Create a HIPAA limited data set with data-use agreement – CCPA/HIPAA-compliant de-identification per 45 CFR §164.514(e)

A limited data set under 45 CFR §164.514(e) retains certain PHI — including dates, geographic subdivisions, and ages — while removing direct identifiers, and may be disclosed for research, public health, or healthcare operations under a data-use agreement. anonym.legal removes the required direct identifiers while preserving the permitted quasi-identifiers so the dataset remains analytically useful.

When this applies

Use this workflow when a researcher or public health authority needs date-level and sub-state geographic precision that Safe Harbor would eliminate, and a signed data-use agreement covering the permitted purposes under §164.514(e)(3) is in place.

  1. Upload the source PHI dataset to anonym.legal.
  2. The engine removes all 16 direct identifiers that must be stripped under §164.514(e)(2): names; postal address information other than town, city, state, and ZIP code; telephone numbers; fax numbers; email addresses; SSNs; medical record numbers; health plan beneficiary numbers; account numbers; certificate or license numbers; vehicle identifiers and serial numbers; device identifiers; web URLs; IP addresses; biometric identifiers; and full-face photographs.
  3. Dates — including admission dates, discharge dates, dates of service, and dates of birth — are retained as permitted under §164.514(e), along with town, city, state, and ZIP code geographic fields.
  4. The engine generates a data-use agreement template pre-populated with the required provisions from §164.514(e)(4): permitted uses and disclosures, prohibition on re-identification, prohibition on contacting individuals, and safeguarding obligations.
  5. The limited data set file and the data-use agreement template are delivered together as a compliance package.
  6. The parties execute the data-use agreement before the limited data set is transmitted.

What you provide

  • Source PHI dataset (CSV, XLSX, or HL7 FHIR JSON)
  • Description of the research, public health, or healthcare operations purpose
  • Recipient organization details for data-use agreement generation

Limitations & cautions

  • A limited data set is still PHI under the Privacy Rule and must be disclosed only under a compliant data-use agreement covering the permitted purposes in §164.514(e)(3) — it is not equivalent to a de-identified dataset.
  • Retaining full ZIP codes and dates means residual re-identification risk in small geographic areas or rare-disease populations; consult a statistician for datasets with small cell sizes.
  • The data-use agreement template provided is a starting-point document; legal review is required before execution.

FAQ

What purposes can a limited data set be used for?

Under §164.514(e)(3), a limited data set may be used or disclosed only for research, public health, or health care operations. It cannot be used for treatment, payment functions that require individual-level PHI, or commercial marketing. The data-use agreement must specify the permitted purpose.

Is a limited data set covered by the HIPAA Security Rule?

Yes. A limited data set is PHI, and if it exists in electronic form it is ePHI subject to the Security Rule safeguards at 45 CFR §164.302–§164.318. Recipients who are business associates must execute a BAA in addition to the data-use agreement.

Can a limited data set include dates of death?

Yes. Dates — including dates of death — are among the permitted retained elements under §164.514(e)(2). The prohibition applies only to the 16 direct identifiers listed; dates are preserved as analytically necessary data elements.

Healthcare Records

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our servers live in Falkenstein, Germany.

We use Hetzner. They hold ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.