Using the HIPAA Minimum Necessary Requirement
A key protection component of the HIPAA Privacy Rule is called the Minimum Necessary Requirement. This requirement establishes a standard that allows for only accessing PHI that is necessary. Accessing more than what is required can result in a HIPAA violation.
Best Practices for the Minimum Necessary Requirement
As a best practice, only ask for the information necessary to complete a task. For example, if you do not need to view the whole chart of an individual, do not ask for it. If you do, ensure that it is to provide the best care for that person. Additionally, the minimum necessary requirement of the HIPAA Privacy Rule does not allow you to access family or friends' information without authorization. Violating the minimum necessary requirement of the HIPAA Privacy Rule could result in penalties for you and your organization.
What is the Minimum Necessary Amount of PHI Needed?
Even if you have an individual’s written authorization for the use or disclosure of their PHI, HIPAA requires that only the minimum necessary amount of PHI is disclosed or used to accomplish the intended business purpose. This requirement does not apply to disclosures to healthcare providers for treatment or to disclosures to the individual, but, this provision applies to you as an employee.
Individuals are permitted to grant written authorizations to third parties so that they can access their PHI in accordance with the Minimum Necessary Requirement. Therefore, it needs to state who has access to the PHI, what PHI specifically they require, why and how they intend to use it, and when the authorization expires.
The minimum necessary requirement does not apply to disclosures to healthcare providers for treatment or to disclosures to the individual. This provision applies to you as an employee. As a best practice, do not ask for the whole patient chart if you do not need the whole chart from another organization. If you do, ensure this is to provide the best patient care. Snooping is not allowed. Just because you have access does not give you the right to access, when not necessary.
This restricts access to a certain time period. In addition to these, the written authorization should include HIPAA-required statements about re-disclosure. Let's look at a scenario where an individual sustained an injury and needed to disclose PHI to their lawyer.
According to the Minimum Necessary Requirement, individuals are allowed to give others access to their PHI in the form of a written authorization. The written authorization must include the "who, what, why, how, and when" involved in the disclosure. So it should include who has access to the PHI, what specific PHI they need access to, why and how they intend to use it, and the date the authorization will expire.
What to Include in Written Authorization
The "who, what, why, how, and when" associated with the disclosure has to be a part of the signed authorization from a patient. These specifics include:
Here are some myths to look out for:
- -
Who has access to the PHI
- -
What PHI specifically they require
- -
Why and how they plan to use it
- -
When the authorization expires
Improve Employee Security with HIPAA Workplace Training
HIPAA training provides many benefits for organizations and individuals. EasyLlama’s HIPAA courses help organizations become compliant with HIPAA regulations, which are designed to protect the privacy and security of patient information. Additionally, HIPAA training provides individuals with the knowledge they need to ensure they are following the appropriate guidelines when handling confidential patient information. This ensures that the data is kept secure and is only accessed by authorized personnel. Finally, HIPAA training can help organizations save money by teaching employees how to handle HIPAA data efficiently and securely.
Helping over 8,000+ organizations create a safer, more inclusive company culture.
EasyLlama’s online training course helps prepare employees to navigate HIPAA. This course provides an in-depth examination of how to respond to a breach of confidential data and the best way to protect your patients. The course covers:
Get more from EasyLlama
