Disclosures of a limited data set are not subject to the HIPAA tracking/accounting requirements. The marginal increase in privacy protections that such an accounting would provide is outweighed by its burdens. DHHS has taken the position that the privacy of individuals with respect to PHI disclosed in a limited data set can be adequately protected through a signed Data Use Agreement.