social Security, medical record, health plan, account, license, vehicle and device numbers are gone, serial numbers in equipment notes included.
• Barcodes, face photos and scanned ID and insurance cards have been checked by eye, not just searched.
• Birth dates are included only if the purpose needs them.
• The filename, document properties, comments and form fields are clean, and redacted text is removed rather than covered.

Where DocArmor fits

DocArmor's HIPAA Safe Harbor template is mapped to all 18 Safe Harbor identifiers, which include each of the 16 a limited data set must remove, and you can adjust it to your own policies before a job runs. OCR reads scanned and faxed pages, and visual detection finds face photos, biometrics and barcodes. Redacted content is removed and checked on every page, and metadata, attachments and form values are stripped. Every finding goes to a reviewer before export, because with dates and towns left in, one missed name or number is enough to identify the patient.

This post is general information about the HIPAA Privacy Rule, not legal advice. Check your data use agreements, and any state law or IRB requirements that apply, with your privacy officer or counsel.