Skip to main content

Data Use Agreements

De-identification and Limited Data Sets

There are 18 identifiers included in the definition of Protected Health Information. De-identifiation is the process of remove all indeitifers from the data.Once all identifiers have been removed this data is no longer considered PHI.

PHI Identifiers

A Limited Data Set is when direct identifiers have been removed, but the following types of generalized data is still included:

•Dates: Birth date, death date, treatment date.
•Geographical Indicators: City, state, and zip code (not address)
•Ages: Patient ages (can be expressed in months, days, or hours)
 
A limited data set is considered PHI. Obtaining a limited data set from a third-party or sharing a limited data set with an entity outside of the U of A will require a Data Use Agreement. Some entities may also request a DUA for sharing de-identified data.

 

To request a Data Use Agreement, contact the Office of Research Contracts & Agreements.