Rule set sha256:adf208a05da8
HIPAA_MINIMUM_NECESSARY_001
One rule of the rule set with digest adf208a05da8edfde9ef5c5a1359104382ac794a5b4ec0d0aaca2fd21e90574c. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
| Rule | HIPAA_MINIMUM_NECESSARY_001 |
|---|---|
| Rule version | ffdef6dc30d0916cf14f78d2e9c098d1c8e6f8d1fda7e7d028f5dbe19fbee71c |
| Provision | 45 CFR 164.502(b) (HIPAA Privacy Rule, minimum necessary) Official publication: https://www.ecfr.gov/current/title-45/section-164.502 |
| Approval | Approved Approved by Leo Celis on 2026-10-16 |
rules/regulations/us/hipaa_minimum_necessary.yaml
- Citation
- 45 CFR §164.502(b)(1) Minimum necessary applies: When using or disclosing protected health information or when requesting protected health information from another covered entity or business associate, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. §164.502(b)(2) Minimum necessary does not apply. This requirement does not apply to: (i) Disclosures to or requests by a health care provider for treatment; (ii) Uses or disclosures made to the individual; (iii) Uses or disclosures made pursuant to an authorization under §164.508; (iv) Disclosures made to the Secretary in accordance with subpart C of part 160 of this subchapter; (v) Uses or disclosures that are required by law; (vi) Uses or disclosures that are required for compliance with applicable requirements of this subchapter.
- Condition
- Requires covered entities and business associates to make reasonable efforts to limit uses, disclosures, and requests of protected health information (PHI) to the minimum necessary to accomplish the intended purpose. HIPAA Privacy Rule, 45 CFR §164.502(b).
- Condition type
- regex, semantic
- Status in the file
- approved