{
  "schema": "upg.factor.v1",
  "exam": [
    "PTCE"
  ],
  "domain": "Federal Requirements",
  "confidence": 0.98,
  "updated_at": "2026-09-07",
  "token_cost_hint": 220,
  "integrity": "practice_only",
  "id": "ptce/federal/hipaa-minimum-necessary",
  "title": "HIPAA minimum necessary",
  "claim": "When using, disclosing, or requesting protected health information, a covered entity or business associate must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose \u2014 with listed exceptions (including treatment disclosures to/from a provider).",
  "plain": "Share only what the job needs. Treatment disclosures to another provider are carved out of minimum-necessary.",
  "citations": [
    {
      "authority": "45 CFR 164.502(b)",
      "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502",
      "pin": "164.502(b)(1)",
      "retrieved_at": "2026-09-07",
      "quote": "When using or disclosing protected health information or when requesting protected health information from another covered entity or business associate, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request."
    }
  ],
  "html": "/factors/ptce/federal/hipaa-minimum-necessary",
  "json": "/factors/ptce/federal/hipaa-minimum-necessary.json"
}