Last verified: October 2026, against 45 CFR 164.502(b) and 164.514(d) on eCFR. General information, not legal advice — confirm with your compliance officer or attorney.
The minimum necessary rule is HIPAA's "need to know" standard. When your practice uses patient information, shares it, or asks another provider or vendor for it, you must make reasonable efforts to limit it to the minimum needed for the purpose. For a practice manager, it is the rule behind three daily decisions: who on staff sees what, what a vendor receives, and what your website forms ask for.
In short: Under 45 CFR 164.502(b), practices must limit PHI to the minimum necessary for each use, disclosure or request. It doesn't apply to treatment disclosures between providers, to patients' own access, to authorized disclosures, or to disclosures required by law. Everything else, including vendors, marketing and staff access, should get less.
What the minimum necessary standard requires
The core sentence is in 45 CFR 164.502(b)(1) (opens in a new tab): "When using or disclosing protected health information or when requesting protected health information from another covered entity or business associate, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request."
Section 164.514(d) (opens in a new tab) turns that into four duties:
- Internal uses: identify which workforce members need access, to which categories of PHI, under what conditions, and limit their access accordingly.
- Routine disclosures: write standard protocols for disclosures you make over and over, such as sending records to a billing company.
- Non-routine disclosures and requests: set criteria and review each one individually.
- No whole records by default: you may not use, disclose or request "an entire medical record" unless the whole record is specifically justified.
The standard applies to everything that counts as PHI; if a detail sits on the line, check what counts as PHI first. The broader definitions are on our hub, what is PHI.
When it doesn't apply
The regulation lists six exceptions in 164.502(b)(2). Minimum necessary does not apply to:
- Disclosures to or requests by a health care provider for treatment.
- Uses or disclosures made to the individual, whether permitted or required, such as a patient's own records request.
- Uses or disclosures made under a valid authorization.
- Disclosures to the HHS Secretary for compliance investigations.
- Uses or disclosures required by law.
- Uses or disclosures required to comply with the HIPAA rules themselves.
Two more points soften the rule in practice. You may reasonably rely on the scope of a request from another covered entity, from a professional on your workforce or a business associate providing professional services, from public officials as permitted, or from researchers with the required documentation. And 164.502(a)(1)(iii) (opens in a new tab) permits incidental disclosures, like a name overheard at the front desk, if you've applied minimum necessary and reasonable safeguards.
Role-based access inside the practice
The internal-use rule is the easiest to document, and a small practice can fit it on one page.
| Role | Needs | Doesn't need |
|---|---|---|
| Front desk | Demographics, insurance, appointment type, balance due | Clinical notes, lab results |
| Billing | Codes, claims, payment history | Full visit notes, unless a claim requires them |
| Medical assistant | Vitals, medications, care plan for today's patients | Financial history |
| Clinician | Full chart for their patients | Practice-wide exports |
| Marketing coordinator | Aggregate counts, campaign results | Any individual patient records |
Then make the software match the page. The Security Rule asks for access authorization and termination procedures under 164.308(a)(3)–(4) (opens in a new tab). Our guide to Security Rule access controls covers unique logins, automatic logoff and audit logs.
Vendors and marketing: give them less
Vendors are where practices over-share most, usually for convenience. If a vendor creates, receives, maintains or transmits PHI for you, it is a business associate and needs a BAA; see what a business associate is. The BAA doesn't lift the minimum necessary duty. It only makes the sharing permissible.
Illustrative example: a fictional physical therapy clinic and its vendors.
Marketing agency. Asked for "the patient list so we can build a lookalike audience." Minimum necessary answer: monthly new-patient counts by source and service. No names, and nothing uploaded to an ad platform.
Web developer. Asked for "a few real form submissions to test the new layout." Answer: a staging form filled with fake data such as "Test Patient, 555-0100."
IT contractor. Needs admin access to fix the server, under a BAA, through a logged account that is removed when the job ends.
Review-response service. Gets the public review text only, never the appointment history behind it.
Designing forms that ask for less
The minimum necessary standard is written around uses, disclosures and requests to other organizations, but forms are where unnecessary PHI enters your systems. Every field you add must be secured, can be breached, and often flows to the form vendor, the email notification and the CRM. A short form is also simply easier to complete.
Copy this checklist for any website form:
- Name
- Phone or email, with the patient choosing the preferred method
- Preferred time to be contacted
- New or existing patient
- Service of interest, as a short list rather than a free-text "describe your symptoms" box
- No date of birth, insurance ID or medical history until intake inside your covered system
- Form notifications that say "New request received" without copying the answers into email
Clinical questions belong in intake, inside a system covered by a BAA. More on build options in HIPAA-compliant forms.
Minimum necessary and AI tools
Staff increasingly paste text into AI assistants. Apply the same test to every prompt:
- Does the task need patient details at all? Drafting a cancellation policy, a blog outline or an ad headline does not.
- If it does, is the tool covered by a BAA? If not, no PHI goes in.
- If it is, paste the minimum. Summarize "45-year-old with knee pain after a fall" rather than pasting the whole chart, and prefer properly de-identified text.
Our guide to AI tools and HIPAA lists which assistants offer BAAs.
Medfy's own design follows the rule. Its HIPAA-compliant forms send submissions to separate, encrypted HIPAA databases in the US or Canada, access is role-based with an audit log, and ad platforms never receive patient data. Read how Medfy handles patient data, or see what your current forms and tags share with a free marketing audit.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Does the minimum necessary rule apply to treatment?
Not to disclosures to, or requests by, a health care provider for treatment. A referral letter or a call with a specialist can include whatever the clinician judges relevant. The rule still applies to treatment-adjacent work that isn't a disclosure for treatment, such as which staff members may open which records inside your practice. Confirm how your role-based access policy handles clinical staff with your compliance officer or attorney.
What does minimum necessary mean for marketing vendors?
Give them the least patient information their job requires, which for most marketing work is none. An agency running ads needs lead counts by source and service, not names. A web developer needs a test form, not real submissions. If a vendor genuinely needs PHI, it must sign a business associate agreement first, and the request still has to be limited to what the task requires.
How should a practice limit staff access to PHI?
List each role, the categories of patient information that role needs, and any conditions, as 45 CFR 164.514(d)(2) requires. Then set your EHR, inbox and CRM permissions to match: front desk sees scheduling and contact details, billing sees claims, clinicians see charts. Review access when people change jobs or leave. Have your compliance officer or attorney review the written policy.
Is collecting extra form fields a HIPAA problem?
Not directly a minimum necessary violation, because the standard governs uses, disclosures and requests to other covered entities rather than what patients choose to type. But every extra field is PHI you must secure, it raises the stakes of any breach, and it often flows to more vendors. Ask only what a callback needs and move clinical questions to intake. Confirm form design with your compliance officer or attorney.