A Receptionist, a Spreadsheet, and 23,000 Patient Records

A front-desk employee at a mid-sized specialty clinic had access to every patient record in the EHR. Not because she needed it — because nobody had ever restricted it. When she downloaded a spreadsheet containing 23,000 records to "update mailing addresses," the organization discovered its minimum necessary policies existed only on paper.

I've seen this pattern dozens of times. The HIPAA minimum necessary standard is one of the most cited — and most violated — requirements in the Privacy Rule. And HHS OCR guidance on the topic couldn't be clearer. Yet organizations keep tripping over it because they confuse "having a policy" with "enforcing a practice."

This post breaks down what the minimum necessary standard actually requires, how OCR has enforced it, and the specific steps your organization should take in 2026 to stay on the right side of the rule.

What the HIPAA Minimum Necessary Standard Actually Says

The minimum necessary standard is codified at 45 CFR §164.502(b). It requires covered entities and business associates to make reasonable efforts to limit the use, disclosure, and request of protected health information (PHI) to the minimum amount necessary to accomplish the intended purpose.

In plain English: your staff should only access, use, or share the PHI they actually need for the task at hand. Not the entire chart. Not every field in the database. Just what's required.

When Minimum Necessary Applies — and When It Doesn't

This is where most organizations get confused. The standard applies to:

  • Uses and disclosures for payment operations
  • Uses and disclosures for healthcare operations
  • Requests to other covered entities for PHI
  • Disclosures to business associates

It does not apply to:

  • Disclosures to or requests by a healthcare provider for treatment purposes
  • Disclosures to the individual who is the subject of the PHI
  • Uses or disclosures authorized by the individual
  • Disclosures required by law or required for HHS compliance investigations

That treatment exception is critical. A referring physician can request and receive a full patient record for treatment without triggering minimum necessary. But your billing department pulling that same record? Different story.

HHS OCR Guidance: What the Regulators Actually Expect

HHS has published specific guidance on the minimum necessary standard through its official guidance page. OCR expects covered entities to implement policies that identify:

  • Which workforce members need access to PHI to perform their job functions
  • The specific categories or types of PHI those roles require
  • The conditions under which access is appropriate

For routine, recurring disclosures, OCR expects standard protocols — not case-by-case review. Your organization should have role-based access controls baked into your EHR and administrative systems. For non-routine disclosures, OCR expects individual review by a designated person who can apply judgment.

The Role-Based Access Model OCR Wants to See

In my experience, the organizations that get this right build role-based access into their systems from day one. A billing specialist sees billing-relevant fields. A nurse sees clinical information for patients on their unit. A front-desk coordinator sees scheduling data and demographics — not lab results or psychiatric notes.

This isn't aspirational. It's what OCR considers "reasonable." And when your EHR has the capability to restrict access by role and you choose not to configure it, that's exactly the kind of gap OCR investigators flag during compliance reviews.

The $5.55 Million Lesson from Memorial Healthcare System

In 2017, OCR settled with Memorial Healthcare System for $5.55 million after finding that the organization failed to implement procedures to restrict access to ePHI based on employees' job roles. Employees at affiliated physician practices had been accessing patient records in the health system's database without authorization — and the access went undetected for years.

The root cause wasn't a sophisticated hack. It was a failure to apply minimum necessary controls. The settlement agreement specifically cited the lack of audit controls and access restrictions as central violations. You can review the resolution agreement on HHS.gov.

That $5.55 million figure represents what happens when an organization knows it should restrict access and simply doesn't follow through.

Verbal Disclosures: The Minimum Necessary Gap Nobody Talks About

Most organizations think about minimum necessary in terms of EHR access and written disclosures. But the standard applies to verbal communications too.

I've walked through clinics where staff discuss patient diagnoses at the front desk within earshot of the waiting room. I've listened to phone calls where an employee reads an entire problem list to a caller who only needs to confirm an appointment date.

These are minimum necessary violations hiding in plain sight. Your workforce needs specific training on how to limit verbal disclosures of PHI to only what's necessary for the conversation. Our Verbal Disclosures: Watch What You Say course addresses exactly this scenario — teaching staff how to share what's needed without over-disclosing.

What Does Minimum Necessary Look Like for Phone Calls?

If a pharmacy calls to verify a prescription, your staff should confirm the specific prescription details — not volunteer the patient's full medication list, diagnosis, or treatment history. If an insurance company calls about a claim, provide the information relevant to that claim. Nothing more.

The test is simple: does the person I'm talking to need this specific piece of information to do what they're calling about? If the answer is no, don't share it.

How to Build a Minimum Necessary Program That Actually Works

Policies on paper won't protect you. Here's what I recommend to every organization I work with:

1. Conduct a PHI Access Inventory

Map every workforce role to the specific PHI categories it requires. This includes employees, volunteers, trainees, and contractors. Document why each role needs access and to what extent. Update this inventory annually or whenever job functions change.

2. Configure Role-Based Access Controls

Work with your IT team and EHR vendor to restrict system access by role. If your scheduling coordinator doesn't need to see clinical notes, remove that access. If your billing team doesn't need to see psychotherapy notes, block it at the system level.

3. Implement Audit Logging and Review

Access controls are only half the equation. You need to log who accesses what — and actually review those logs. Set up automated alerts for unusual access patterns, like an employee viewing records for patients not on their unit or schedule.

4. Train Your Workforce — Specifically and Repeatedly

Generic HIPAA training that spends two slides on minimum necessary doesn't cut it. Your staff needs scenario-based training that reflects their actual job functions. A medical records clerk faces different minimum necessary challenges than a case manager or a lab technician.

Browse our full course catalog for role-specific HIPAA training modules that address minimum necessary in practical, job-relevant terms.

5. Create a Non-Routine Disclosure Review Process

For one-off requests — subpoenas, law enforcement inquiries, public health reporting — designate a privacy officer or trained staff member to review each request and determine the minimum PHI necessary to fulfill it. Document the decision-making process every time.

Quick-Reference: What Is the HIPAA Minimum Necessary Standard?

The HIPAA minimum necessary standard requires covered entities and business associates to limit the use, disclosure, and request of protected health information to only the amount reasonably necessary to accomplish the intended purpose. It applies to most uses and disclosures of PHI except treatment, disclosures to the individual, and certain legally required disclosures. HHS OCR enforces this standard through audits, complaint investigations, and breach reviews — and penalties for non-compliance can reach millions of dollars.

Where Organizations Fail in 2026

The biggest mistake I see right now isn't a lack of awareness. It's a failure to operationalize. Organizations write minimum necessary into their Notice of Privacy Practices and their policy manuals. Then they hand every employee the keys to the entire database.

OCR doesn't care what your policy says if your practice contradicts it. In fact, having a policy you don't follow can make things worse during an investigation — it shows you knew the requirement and chose not to implement it.

The HIPAA minimum necessary standard isn't a suggestion. It's a regulatory requirement with teeth, and HHS OCR guidance makes the expectations specific enough that no covered entity can claim confusion.

Start with your access controls. Audit your logs. Train your people on real scenarios — including verbal disclosures that happen every day in every clinic. The minimum necessary standard protects your patients and your organization. But only if you actually enforce it.