A limited data set is PHI that has had all direct identifiers removed (i.e., name, address, phone and fax numbers, email address and URLs, SSN, photo, etc.) but that may retain indirect identifiers, including date of birth, age, five-digit ZIP code, and medical admission, discharge, and service dates. Limited data sets can be used for research or public health purposes without authorization. A covered entity that releases limited data sets must have agreements with recipients that specify how and for what period the data will be used, and that it can’t be shared with third parties.