HIPAA Minimum Necessary Standard — 45 CFR §164.502(b)

Overview

The minimum necessary standard is a core principle of the HIPAA Privacy Rule requiring covered entities to make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. Codified at 45 CFR §164.502(b) and elaborated in §164.514(d), this standard affects every PHI handling decision within a covered entity's operations. The HITECH Act §13405(b) directed HHS to issue guidance on defining "minimum necessary" with greater specificity, and while HHS has not issued a final rule on this provision, OCR has consistently enforced the standard through settlements and corrective action plans.

Regulatory Framework

Statutory and Regulatory Basis

• 45 CFR §164.502(b)(1): "When using or disclosing protected health information or when requesting protected health information from another covered entity or business associate, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request."
• 45 CFR §164.514(d): Implementation specifications for the minimum necessary standard
• HITECH Act §13405(b): Required HHS to issue guidance defining minimum necessary; pending final rule, the standard is applied as a reasonableness standard

Exceptions to Minimum Necessary — §164.502(b)(2)

The minimum necessary standard does NOT apply to: