A covered entity may enter into a data use agreement to use and disclose protected health information (PHI) that is included in a limited data set without obtaining either authorization or a waiver of authorization. Limited data sets may be used or disclosed only for purposes of research, public health, or health care operations.