Do not be misled by complaining requestors under the wrongful claim of “Minimum Necessary” Violations.
Confrontational requestors may challenge the content provided in response to a records request because they don’t like the fee associated with issuance of records. The requestor may perceive the fee as being associated with the volume of information, or they don’t want to spend the time sifting through the data to find what’s relevant to them. Rest assured, a Covered Entity makes the determination of what constitutes their organization’s Minimum Necessary Policy, regardless of the questions and complaints of requestors.
As your healthcare data experts, ScanSTAT provides the following guidance to Covered Entities so you do not have to respond to or spend time appeasing disgruntled or misleading requestors. It is the Covered Entity (or trusted Business Associate) that holds the authority to develop its own policies and procedures to address the issue of Minimum Necessary.
So long as your organization is adhering to its policies, it is likely you are compliant with the applicable HIPAA provisions despite pushback from requestors to the contrary. Your organization is not required to spend hours sifting through the medical records and parsing out information in order to spare a requestor from spending the time to locate the information they deem relevant.
WHAT IS THE HIPAA MINIMUM NECESSARY STANDARD?
Covered Entities and Business Associates are required by the Standards for Privacy of Individually Identifiable Health Information (Privacy Rule)[1] to make reasonable efforts to limit the release of PHI to the minimum necessary to accomplish the intended purpose of the request,[2] often referred to as the “Minimum Necessary Standard.” It is designed to be flexible and places the authority with the Covered Entity to determine implementation.[3]
HOW DOES THE MINIMUM NECESSARY REQUIREMENT RULE WORK?
A healthcare organization must develop and implement policies and procedures that are appropriate for its organization and reflect the business practices and workforce. The organization’s policies and procedures must identify who needs access to PHI to carry out their job responsibilities, the categories of PHI needed and the conditions where access is appropriate. For example, a hospital can permit doctors, nurses or others involved in treatment to have access to the full medical record. Where the entire medical record is necessary, the organization’s policies and procedures must state so explicitly and include a justification.
When Does The Minimum Necessary Standard Not Apply?
- Healthcare providers making a request for treatment purposes
- Patients when making a request for their own records
- Requests with a valid authorization
- Requests required for compliance with HIPAA Administrative Simplification Rules
- HHS requests for disclosure of information required under the Privacy Rule for enforcement purposes
- When the request is otherwise required by law
WHO DECIDES WHAT IS MINIMUM NECESSARY?
A Covered Entity may rely on the judgment of its Business Associate as to the minimum amount of information needed for a reasonable request to disclose PHI. This is where we ask Covered Entities to defer to ScanSTAT and let us take on this burden. As a trusted Business Associate, we want to ensure we provide requestors with the right information. Covered Entities entrust us with PHI, and we have an obligation to disclose that information correctly. We have developed policies and procedures for implementing the Minimum Necessary Standard so our fulfillment of applicable requests are compliant with the Privacy Rule.
SCANSTAT & YOUR MINIMUM NECESSARY POLICY
At ScanSTAT, we aim to do what is in the best interest of our clients. It is ultimately the Covered Entity that determines whether to defer to our method of implementation or utilize their own minimum necessary policy. If a Covered Entity prefers to use its own method, we will certainly comply as the Privacy Rule dictates. The Covered Entity always has discretion to set its own standard for minimum necessary determination for disclosures.
Learn more by contacting our team of Healthcare Data Experts.
[1] 45 CFR Part 160 and Part 164, Subparts A and E
[2] 45 CFR 164.502(b)
[3] https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html