HIPAA Privacy Rule - Minimum Necessary

A central aspect of the HIPAA Privacy Rule is the principle of "minimum necessary" use and disclosure.

• A covered entity must make reasonable efforts to use, disclose, and request only the minimum amount of protected health information needed to accomplish the intended purpose of the use, disclosure, or request.
• A covered entity must develop and implement policies and procedures to reasonably limit uses and disclosures to the minimum necessary.

When the minimum necessary standard applies to a use or disclosure, a covered entity may not use, disclose, or request the entire medical record for a particular purpose, unless it can specifically justify the whole record as the amount reasonably needed for the purpose.

The minimum necessary requirement is not imposed in any of the following circumstances:

1. disclosure to or a request by a health care provider for treatment;
2. disclosure to an individual who is the subject of the information, or the individual's personal representative;
3. use or disclosure made pursuant to an authorization;
4. disclosure to HHS for complaint investigation, compliance review or enforcement;
5. use or disclosure that is required by law; or
6. use or disclosure required for compliance with the HIPAA Transactions Rule or other HIPAA Administrative Simplification Rules.