HIPAA Privacy Rule — Minimum Necessary Standard
Enforced by: HHS OCR (US)
Current as of March 26, 2013
Plain Language Summary
Only access the PHI you actually need. Employees should not have access to more patient data than their role requires.
A covered entity must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. This standard applies to all workforce members accessing PHI and to all requests for PHI disclosure to external parties.