Minimum necessary (HIPAA)
Also called minimum necessary standard, minimum necessary rule.
The HIPAA rule that covered entities and business associates should use, share or request only the PHI needed for the purpose at hand.
Last updated
What it is.
45 CFR 164.502(b) says that when using or disclosing PHI, or requesting it from another covered entity or business associate, a covered entity or business associate must make reasonable efforts to limit it to the minimum necessary for the intended purpose.
There are exceptions, such as disclosures to a provider for treatment, disclosures to the patient, and uses the patient has authorised. For everything else, it is a design principle as much as a policy.
Why it matters
In software, minimum necessary shows up as role-based access, field-level permissions, filtered exports and APIs that return only the fields a caller needs. It reduces the damage of any breach and is one of the controls an auditor or customer will ask about.
In a product build
Minimum necessary is easiest to build in from the first wireframes, by deciding which roles see which fields on each screen, rather than retrofitting permissions after launch.
Common mistakes.
- 01
Giving every staff account full access because roles were left for later.
- 02
APIs that return the whole patient record when the caller needs two fields.
- 03
Sending full records to AI or analytics tools when a reduced or de-identified set would do.
Read the official text.
Primary sources this definition is based on.
- 45 CFR 164.502, Uses and disclosures of PHI (eCFR)checked 2026-10-25
- 45 CFR 164.514, De-identification of PHI (eCFR)checked 2026-10-25
Work it out with a tool.
Related terms.
- PHI (protected health information)Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate.
- Business associate (HIPAA)A person or company that creates, receives, keeps or sends protected health information on behalf of a HIPAA covered entity.
- ePHI (electronic protected health information)Protected health information that is stored or sent in electronic form, which is what the HIPAA Security Rule protects.
- Guardrails (AI)Checks placed around an AI model that block, fix or flag unsafe, off-topic or incorrect inputs and outputs.
Guides and pages
Browse the full glossary or read answers to common questions.
