DHHS has taken the position that the protection of individuals` privacy with respect to PHI, disclosed in a „limited set of data“, can be duly protected by a signed data use agreement. The current data protection authorization is the authorization signed by a person that allows a covered entity to use or disclose the person`s PHI for the purposes and to the recipient or recipient, as indicated in the authorization. . . .