Medical Records and the Law

Minimum Necessary Rule 147necessary information to provide. This will require covered entities toreview against established criteria each such request individually as it ismade. 175 However, DHHS does not expect covered entities to restructure,upgrade, or redesign their existing facilities and computer systemsto meet the minimum necessary rule. 176The minimum necessary rule is a reasonableness standard, whichgives covered entities flexibility to address their unique circumstancesand make their own judgments as to what PHI is reasonably necessaryfor the purpose of the use or disclosure. Covered entities are not requiredto limit uses or disclosures of PHI to those that are absolutelyneeded to achieve the stated purpose. DHHS expects covered entitiesto approach disclosures of PHI consistent with the best practices andguidelines used by healthcare providers to limit the unnecessary disclosureof health information. The Privacy Rule is not intended to overrideprofessional judgment and standards with respect to preventinginappropriate access to such information. 177In some cases, covered entities may rely upon the determinations ofothers as to what PHI is minimally necessary for a particular use or disclosure.The Privacy Rule permits, but does not require, such reliancewhen the request for PHI is made by any of the following:• a public official for disclosures permitted by the rule• another covered entity• a person who provides professional services for the entity as a memberof its workforce or as a business associate (see the discussion ofbusiness associates later in this chapter)• a researcher with appropriate documentation from an institutionalreview board or privacy board (see the discussion concerning researchin Chapter 14) 178When requests are made by a public official or a professional, the coveredentity may rely upon the representations they make that the17545 C.F.R. § 164.514(d)(3)(ii).176U.S. Department of Health and Human Services, Standards for Privacy of IndividuallyIdentifiable Health Information (Dec. 3, 2002), 27, available at http://www.hhs.gov/ocr/hipaa/.177U.S. Department of Health and Human Services, First Guidance on New Patient PrivacyProtections (July 6, 2001), 17, available at http://www.hhs.gov/ocr/hipaa.17845 C.F.R. § 164.514(d)(3)(iii).