Permitted Uses
Specify allowed activities (research, public health, operations) and prohibit re-identification or further disclosure beyond the defined purposes.
A clear LDMTS Agreement enables lawful sharing of de-identified-but-limited datasets while preserving research and public health value and reducing regulatory risk under HIPAA.
Lead organizations sign and manage LDMTS Agreements to permit secondary use of limited data sets while meeting HIPAA requirements.
Clear role definitions in the agreement reduce ambiguity about permitted processing, auditing responsibilities, and breach notification duties.
Specify allowed activities (research, public health, operations) and prohibit re-identification or further disclosure beyond the defined purposes.
List the data elements included in the limited data set and confirm excluded direct identifiers per HIPAA limited data set rules.
Detail administrative, technical, and physical safeguards, including encryption, access controls, and minimum-security baselines for data recipients.
Require periodic reporting, access logs, and audit rights that allow the disclosing party to verify permitted use and compliance.
Define notification timelines, investigative duties, and coordination procedures consistent with HIPAA breach notification expectations.
Allocate responsibility for misuse or re-identification and include indemnity provisions, insurance minimums, and limits on liability where appropriate.
| Field validation rules | Require MM/DD/YYYY for dates |
|---|---|
| Signer order | Choose sequential or parallel routing |
| Authentication method | Email link or SMS code |
| Document retention | Enable secure copy storage |
| Audit capture | Record IP and timestamp |
Use a platform that supports audit trails, secure storage, and required authentication for sensitive healthcare agreements.
Ensure the chosen eSignature provider can sign a BAA, capture a complete audit trail, and export tamper-evident signed PDFs for long-term retention.
7–14 business days for legal and security review
Target 3–7 business days by parties
Align with DUA before data release
Ensure logs retained immediately
Confirm storage within 30 days
The center needed de-identified data for outcomes research and partnered with an analytics vendor
A health research lab requested limited clinical datasets for a population study
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial | Varies by plan | Varies by plan | Varies by plan | Varies by plan |
| Bulk Send | Yes | Yes | Yes | Yes | Yes |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |
| Envelope Cap | No cap | 100 envelopes/user/year | Varies by plan | Varies by plan | Varies by plan |