Written and maintained by CASRAI Editorial Board
Last updated
The HIPAA minimum necessary standard requires a covered entity or business associate to make reasonable efforts to limit protected health information (PHI) to the minimum necessary to accomplish the intended purpose of a use, disclosure or request. It is set out in 45 CFR 164.502(b), and the implementation requirements are in 45 CFR 164.514(d). It is a “reasonable efforts” standard, not a ban on sharing, and six listed situations are exempt from it.
This page walks through the regulation text paragraph by paragraph, as the regulation text stood on 2026-10-29, so you can see which paragraph governs uses, disclosures, requests and the entire medical record. For the identifiers that make information PHI in the first place, see the 18 HIPAA identifiers.
What the standard requires
Under 45 CFR 164.502(b), when a covered entity or business associate uses or discloses PHI, or requests PHI from another covered entity or business associate, it “must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.” The standard therefore has three triggers: uses inside the organization, disclosures to others, and requests made of others.
Section 164.514(d) turns that general rule into implementation requirements, one paragraph per trigger. The table maps each trigger to the paragraph that governs it.
| Situation | Governing paragraph | What it requires |
|---|---|---|
| Uses of PHI by the workforce | 164.514(d)(2) | Identify the persons or classes of persons in the workforce who need access, the categories of PHI each needs, and any conditions on access; make reasonable efforts to limit access to match. |
| Disclosures of PHI | 164.514(d)(3) | Routine and recurring disclosures follow policies and standard protocols that limit the PHI disclosed; other disclosures use criteria and individual review. |
| Requests for PHI | 164.514(d)(4) | Limit requests to what is reasonably necessary; routine requests follow protocols, other requests use criteria and review. |
| Entire medical record | 164.514(d)(5) | May not use, disclose or request an entire medical record unless it is specifically justified as the amount reasonably necessary. |
The six exceptions
Section 164.502(b)(2) states that the minimum necessary requirement does not apply to the following:
- Disclosures to or requests by a health care provider for treatment.
- Uses or disclosures made to the individual who is the subject of the information, under 164.502(a)(1)(i) or (a)(2)(i).
- Uses or disclosures made pursuant to an authorization under 164.508.
- Disclosures made to the Secretary of HHS under Part 160, subpart C.
- Uses or disclosures that are required by law, as described in 164.512(a).
- Uses or disclosures that are required for compliance with the HIPAA rules.
Read the first item carefully: the exception is worded as disclosures to, or requests by, a provider for treatment. Any other purpose, such as payment or health care operations, is not on the list.
Role-based access for uses
The use paragraph, 164.514(d)(2), is the origin of role-based access in HIPAA programs. A written role-access matrix that satisfies the paragraph has three columns: the workforce person or class of persons, the categories of PHI that person or class needs to do their job, and the conditions that apply to that access. The entity then makes reasonable efforts to limit access to match the matrix. Research systems follow the same logic: REDCap user rights and data access groups are one place where such a matrix gets enforced in practice.
Routine versus non-routine disclosures
Paragraph 164.514(d)(3) splits disclosures in two. For disclosures made on a routine and recurring basis, the entity implements policies and procedures, which may be standard protocols, that limit the PHI disclosed to the amount reasonably necessary for that type of disclosure. For all other disclosures, the entity develops criteria designed to limit the PHI to the minimum necessary and reviews each request individually against those criteria.
A subpoena response is a worked example of the second path. The permissive disclosure route in 164.512(e) is subject to minimum necessary, as covered in subpoena for medical records. A disclosure required by law under 164.512(a) is not.
Requests and reasonable reliance
Paragraph 164.514(d)(4) applies the same discipline to the entity that asks for PHI: limit the request to what is reasonably necessary for the purpose, use protocols for routine requests, and criteria plus review for the rest.
On the disclosing side, 164.514(d)(3) allows an entity to rely on a requester’s representation that it is asking for the minimum necessary in listed cases, for example where the requester is a public official, another covered entity, a professional who is a member of the entity’s own workforce or a business associate providing professional services, or a person requesting information for research who has provided documentation or representations that meet 164.512(i). The reliance is allowed only “if such reliance is reasonable under the circumstances,” so it is a judgement the entity still has to be able to defend.
The entire medical record rule
Paragraph 164.514(d)(5) says an entity “may not use, disclose or request an entire medical record” unless the entire record is specifically justified as the amount reasonably necessary to accomplish the purpose. A blanket “send the whole chart” practice therefore needs a stated, record-level justification, not a default.
Minimum necessary in research
For research, the first question is which route the data leaves the covered entity by, because the exceptions turn on it.
- Authorization route. Disclosures made pursuant to an authorization under 164.508 are on the exception list, so minimum necessary does not apply to them. What the authorization covers is set by its own required content.
- Waiver route. A disclosure made under a waiver or alteration of authorization is not among the six listed exceptions, so the entity should treat it as subject to the standard. See HIPAA waiver or alteration of authorization for research.
- Vendors and tools. When a business associate handles PHI, 164.502(b) applies to it directly as well. See business associate agreements for AI tools in research.
Information that falls outside the Privacy Rule altogether is a separate question; see PHI exemptions from the HIPAA Privacy Rule.
Common mistakes
Each of these follows directly from the text above.
- Treating minimum necessary as a disclosure-only rule. Section 164.502(b) covers uses and requests too, and 164.514(d)(2) and (d)(4) have their own requirements.
- Applying it to everything. Authorization-based and required-by-law disclosures are exempt, and over-redacting them is not what the regulation asks for.
- Giving every workforce member the same access. Paragraph (d)(2) asks for access matched to defined classes and categories of PHI.
- Reviewing routine disclosures one at a time, or sending non-routine ones with no criteria. Paragraph (d)(3) assigns protocols to the first and criteria with individual review to the second.
- Defaulting to the entire record without a recorded justification, contrary to (d)(5).
- Assuming that reliance on a requester is automatic. It must be reasonable under the circumstances.
Related regulatory paragraphs
| Paragraph | Subject |
|---|---|
| 45 CFR 164.502(a) | General rules for uses and disclosures; the individual-access exceptions in (b)(2) point back to (a)(1)(i) and (a)(2)(i). |
| 45 CFR 164.508 | Uses and disclosures for which an authorization is required; disclosures under it are exempt from minimum necessary. |
| 45 CFR 164.512(a) | Uses and disclosures required by law; exempt from minimum necessary. |
| 45 CFR 164.512(e) | Disclosures for judicial and administrative proceedings; a permissive disclosure here is subject to minimum necessary. |
Frequently asked questions
Does the minimum necessary standard apply to treatment?
Not to disclosures to or requests by a health care provider for treatment. That is the first exception in 164.502(b)(2).
Does it apply when a patient signs an authorization?
No. Uses and disclosures made pursuant to an authorization under 164.508 are on the exception list.
Can an entity ever disclose an entire medical record?
Yes, but only when the entire record is specifically justified as the amount reasonably necessary for the purpose, under 164.514(d)(5).
Does it apply to business associates?
Yes. Section 164.502(b) is addressed to covered entities and business associates alike.
Sources
- 45 CFR 164.502(b), minimum necessary: eCFR, 45 CFR 164.502 (text checked on 2026-10-29).
- 45 CFR 164.514(d), implementation requirements: eCFR, 45 CFR 164.514 (text checked on 2026-10-29).
The regulation text is described as it appeared on those dates; regulations can be amended, so check the current eCFR text for any decision that depends on it. This page is general information, not legal advice.
