The HIPAA minimum necessary rule is a requirement of the HIPAA Privacy Rule to restrict uses and disclosures of – and requests for – Protected Health Information to the minimum necessary to achieve the purpose of the use, disclosure, or request. However, the minimum necessary rule does not apply in all circumstances.
When the first HIPAA Privacy Rule was proposed, one of the concerns regarding permissible uses and disclosures of Protected Health Information (PHI) was that, in theory, health plans could request full medical record sets from healthcare providers before – for example – authorizing a treatment. Because medical records can exist in multiple locations, responding to the requests would place an unnecessary administrative burden on healthcare providers.
There were also secondary concerns that collating and sending full medical record sets to health plans would extend the number of people with access to PHI and increase the likelihood of further (impermissible) uses and disclosures of the information. While there was no evidence to support the secondary concerns, the Secretary for Health and Human Services addressed the concerns by implementing the HIPAA Minimum Necessary Rule.
The HIPAA Minimum Necessary Rule
The HIPAA minimum necessary rule at §164.502(b) of the HIPAA Privacy Rule states “when using or disclosing protected health information or when requesting protected health information from another covered entity or business associate, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.”
A second standard in §164.514(d) of the HIPAA Privacy Rule includes the implementation specifications for complying with the HIPAA minimum necessary rule. The implementation specifications require covered entities and business associates (where applicable) to:
- Identify which members of the workforce require access to PHI to carry out their duties.
- Limit the access of eligible workforce members to only the category of PHI required.
- Implement “minimum necessary” procedures for routine and recurring disclosures of PHI.
- Implement policies to review non-routine or recurring incoming requests for PHI.
- Limit outgoing requests to the minimum necessary to achieve the purpose of the request.
- Only disclose full medical record sets when the disclosure is required or justified.
The “reasonable efforts” condition of §164.502(b) gives covered and entities a degree of flexibility in how they comply with the implementation specifications. Compliance may also be subject to the “flexibility of approach” standard in §164.306(b) of the HIPAA Security Rule. However, when responding to a request for PHI, covered entities and business associates must comply with the HIPAA Privacy Rule’s verification requirements:
“Verify the identity of a person requesting protected health information and the authority of any such person to have access to protected health information.” HIPAA Privacy Rule §164.514(h).
Exceptions to the Minimum Necessary Standards
One of the risks of implementing the HIPAA minimum necessary rule is that it could impede the flow of information for essential healthcare and operational activities. Consequently, the HIPAA Privacy Rule allows for six occasions when compliance with the minimum necessary standards is not required. The six occasions apply to:
- Requests for PHI and disclosures to a healthcare provider for treatment purposes.
- Disclosures to the individual who is the subject of the PHI for any purpose.
- Uses, disclosures, and requests supported by a valid HIPAA authorization.
- Disclosures to HHS’ Office for Civil Rights during a compliance investigation.
- Disclosures required by law provided the disclosures are limited to the requirements of the law
- Uses and disclosures required to comply with any other section of the HIPAA Privacy Rule’s General Rules (§164.502).
These exceptions have to be accounted for in the policies and procedures implemented by covered entities and business associates to comply with §164.514(d). They should also be included in HIPAA training so that members of the workforce understand when exceptions to the HIPAA minimum necessary standard apply and so that they do not inadvertently impede the flow of information or prevent an individual exercising their HIPAA rights.