- Federal regulations provide that employees limit PHI to the minimum necessary to carry out the intended purpose of use, disclosure or request. In general, the minimum necessary does not apply to disclosures made to or authorized by the client. Consequently, staff must ensure that PHI is not unnecessarily or inappropriately accessed or disclosed. The following are examples:
- A pharmacy calls to verify an individual’s Medicaid number. The purpose is for providing a service to the client and for billing the state for those services. Giving the provider the client’s Medicaid number and eligibility dates gives the minimum necessary information. It would be inappropriate to share additional information such as the client’s Social Security Number, medical diagnosis and other PHI in this example.
- A FSD office receives a client’s medical records. The employee who is distributing the mail needs to verify from the incoming records which caseworker gets them. On the other hand, the caseworker needs to arrange and view all PHI. The intended purpose is to summarize the important PHI on the Social Information Summary and Disability Questionnaire form. The caseworker and the person who distributed the mail followed the minimum necessary use. However, it would be inappropriate for mailroom personnel to read the complete records.
- The minimum necessary does not apply in certain circumstances involving victims of abuse, neglect, or domestic violence, in certain legal proceedings, and in specific law enforcement purposes. If staff has a question involving disclosure of more than the minimum amount and it concerns situations named in this paragraph, contact the FSD privacy officer for guidance.
DSS Manuals Website