# HIPAA Minimum Necessary — Standards and References

## Primary Legal Sources
- **45 CFR §164.502(b)** — Minimum necessary standard (general rule)
- **45 CFR §164.514(d)** — Implementation specifications for minimum necessary
- **45 CFR §164.514(d)(2)** — Uses of PHI by covered entity workforce
- **45 CFR §164.514(d)(3)** — Disclosures of and requests for PHI (routine, non-routine, reasonable reliance)
- **45 CFR §164.514(d)(4)** — Standard: minimum necessary for requests by covered entity
- **45 CFR §164.514(d)(5)** — Standard: minimum necessary for entire PHI
- **HITECH Act §13405(b)** — Enhancement to minimum necessary standard (limited dataset floor; HHS guidance directive)
- **78 FR 5566** — Omnibus Rule (minimum necessary applied to business associates)

## OCR Guidance
- **OCR FAQ on Minimum Necessary** — Frequently asked questions clarifying minimum necessary implementation
- **OCR Right of Access Initiative** — Enforcement actions noting minimum necessary does NOT apply to individual access
- **OCR Guidance on Business Associate Minimum Necessary** — BA obligations under the standard