Under HIPAA, sharing a limited data set for research requires which of the following?

Under HIPAA, sharing a limited data set for research requires which of the following?

• A. Sharing is Permitted with Only a General Consent
• B. Data Use Agreements Are Optional for Limited Data Sets
• C. Data Use Agreements Permitting Specified Uses and Involving a Business Associate
• D. Limited Data Sets Must Be Fully De-Identified

Answer: (C)

The main idea is that sharing a limited data set for research is allowed only under a Data Use Agreement that spells out the allowed uses and disclosures and involves a business associate. A limited data set can include certain indirect identifiers (like dates and city) but not direct identifiers such as names or full contact details. To share this data, the disclosing entity and the recipient must enter into a Data Use Agreement that specifies the purposes of the use, the specific permitted disclosures, and safeguards to protect the data, including prohibitions on re-identification. A business associate can be involved in handling the data, provided the DUA exists and requires appropriate safeguards. General consent alone does not authorize these disclosures, and the Data Use Agreement is not optional. Also, a limited data set is not fully de-identified; it still contains some identifiers, which is why the DUA is essential.

The main idea is that sharing a limited data set for research is allowed only under a Data Use Agreement that spells out the allowed uses and disclosures and involves a business associate. A limited data set can include certain indirect identifiers (like dates and city) but not direct identifiers such as names or full contact details. To share this data, the disclosing entity and the recipient must enter into a Data Use Agreement that specifies the purposes of the use, the specific permitted disclosures, and safeguards to protect the data, including prohibitions on re-identification. A business associate can be involved in handling the data, provided the DUA exists and requires appropriate safeguards. General consent alone does not authorize these disclosures, and the Data Use Agreement is not optional. Also, a limited data set is not fully de-identified; it still contains some identifiers, which is why the DUA is essential.