4.1.B.1 HIPAA/Privacy: General Rules - Minimum Necessary Uses and Disclosure of PHI for Non-Routine Disclosure Policy

  • POLICY:

    When making routine and recurring disclosures of protected health information, or when making a routine and recurring request for protected health information, Lister Healthcare Corporation will limit the information disclosed or requested to the amount reasonably necessary to achieve the intended purpose. (CFR 164.514(d)(3)(i) and (4)(ii)

    Minimum necessary requirements, including the requirements set forth in this policy and procedure, will NOT apply to:

    • disclosures to or requests by a healthcare provider for treatment purposes.
    • authorized or required disclosures to a patient or a patient's representative.
    • uses or disclosures made pursuant to a valid authorization when the authorization is initiated by the patient or the patient's representative.
    • uses or disclosures to the Secretary of DHHS for enforcing the Privacy Rule.
    • uses or disclosures required by law.
    • uses or disclosures that are required for compliance with the regulations implementing the other administrative simplification provisions of HIPAA. (CFR 164.502(b)(2)

    PROCEDURE:

    • Limiting Routine and Recurring Disclosures and Requests.
      • When making routine and recurring disclosures of protected health information or when making a routine and recurring request for protected health information, Lister Healthcare Corporation will make reasonable efforts to limit the information disclosed to the amount reasonable necessary to achieve the purpose of the disclosure or request.  Individual review of each disclosure or request is not required. (C.F.R 164.514(d)(3)(i) and (4)(ii)
    • Minimum Necessary Assessment.
      • Lister Healthcare Corporation will make an assessment of the protected health information that is reasonably necessary for particular purposes and will, in an attachment to this policy and procedure, identify appropriate procedures for limiting routine and recurring disclosures and requests to the amount reasonable necessary to achieve their intended purpose. These procedures will take into account the characteristics of Lister Healthcare Corporation's business and workforce, and will reflect and be consistent with professional judgement and standards.
    • Reasonable Reliance Exception for Certain Disclosures.
      • Lister Healthcare Corporation may rely, if reasonable under the circumstances,on the amount requested as the minimum necessary when:
        • making disclosures to public officials for public health activities, to report abuse, neglect or domestic violence, for health oversight activities and as otherwise authorized or required without a patient's authorization if the public official represents that the information requested is the minimum necessary for the stated purpose(s).
        • the information is requested by another health care provider, health plan or other entity subject to the Privacy Rule's requirements; or
        • the information is requested by a professional who is a workforce member or business associate of Lister Healthcare Corporation for the purpose of providing professional services to Lister Healthcare Corporation, if the professional or business associate represents that the information requested is the minimum necessary for the stated purpose(s).
      • Reasonable reliance, however, is not required, and Lister Healthcare Corporation retains its discretion to question any request that it believes is not warranted or excessive, and to make its own minimum necessary determination for any disclosures that it makes. (CFR 164.514(d)(3)(iii)
    • Disclosing or Requesting an Entire Medical Record.
      • Lister Healthcare Corporation may not disclose or request an entire medical record, except when the entire medical record is specifically justified, as indicated in Lister Healthcare Corporation's privacy workforce directory or in a Lister Healthcare Corporation's policy and procedure, as the amount that is reasonably necessary to accomplish the purpose of the requested disclosure or request. (CFR 164.514(d)(5)

    Revised 12/2013

  • Date Format: MM slash DD slash YYYY