07/26/2014
Under the HIPAA Privacy Rule, a covered entity (CE) may use a Data Use Agreement to allow for a Limited Data Set of PHI to be used and disclosed for a particular purpose without an individual authorization. This type of process should be supported by SOPs within the CE related to compliance with the applicable regulations (45 CFR 164.514 (b)).