Use and Disclosure of PHI

Back Next

Minimum Necessary

When PHI is used or disclosed, a reasonable effort must be made to limit the use or disclosure of PHI to the minimum amount necessary to accomplish the purpose of the permitted use or disclosure. This includes uses and disclosures made for the purposes of payment and healthcare operations.

Incidental Uses and Disclosures

The HIPAA Privacy Rule is not designed to keep healthcare providers from talking to each other or to their patients. Incidental uses or disclosures of PHI that occur as a result of an otherwise permitted use or disclosure are not considered violation of the HIPAA Privacy Rule provided that reasonable precautions are taken to safeguard the information. Reasonable precautions may include:

• speaking quietly when discussing a patient's condition with family members in a common area;

• avoiding use of a patient's name in public hallways and elevators;

• avoiding discussion of the patient's condition with bystanders.