HIPAA Privacy Rule Minimum Necessary
In this week’s “Know The Rules!,” I am discussing the Privacy Rule minimum necessary standard, [45 CFR 164.502(b), 164.514(d)].
Minimum necessary applies:
When using or disclosing protected health information (PHI) or when requesting PHI from another Covered Entity (CE) or Business Associate (BA), a CE or BA must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure or request.
Here Is How the Rule Works
The Privacy Rule requires CEs and their BAs evaluate their practices and take reasonable steps to limit uses, disclosures, or requests of PHI.
The minimum necessary standard does not apply to the following:
- • Disclosures to or requests by a healthcare provider for treatment purposes.
- • Disclosures to the individual who is the subject of the information.
- • Uses or disclosures made following an individual’s authorization.
- • Uses or disclosures required for compliance with the Health Insurance Portability and Accountability Act (HIPAA) Administrative Simplification Rules.
- • Disclosures to the Department of Health and Human Services (HHS) when disclosure of information is required under the Privacy Rule for enforcement purposes.
- • Uses or disclosures that are required by other law.
CEs and BAs are required to develop and implement policies and procedures appropriate for their organization, reflecting the organizations business practices and workforce. Your policies and procedures must identify the persons or classes of persons who need access to the information to carry out their job duties, the categories or types of PHI needed, and conditions appropriate to such access.
What Does This Mean?
PHI should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function.
For example, hospitals may implement policies that permit doctors, nurses, or others involved in treatment to have access to the entire medical record, as needed. Likewise, for a small practice your receptionists should not have access to treatment records and nurses should not have access to patient financial data.
Covered Entities and Business Associates need to understand your patients are entrusting YOU with their most private and intimate details, they expect it to remain secure.
Don’t forget keeping your patient’s PHI secure IS your responsibility!
Besides, it is YOUR practice, YOUR patients, YOUR reputation, and YOUR legacy! Why are you leaving yourself wide open to such risks?
For tips like this and more request your copy of our “HIPAA Security Rule – Know The Rules!” Newsletter Today.