HIPAA limited data sets and data use agreements for AI model development

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

What a limited data set keeps that Safe Harbor strips

A limited data set keeps the date and location detail that Safe Harbor removes, and nothing else changes about its status as PHI. Under 164.514(e)(2), the covered entity must strip 16 direct identifiers of the patient and of relatives, employers or household members: names, street address, phone and fax numbers, email, SSN, medical record numbers, health plan beneficiary numbers, account numbers, certificate and license numbers, vehicle and device identifiers, URLs, IP addresses, biometric identifiers and full-face photographs [1]. What survives is the field set Safe Harbor deletes: admission, discharge, service, birth and death dates, ages over 89, five-digit ZIP, and town or city [2][3].

That difference matters for readmission windows, time-to-event survival models, seasonality, outbreak and claims-lag forecasting, and anything keyed to geography below the three-digit ZIP level. Safe Harbor keeps only the year and, for most areas, only the first three ZIP digits; the Safe Harbor dates and ZIP code trade-offs are covered separately [2].

Whether model training fits research, public health or health care operations

Model training can fit an LDS purpose, but only when the activity is genuinely one of the three purposes in 164.514(e)(3), and each has a limit that commercial training often breaks [1][6]. The question is legal, not technical, and it should be settled in writing before the first extract.

Research. HIPAA's research definition turns on a systematic investigation designed to contribute to generalizable knowledge. An academic team developing and publishing a sepsis-onset model often fits; a vendor training a proprietary product whose only output is a commercial model is a harder argument, and counsel on both sides should document the reasoning.

Health care operations. Operations are the covered entity's own activities, such as quality assessment, population health and care coordination. A health system training a no-show or deterioration model for its own use can sit here; a third-party developer reusing the same LDS to build a product sold to other hospitals is outside that covered entity's operations. If the developer prepares the LDS on the covered entity's behalf, that work happens under a business associate agreement, not the DUA; see business associate agreement or data license.

Public health. This purpose is tied to public health authorities and activities such as surveillance. It rarely covers a private developer's training run.

Treat "AI development" as too vague for a purpose clause. Name the model family, the task (for example, 30-day readmission risk), the evaluation use, and whether derived artifacts leave the recipient.

Required DUA elements under 45 CFR 164.514(e)(4)

A HIPAA-compliant DUA must set permitted uses, name who may use or receive the data, and bind the recipient to five specific obligations [1]. Institutional templates follow the regulation closely and add execution-before-disclosure as a gate [4][6].

Illustrative example: invented to show structure; it does not describe an available dataset.

DUA review checklist for an AI development use

• Permitted uses and disclosures stated, and no use the covered entity itself could not make under the Privacy Rule [1].
• Authorized users named by role or organization, including any cloud, labeling or compute subcontractors that touch raw records.
• Recipient will not use or further disclose the data except as the DUA permits or law requires [1].
• Recipient will use appropriate safeguards against other uses or disclosures [1][4].
• Recipient will report any use or disclosure not provided for by the DUA [1][6].
• Recipient will ensure agents and subcontractors agree to the same restrictions [1].
• Recipient will not identify the information or contact the individuals [1][4].
• Signed before any disclosure [4].
• AI-specific additions (not required by HIPAA, but worth negotiating): treatment of model weights, embeddings and synthetic outputs; memorization testing; linkage bans; destruction or retention at term.

The covered entity also carries risk: if it knows of a pattern of activity that materially breaches the DUA, it must take reasonable steps to cure it or stop disclosing [1]. Expect audit and termination rights in return. For how prohibition language reads in commercial licenses, see re-identification prohibition clauses, and for how a DUA differs from a license generally, see data license vs data use agreement.

Remuneration, the sale-of-PHI rule and commercial licensing

Paying for an LDS can turn the disclosure into a sale of PHI, which generally requires each patient's authorization. Because an LDS remains PHI [1][3], the Privacy Rule's sale provisions in 164.502(a)(5)(ii) need to be checked; practitioners commonly read the research exception as limited to a cost-based fee for preparing and transmitting the data, so a profit margin can take the deal outside it. Have counsel confirm the exact exception text before pricing anything.

In practice, this means a commercial "LDS license" with value-based pricing is a red flag for both parties. If your budget and the supplier's expectations involve real consideration for data, the cleaner path is usually de-identified data, which falls outside HIPAA once the 164.514(a)-(b) standard is met [1][3]. Healthcare counsel should also check 42 CFR Part 2 for substance-use records and state health privacy laws, which an LDS does not displace.

When to require Expert Determination data instead of an LDS

Choose Expert Determination when you need dates and fine geography and the deal is commercial, the use goes beyond the three LDS purposes, or the model will ship to third parties. An expert can approve date shifting per patient, generalized ZIP, or suppression of rare combinations while preserving intervals, and the result is no longer PHI [2].

The trade-offs are cost, the expert's conditions (often recipient controls and a linkage ban) and the need to review the report itself; see Safe Harbor vs Expert Determination for AI training and how to review an Expert Determination report. Keep an LDS for cases where the purpose is clearly research or the covered entity's own operations, remuneration is cost-based, and outputs stay inside the recipient.

Engineering controls that make a DUA enforceable in an ML pipeline

A DUA is only as good as the controls that implement it, and the minimum necessary standard applies to AI workflows: restrict fields, time ranges and user access to what the task needs [5]. Translate each DUA promise into a control a reviewer can verify.

• Field allowlist. Ingest only the columns the purpose clause supports, for example encounter_id_hashed, admit_date, discharge_date, zip5, icd10_dx, cpt_px, drg, payer_class. Drop free-text notes unless separately scrubbed, because LDS stripping does not reach names in clinical narrative; see PII redaction for LLM training data.
• Enclave and access logs. Keep raw LDS tables in a segregated project with role-based access tied to the DUA's named users, and log reads.
• Linkage controls. Block joins to consumer, address or voter files; date plus five-digit ZIP plus sex is exactly the quasi-identifier set that enables re-identification.
• Model artifacts. Memorized dates and ZIPs in generated text can amount to a disclosure. Run extraction and membership-inference tests before weights leave the enclave; see training-data extraction and memorization risk.
• Subcontractor flow-down. Labeling vendors, GPU clouds and evaluation contractors are agents who must sign the same restrictions [1][5].

How SourceX approaches health data for model development

SourceX sources operational datasets from US companies on request, and for health records it requires HIPAA de-identification by Safe Harbor or Expert Determination before delivery. Each dataset is rights-reviewed for ownership and consents, personal details are removed or replaced with the method recorded and a sample checked, and delivery runs through private, access-controlled workflows only after an executed agreement and supplier approval. No de-identification method is perfect, so your own controls still matter. Buyers can describe the dated, location-bearing health data a model needs; a request does not guarantee a match. For background, see the PHI glossary entry, HIPAA and AI training data, and the privacy and de-identification hub within the AI data buyer guides.

Request de-identified health data for your model

If an LDS under a DUA does not fit your purpose or pricing, describe the records, fields and allowed uses you need. SourceX looks for US businesses that hold that data, and every release is approved by the supplying company under a license defining records, uses, term and delivery. Start a buyer request at sourcex.si/buyers.