HIPAA_MINIMUM_NECESSARY_001

rules/regulations/us/hipaa_minimum_necessary.yaml

Citation

45 CFR §164.502(b)(1) Minimum necessary applies: When using or disclosing protected health information or when requesting protected health information from another covered entity or business associate, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. §164.502(b)(2) Minimum necessary does not apply. This requirement does not apply to: (i) Disclosures to or requests by a health care provider for treatment; (ii) Uses or disclosures made to the individual, as permitted under paragraph (a)(1)(i) of this section or as required by paragraph (a)(2)(i) of this section; (iii) Uses or disclosures made pursuant to an authorization under § 164.508; (iv) Disclosures made to the Secretary in accordance with subpart C of part 160 of this subchapter; (v) Uses or disclosures that are required by law, as described by § 164.512(a); and (vi) Uses or disclosures that are required for compliance with applicable requirements of this subchapter.

Condition

Requires covered entities and business associates to make reasonable efforts to limit uses, disclosures, and requests of protected health information (PHI) to the minimum necessary to accomplish the intended purpose. HIPAA Privacy Rule, 45 CFR §164.502(b).

Layer 1 detects

share, disclose, send, transmit, provide or grant access to (and words that begin with them), then entire, full, complete or all, then medical, patient, health or clinical record, with no word between; bulk, mass or wholesale PHI, patient data, medical record or health information disclosure, transfer, sharing or export; request or requesting the entire, full, complete or all medical, patient or health record when, where or but only, just or merely; no or without minimum necessary, need-to-know or role-based assessment, review, determination or access control; everyone, all staff, the entire team or all employees, then has, have or with, then access to or can access, then PHI, patient record, medical record or health information; over-disclosure or excessive disclosure (of) PHI, protected health information or patient data; and sharing or disclosing more PHI or more health information than necessary, required or needed. The words follow each other with nothing in between. It matches wording, not meaning: it misses the practice told in other words ("For the billing dispute, share the entire medical record including psychotherapy notes with the collections agency." has the word "the" between the verb and "entire"), it does not read the treatment and individual-access exceptions, and it fires on text that only names the practice. Whether a use or disclosure goes beyond the minimum necessary is judged in Layer 2.

Condition type

regex; semantic condition in the file, not run by the engine

Status in the file

approved