A DUA permits disclosure of a limited data set (PHI stripped of direct identifiers) when the recipient agrees to specified safeguards and use restrictions under 45 CFR 164.514(e).