Must a covered entity provide an accounting for disclosures if the only information disclosed to a public health authority is in the form of a limited data set?
No, a covered entity is not required to provide an [...]
May a covered entity hire a business associate to create a limited data set, and may the public health authority be a business associate for that purpose, even if the public health authority is also the intended recipient of the limited data set?
A covered entity may enter into a business associate agreement [...]
I want to hire the intended recipient of a limited data set to also create the limited data set as my business associate. Can I combine the data and use agreement and business associate contract?
Yes. A data use agreement can be combined with a [...]
Under the HIPAA Privacy Rule, may a covered entity contract with a business associate to create a limited data set the same way it can use a business associate to create de-identified data?
Yes. See 45 CFR 164.514(e)(3)(ii). For example, if a researcher [...]
If the only protected health information a business associate receives is a limited data set, does the HIPAA Privacy Rule require the covered entity to enter into both a business associate agreement and data use agreement with the business associate?
No. Where a covered entity discloses only a limited data [...]