What is the HIPAA minimum necessary rule?

The HIPAA minimum necessary rule requires a covered entity or business associate to make reasonable efforts to limit protected health information (PHI) to the minimum necessary when using, disclosing, or requesting that PHI (45 CFR 164.502(b) and 164.514(d)).

The rule applies to every use, disclosure, and request of PHI, subject to the exceptions that the rule lists.

What does the minimum necessary rule require?

The minimum necessary rule requires a covered entity or business associate to make reasonable efforts to limit PHI to the minimum necessary, and the table below lists each requirement with its citation.

Which sections of 45 CFR cover the minimum necessary rule?

The minimum necessary rule is in 45 CFR 164.502(b). Section 164.502(b)(1) states the duty to make reasonable efforts to limit PHI, and section 164.502(b)(2) lists the exceptions. Section 164.514(d) sets the implementation requirements, and a covered entity must meet paragraphs (d)(2) through (d)(5) for any request for, or use or disclosure of, PHI. Paragraph (d)(2) covers uses, paragraph (d)(3) covers disclosures, and paragraph (d)(4) covers requests.

Does the minimum necessary rule apply to a small practice?

The minimum necessary rule applies to a covered entity or business associate, and the exceptions in 45 CFR 164.502(b)(2) include none based on practice size. A small practice that is a covered entity or business associate is subject to the same standard as a large one.

Which disclosures are exempt from the minimum necessary rule?

The minimum necessary rule does not apply to treatment disclosures or requests by a provider, to uses or disclosures to the individual, or to uses or disclosures under a 164.508 authorization. The rest of that list in 45 CFR 164.502(b)(2) names disclosures to the Secretary of HHS, uses or disclosures required by law under 164.512(a), and uses or disclosures required for compliance with the subchapter. Each of these exceptions removes the limit for that category of use or disclosure. The rule still applies to every use, disclosure, and request that none of these exceptions covers.

Does the minimum necessary rule apply when a patient asks for their own records?

The minimum necessary rule does not apply when a patient asks for their own records, because 45 CFR 164.502(b)(2) lists uses and disclosures to the individual as an exception. The same exception applies when the disclosure to the individual goes out by fax.

Can a practice rely on a requester's statement that a request is the minimum necessary?

A covered entity may rely on a requested disclosure as the minimum necessary when that reliance is reasonable under the circumstances and the conditions in 45 CFR 164.514(d)(3)(iii) are met. One example the rule gives is a public official's representation that the request is the minimum necessary.

How does the minimum necessary rule apply to faxing?

The minimum necessary rule applies to each fax that discloses or requests PHI, unless an exception in 45 CFR 164.502(b)(2) applies. A fax that discloses PHI falls under 164.514(d)(3), and a fax that requests PHI falls under 164.514(d)(4). For a fax that is not excepted, the covered entity makes reasonable efforts to limit the PHI in that fax to the minimum necessary. The exceptions in 45 CFR 164.502(b)(2) apply to a fax in the same way they apply to any other disclosure.

The cover sheet is covered separately in HIPAA fax cover sheet requirements. Records sent in reply to a request are covered in how to respond to a medical records request by fax. A fax that reaches the wrong recipient is covered in what to do when a fax goes to the wrong number under HIPAA.

* The regulation text was read at law.cornell.edu on October 13, 2026.