The rule does not require patient authorization (or a waiver) for the disclosure to researchers of limited data sets (ie, information from which most of 18 identifiers specified in the rule have been removed, such as geographic information related to the individual, including zip code, and dates related to the individual, such as birth dates and admission dates).