Minimum Necessary

Op10.03-5 Minimum Necessary

Applies to the Administrative Requirements of the Health Insurance Portability and Accountability Act of 1996. 45 CFR Section 164.514(d)

Policy

The Employee Benefit Plan and its Business Associates use, disclose, and request the minimum amount of Protected Health Information ("PHI") necessary to achieve the purpose of the use, disclosure, or request.

 

  • The Employee Benefit Plan identifies the individuals who need access to PHI according to the categories of uses for payment or health care operations.
  • The Employee Benefit Plan identifies the type and minimum amount of PHI needed to administer the plan.
  • The Employee Benefit Plan determines the circumstances under which individuals who perform plan functions may use PHI.
  • All individuals are required to use PHI in accordance with the determination made by the Employee Benefit Plan of the minimum amount necessary to effectively administer the plan.
  • When an individual performs more than one function of the Employee Benefit Plan, the types of PHI and conditions for access are dependent on the function that the member is performing.
  • Newly hired individuals who will perform plan administration functions are provided with information regarding their access to PHI during their initial training.

Procedure: Minimum Necessary Disclosure of PHI

Routine and recurring disclosures of PHI
  • The Employee Benefit Plan has identified disclosures of PHI it makes on a routine and recurring basis.
  • The Employee Benefit Plan has determined the minimum amount of PHI that is needed to achieve the purpose of these requests.
Non-routine disclosures of PHI
  • The Employee Benefit Plan reviews non-routine requests for disclosures of PHI that are subject to the minimum necessary standard on a case-by-case basis.
  • The request for disclosure is forwarded to the Assistant Director of Human Resources (or designee) to determine if the amount of PHI requested is the minimum necessary to achieve the purpose of the disclosure according to established criteria.
  • The Employee Benefit Plan relies on representations that the PHI requested is the minimum amount necessary if the request is from a public official for a permitted disclosure; a Health Care Provider, a Health Plan, or a Health Care Clearinghouse; or a professional providing services to the Employee Benefit Plan who is a Business Associate and who represents that the PHI requested is the minimum necessary.
  • When necessary or appropriate, the Assistant Director of Human Resources will speak with a representative from the entity making the request to get clarification and/or modifications.
Disclosures of entire medical record
  • The Employee Benefit Plan does not disclose a participant's entire medical record in fulfillment of any request subject to the minimum necessary standard for any reason unless a specific acceptable justification for such a disclosure is documented.

Procedure: Minimum Necessary Requests for PHI

Routine and recurring requests for PHI
  • The Employee Benefit Plan has identified requests for PHI it makes on a routine and recurring basis.
  • The Employee Benefit Plan has determined the minimum amount of PHI that is needed to achieve the purpose of these requests.
  • When the Employee Benefit Plan requests PHI, the Covered Entity to whom the request is made may rely on the Employee Benefit Plan's determination that the amount of PHI requested is the minimum necessary to achieve the purpose of the request.
Non-routine requests for PHI
  • The Employee Benefit Plan reviews the non-routine requests it makes for disclosures of PHI on a case-by-case basis.
  • The Privacy Official (or designee) reviews non-routine requests made by the Employee Benefit Plan for PHI from another Covered Entity to ensure that the amount of PHI requested is the minimum necessary to achieve the purpose of the request according to established criteria.
Requests for entire medical record
  • The Employee Benefit Plan does not request a participant's entire medical record for any purpose unless an acceptable justification for such a disclosure is documented.

Effective Date: April 14, 2003

Procedure: Minimum Necessary Use of PHI