Minimum Necessary:                   The Privacy Principle in Action

Access Only What You Need  

 Every time you access patient data, you are saying, "I need this to do my job." Even if your system allows access, that does not mean it is permitted. Workforce members are only permitted to view the minimum necessary PHI that is necessary for your role whether it’s oral, written, or electronic.

 When accessing patient information, ask yourself: 

• Do I need this information to do my job?
• Am I accessing only the minimum necessary to perform my duties?
• Would I be comfortable explaining this access in an audit? 

Role-based access, authorization controls, and audits help enforce the minimum necessary standard. But it is up to you to use access responsibly. 

Failure to apply the minimum necessary requirements may result in a violation and sanctions being applied. 

Reminders for Responsible Access 

Routine vs. Non-Routine Requests: 

Routine disclosures must follow standard protocols that limit PHI to what’s reasonably necessary. 

Non-routine disclosures require individual review using established criteria. 

Confidential Information belongs to the Company. That means: 

• Don’t share it with anyone who doesn’t have a need to know.
• Don’t use unauthorized channels like personal email or social media to discuss it. 

Never post confidential information even if it seems harmless or anonymized. 

When minimum necessary does not apply 

• Disclosures for treatment
• Requests by the individual
• HIPAA-compliant authorizations
• Requests by public officials or researchers with proper documentation
• Disclosures required by law 

Please reach out to your Facility Privacy Official (FPO) and Ethics & Compliance Officer (ECO) for questions and guidance. 

Announcements: 

Corporate Privacy Policies are currently unavailable through the Privacy Community SharePoint Site, as we are in the process of renumbering and relocating to the Ethics & Compliance SharePoint site. 

Facility Model Privacy Policies are currently still available on the Privacy Community SharePoint site. 

Should you need a copy of a Corporate Privacy Policy. Please contact the Corporate Privacy Department via the URGENT Privacy RI Message mailbox. 

We appreciate your patience during this transition and will notify you once access is restored. 

Looking for the latest updates from the Office for Civil Rights (OCR)? Visit the OCR Press Room for official news, enforcement actions, and policy updates, by clicking here.

 Email the URGENT Privacy RI Message mailbox.