A HIPAA Covered Entity, or a Hybrid Covered Entity like UA, may use a member of its own workforce to create the "Limited Data Set."  Alternatively, the recipient may create the "Limited Data Set," so long as the recipient is acting as a Business Associate or Subcontractor (pursuant to a Business Associate Agreement) of the Covered Entity or Hybrid Covered Entity.  

A DUA must be entered into before there is any use or disclosure of a Limited Data Set to an outside institution or party. 

No, disclosures of "limited data sets" are not subject to the HIPAA accounting of disclosures requirements.  The Department of Health and Human Services (DHHS) has taken the position that the privacy of individuals with respect to PHI disclosed in a "Limited Data Set" can be adequately protected through a single DUA.