HIPAA Glossary · Data & information types
Data use agreement
The required contract governing a recipient's use of a limited data set.
Context
Required by §164.514(e)(4). Must limit use to specified purposes, prohibit further disclosure, require safeguards, require reporting of unauthorised use, and bind the recipient to not re-identify. A data use agreement is a lighter instrument than a BAA — it covers a limited data set, not full PHI.
Related terms
- Limited data set — PHI stripped of most direct identifiers but retaining elements like dates and geographic detail, usable under a data use agreement.
- BAA — The mandatory contract establishing what a business associate may do with PHI, the safeguards required, and breach reporting duties.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.