# HIPAA Minimum Necessary Standard — Assessment Template

## Organization Information

| Field | Value |
|-------|-------|
| Organization Name | |
| Assessment Date | [YYYY-MM-DD] |
| Privacy Officer | [Name, Title] |
| Assessor | [Name, Title] |

---

## Role-Based Access Definitions (§164.514(d)(2))

| Workforce Role | PHI Categories Permitted | Justification | Last Reviewed |
|---------------|------------------------|---------------|---------------|
| | | | |

---

## Routine Disclosure Protocols (§164.514(d)(3)(i))

| Disclosure Type | Standard PHI Set | Excluded PHI | Protocol Document |
|----------------|-----------------|-------------|-------------------|
| Insurance eligibility verification | Name, DOB, Insurance ID, service dates | Clinical info, SSN | |
| Referral to external provider | Clinical summary, medications, allergies, reason for referral | Unrelated history, SUD records, psychotherapy notes | |
| Workers' compensation claim | Work-related injury/illness records only | Unrelated medical history | |
| Pre-authorization request | Proposed procedure, clinical justification, relevant diagnostics | Complete medical record | |
| Public health reporting | Required data elements per statute | Additional clinical detail | |

---

## Non-Routine Disclosure Review Criteria (§164.514(d)(3)(ii))

- [ ] All non-routine requests routed through HIM/Privacy Office
- [ ] Purpose of disclosure verified before determining scope
- [ ] PHI limited to minimum necessary for stated purpose
- [ ] Privacy Officer review required for sensitive categories
- [ ] Documentation retained for each non-routine disclosure

---

## Compliance Assessment

| Area | Compliant | Finding |
|------|-----------|---------|
| Role-based access policies documented | [ ] | |
| Access profiles match role definitions | [ ] | |
| Quarterly access reviews conducted | [ ] | |
| Routine disclosure protocols documented | [ ] | |
| Non-routine review criteria established | [ ] | |
| Reasonable reliance policies documented | [ ] | |
| Minimum necessary exceptions properly identified | [ ] | |
| Workforce training includes minimum necessary | [ ] | |

---

## Approval

| Role | Name | Date |
|------|------|------|
| Privacy Officer | | |
| CISO | | |