{"head":{"title":"What Is the HIPAA Minimum Necessary Standard? | OceanLab","description":"HIPAA's minimum necessary standard means using or sharing only the PHI a task needs. What it covers, its exceptions and how it shapes software.","canonical":"https://oceanlab.in/glossary/minimum-necessary"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"minimum necessary","path":"/glossary/minimum-necessary"}],"slug":"minimum-necessary","term":"Minimum necessary (HIPAA)","aka":["minimum necessary standard","minimum necessary rule"],"category":"Compliance","short":"The HIPAA rule that covered entities and business associates should use, share or request only the PHI needed for the purpose at hand.","body":[["45 CFR 164.502(b) says that when using or disclosing ",{"href":"/glossary/phi","text":"PHI"},", or requesting it from another covered entity or business associate, a covered entity or ",{"href":"/glossary/business-associate","text":"business associate"}," must make reasonable efforts to limit it to the minimum necessary for the intended purpose."],["There are exceptions, such as disclosures to a provider for treatment, disclosures to the patient, and uses the patient has authorised. For everything else, it is a design principle as much as a policy."]],"why":["In software, minimum necessary shows up as role-based access, field-level permissions, filtered exports and APIs that return only the fields a caller needs. It reduces the damage of any breach and is one of the controls an auditor or customer will ask about."],"example":["In a clinic system, front-desk staff see names, contact details and appointment times, but not clinical notes. The billing export includes codes and amounts but not the doctor's free-text notes. Both limits are built into the roles and the export, not left to staff judgement."],"inBuild":["Minimum necessary is easiest to build in from the first wireframes, by deciding which roles see which fields on each screen, rather than retrofitting permissions after launch."],"mistakes":[["Giving every staff account full access because roles were left for later."],["APIs that return the whole patient record when the caller needs two fields."],["Sending full records to AI or analytics tools when a reduced or de-identified set would do."]],"related":[{"href":"/glossary/phi","label":"PHI (protected health information)","detail":"Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate."},{"href":"/glossary/business-associate","label":"Business associate (HIPAA)","detail":"A person or company that creates, receives, keeps or sends protected health information on behalf of a HIPAA covered entity."},{"href":"/glossary/ephi","label":"ePHI (electronic protected health information)","detail":"Protected health information that is stored or sent in electronic form, which is what the HIPAA Security Rule protects."},{"href":"/glossary/guardrails","label":"Guardrails (AI)","detail":"Checks placed around an AI model that block, fix or flag unsafe, off-topic or incorrect inputs and outputs."}],"tools":[{"href":"/tools/hipaa-checklist","label":"HIPAA checklist","detail":"Free tool"},{"href":"/tools/hipaa-risk-assessment","label":"HIPAA risk assessment","detail":"Free tool"}],"links":[{"href":"/compliance/hipaa","label":"HIPAA guide","detail":"Who HIPAA applies to and what it asks of software."},{"href":"/software/clinics","label":"Software for clinics","detail":"Clinic systems, the rules that apply and how they are built."},{"href":"/build/ehr","label":"Building an EHR","detail":"Clinical records, access control and integrations."}],"sources":[{"title":"45 CFR 164.502, Uses and disclosures of PHI (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502","checkedAt":"2026-10-25"},{"title":"45 CFR 164.514, De-identification of PHI (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}