1. Minimum Necessary Standard - When using, disclosing or requesting PHI, reasonable efforts must be made to use, disclose or request only the minimum amount necessary for the intended purpose.
  2. Exceptions - The minimum necessary standard does not apply when:
    1. The information is disclosed to or requested by a health care provider for treatment;
    2. The use or disclosure is authorized by the individual;
    3. The disclosure is made to the U.S. Department of Health and Human Services Office of Civil Rights, when investigating a complaint or conducting a compliance review under the federal HIPAA rule;
    4. The use or disclosure is required by law; and
    5. The use or disclosure is required for compliance with the federal HIPAA rules.
  3. Procedure - Determine the need for access - When you receive, request or store PHI, you must identify:
    1. Those persons or classes or persons in the workforce (which includes employees, volunteers, trainees, contractors and employees of contractors) who need access to PHI to carry out their duties; and
    2. The category or categories of PHI to which access is needed.
  4. Condition the access - You must establish appropriate conditions on access to PHI as determined by number 3 above to ensure that:
    1. Only staff with a need for access to PHI has such access; and
    2. Staff shall only have access to the categories of PHI needed to carry out their assigned duties.
  5. Limit requests - When requesting PHI from another entity, you must request only the information reasonably necessary for the purposes of the request. For example, CFC staff shall not request a child's entire medical record unless staff has determined that the entire record is needed for the intended purpose.
  6. Limit disclosures - When disclosing PHI to another entity, you must disclose only the information reasonably necessary for the purposes of the disclosure. For example, CFC staff shall not disclose a child's entire CFC file unless the request specifically indicates why the entire file is needed and the disclosure has been authorized by the child's parent or guardian or is otherwise permitted by law.