The Minimum Necessary Standard
HIPAA's minimum necessary standard requires covered entities to make reasonable efforts to limit PHI use, disclosure, and requests to the minimum necessary to accomplish the intended purpose. This standard applies to most uses and disclosures of PHI — but not to disclosures for treatment, payment, or healthcare operations.
Permitted Uses and Disclosures of PHI
| Permitted Use/Disclosure | Authorization Required? | Notes |
|---|---|---|
| Treatment | No | Healthcare providers can share PHI for treatment without authorization |
| Payment | No | Plans can use PHI for claims processing without authorization |
| Healthcare operations | No | Quality improvement, compliance, and other operations |
| Plan sponsor (limited) | No (with plan document restrictions) | Employer can receive summary health information and enrollment data |
| Research | Usually no (with IRB approval) | De-identified data or limited data set |
| Marketing | Yes | Authorization required for most marketing uses |
| Sale of PHI | Yes | Authorization required |
De-Identification
De-identified health information is not PHI and is not subject to HIPAA. Information is de-identified if all 18 HIPAA identifiers are removed and the covered entity has no actual knowledge that the remaining information could be used to identify the individual.
Pro Tip
Employers can receive de-identified claims data from their TPA or carrier without HIPAA restrictions. De-identified data is sufficient for most plan management purposes — identifying cost drivers, evaluating programs, and benchmarking. Request de-identified data for population-level analysis and reserve PHI access for specific plan administration purposes.