Minimum Necessary Request, Use or Disclosure of Protected Health Information

Statement of Policy

Washington University and its member organizations (collectively, “Washington University” or “WU”) are committed to conducting business in compliance with all applicable laws, regulations and WU policies. As part of this commitment, WU has adopted a policy to ensure that it requests, Uses internally, or Discloses externally only the “Minimum Necessary” Protected Health Information (“PHI”) to accomplish an intended purpose.

Scope of Policy

The minimum necessary rule applies:
1) To all Requests by WU for PHI unless WU is requesting PHI for Treatment purposes;

2) To all Uses of PHI by WU except in the following situations:

a) Uses pursuant to an Authorization unless the Authorization is requested by WU for its own Use or is for PHI that was created for research that includes Treatment of the Individual (see WU HIPAA Policy on Authorization Required for Uses or Disclosures of Protected Health Information);
b) Uses required by law as long as the Use is limited to the relevant requirements of such law; and

3) To all Disclosures of PHI by WU except in the following situations: (see WU HIPAA Policy on Verbal/Inferred Agreement to Use or Disclosure Protected Health Information);

a) Disclosures to a Health Care Provider for purposes of Treatment of the Individual;
b) Disclosures that are Permitted or Required by the Privacy Regulations, such as Disclosures made under the regulations governing the Individual’s right to access or right to an accounting of PHI;
c) Disclosures to the Secretary of Health and Human Services for purposes of enforcing or ensuring compliance with the Privacy Regulations;
d) Disclosures required by law; or
e) Disclosures required by WU to ensure its compliance with applicable requirements of the Privacy Regulations.

Policy

1) Minimum Necessary Amount of PHI that can be Requested or Used.

Unless the foregoing exceptions are applicable, WU should limit its requests or Uses of PHI to the amount reasonably necessary to accomplish the purpose of the request or Use. For example, WU should not request an Individual’s entire medical record except when the entire medical record is specifically justified as the amount of PHI that is reasonably necessary to accomplish the purpose for which the PHI is requested.

2) Minimum Necessary Amount of PHI that can be Disclosed.

WU should limit its Disclosure of PHI to the amount reasonably necessary to accomplish the purpose of the Disclosure. WU should not Disclose an Individual’s entire medical record except when the entire medical record is specifically justified as the amount of PHI that is reasonably necessary to accomplish the purpose for which the Disclosure is sought. Unless its reliance would be unreasonable under the circumstances, WU may (but is not required to) rely upon the scope of a requested Disclosure as being the Minimum Necessary for the stated purpose in any of the following circumstances:

a) Requests to WU by public officials for Permitted Disclosures if the public official represents that the PHI requested is the minimum necessary for the stated purpose (see WU HIPAA Policy on Uses or Disclosures of Protected Health Information without Verbal or Written Authorization);
b) Requests to WU by another Covered Entity;
c) Requests to WU by a professional who is a member of WU’s Workforce or is a Business Associate of WU and the Disclosure is for the purpose of providing professional services to WU, if the professional represents that the PHI requested is the minimum necessary for the stated purpose (see WU HIPAA Policy on Verbal/Inferred Agreement to Uses or Discloses Protected Health Information without Verbal or Written Authorization); or
d) Requests to WU for research purposes and the person making the request has complied with all of the required documentation and representations for a Permitted Disclosure for such purposes.

3) Scope of Requests for PHI by WU.

a) For requests by WU for Treatment purposes, Minimum Necessary rule is not applicable. All PHI relevant to the Individual’s Treatment is determined necessary in the Health Care Provider’s reasonable professional judgment.
b) For requests by WU for purposes other than Treatment, Minimum Necessary rule does apply and is defined as the minimum amount of PHI that is reasonably required to accomplish the specific purpose of which the PHI is requested.

WU should review such requests on an individual, case-by-case basis to determine the types and amounts of information that constitute the Minimum Necessary PHI in each instance. Before making such a request, each Workforce member should consult with his/her Privacy Liaison for guidance in determining the appropriate types and amounts of PHI to be requested. If the WU Workforce member and his/her Privacy Liaison are unable to make such a determination, they should consult with the Privacy Officer for guidance

4) Scope of Uses of PHI by WU.

WU should only Use PHI in accordance with the “Use of Minimum Necessary PHI According to Position Title/Job Classification” chart attached to this Policy as Exhibit A. For each position title/job classification, the chart identifies the categories of PHI to which such persons need access to perform their job functions and any conditions and/or limitations placed upon such person’s access. WU should make reasonable efforts to ensure that the persons or classes of persons identified Exhibit A only access PHI in accordance with the limitations stated therein. Workforce members who hold more than one position title/job classification should only use an Individual’s PHI in accordance with that member’s job function being performed at the time he or she accesses the PHI.

5) Scope of Uses of PHI by WU.

Attached to this Policy as Exhibit B is a chart that lists situations in which WU Discloses PHI. This chart should be used by WU as a guideline in determining the types and amounts of PHI in each situation that constitute the Minimum Necessary PHI to accomplish the purpose of the Disclosure.

a) For any Disclosures that are not listed on Exhibit B, WU Workforce members should consult with his/her Privacy Liaison to determine the appropriate types and amounts of PHI to be Disclosed. If the WU Workforce member and his/her Privacy Liaison are unable to make such a determination, they should contact the Privacy Officer for guidance.
b) For Disclosures for purposes other than Treatment, WU should review requests for such Disclosures on an individual on a case-by-case basis to determine the amount of information that constitutes the Minimum Necessary PHI in each instance. Before making such a Disclosure, Workforce members should consult with their Privacy Liaison for guidance in determining the appropriate types and amounts of PHI to be Disclosed. If the WU Workforce member and his/her Privacy Liaison are unable to make such a determination, they should contact the Privacy Officer for assistance.

Creation Date: November 22, 2002
Effective Date: April 14, 2003
Last Revision Date: January 9, 2003

Exhibit A

Use of Minimum Necessary PHI According to Position Title/Job Classification

EXHIBIT B

Guidelines for Disclosures of PHI Based on Purpose of Disclosure