HIPAA minimum necessary

Claim

When using, disclosing, or requesting protected health information, a covered entity or business associate must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose — with listed exceptions (including treatment disclosures to/from a provider).

Plain

Share only what the job needs. Treatment disclosures to another provider are carved out of minimum-necessary.

Citations

1. 45 CFR 164.502(b) (164.502(b)(1)) — source
   

   When using or disclosing protected health information or when requesting protected health information from another covered entity or business associate, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

   retrieved 2026-09-07