The Department shall make reasonable efforts to limit the

·           protected health information (PHI) disclosed to the minimum necessary amount, or

·           the extent of information needed to accomplish the intended purpose of the use, disclosure, or request

·           the access to PHI to the category or categories of PHI to which access is needed and any conditions appropriate to such access.

The Department shall identify the staff in its workforce who needs access to PHI to carry out their duties.

If the Department receives a request to disclose PHI, it may assume that the information requested is the minimum necessary for the stated purpose when

·           making disclosures to officials that are permitted by law, if the official states that the information requested is the minimum necessary

·           the information is requested by another entity; e.g., health plan, hospital or a provider

·           the information is requested by a professional who is a Department employee or is a professional provider to the Department if the professional represents that the information requested is the minimum necessary, or

·           the documentation complies with the applicable requirements of the Institutional Review Board (IRB).

Cross- Reference: Policy 26-8-1, Institutional Review Board.

The Department may not use or disclose the entire medical record, except when the entire medical record is specifically justified as the amount that is reasonably necessary to accomplish the purpose of the use, disclosure or request.

Minimum necessary does not apply to

·           disclosures to, or requests by, a health care provider for treatment

·           any use or disclosure made to an individual, or

·           as required by law.