HIPAA Minimum Necessary Standard: Compliance and Penalties

The HIPAA minimum necessary standard, set out at 45 CFR 164.502(b), requires covered entities and business associates to make reasonable efforts to limit any use, disclosure of, or request for protected health information to the smallest amount needed to accomplish the purpose. If a billing clerk only needs a diagnosis code and an insurance ID to process a claim, that is all they should see, send, or ask for. The rule reaches nearly every routine handling of health data, with six specific exceptions.¹

What the Standard Requires

The core obligation is easy to state and harder to live by: never access, send, or request a whole record when a piece of it will do. A billing department processing an insurance claim does not need psychiatric notes. An employer asking for fitness-for-duty information does not need a full medical history. HHS expects covered entities to evaluate their own practices and tighten safeguards where unnecessary access is possible, and to keep doing so as workflows and technology change.²

Routine Versus Non-Routine Disclosures

The regulation splits disclosures into two categories, and getting this split right is where most compliance programs succeed or fail.

For routine, recurring disclosures, you must build standard protocols that pre-define what goes out. If your office sends records to insurers every day, a written policy should specify which data elements accompany each claim type. Staff should not be making case-by-case judgment calls on transactions they handle hundreds of times a month.³

For non-routine disclosures, the organization must develop criteria and apply them one request at a time. When an attorney sends a subpoena or a public health authority asks for records tied to a disease investigation, someone has to look at the specific ask and decide what is reasonably necessary to answer it.

Internal Access

Inside the organization, the covered entity has to identify which workforce members or job categories need access and what categories of information each role requires. Registration clerks need demographics and insurance data. Pharmacists need medications and allergies. An administrator running quality reports may need aggregate numbers but not individual identifiers. The rule requires you to map these access levels and then enforce them.²

When the Standard Does Not Apply

Six situations sit outside the minimum necessary standard. These carve-outs cover some of the most common exchanges of health information, so they are worth memorizing:

Disclosures to a healthcare provider for treatment. A surgeon consulting a cardiologist before an operation can review the full relevant record.
Disclosures to the patient. When you request your own records, the organization cannot withhold portions on minimum necessary grounds.
Disclosures made under a valid HIPAA authorization signed by the patient.
Disclosures to HHS for enforcement, including complaint investigations and compliance reviews.
Disclosures required by law, such as mandatory communicable disease reporting or a court order.
Uses and disclosures needed to comply with HIPAA’s own Administrative Simplification transaction and code set rules.

Everything else falls under the standard, including payment processing, healthcare operations, quality assurance, auditing, and most third-party requests.¹

Who Has to Comply

Two categories of organizations carry minimum necessary obligations.

Covered entities are health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically for standard transactions. In practice, that is hospitals, physician practices, pharmacies, health insurers, and government programs like Medicare and Medicaid.⁴

Business associates are outside organizations that handle protected health information on a covered entity’s behalf: billing companies, IT vendors with access to record systems, cloud storage providers, and consultants who review patient data. Every business associate relationship must be governed by a written Business Associate Agreement.²

Since the HITECH Act of 2009, business associates are directly liable for minimum necessary violations. HHS can pursue enforcement against a business associate on its own, without going through the covered entity.⁵

When You Can Rely on the Requester

The regulation lets a covered entity rely on a requester’s representation that the information asked for is the minimum necessary. Reasonable reliance is permitted when:

A public official, such as a public health authority or law enforcement officer, represents that the request is the minimum necessary for a stated purpose.
Another covered entity requests information for its own permitted purpose.
A workforce member or business associate states the request reflects the minimum necessary for professional services they are providing.
A researcher provides documentation from an Institutional Review Board or Privacy Board that meets HIPAA’s research provisions.

Reliance is not blind trust. If a request is obviously overbroad, or the stated purpose does not match the volume of information asked for, the disclosing entity should push back.³

How Organizations Comply in Practice

The rule asks for “reasonable efforts,” not a single prescribed method, so the specifics track the organization’s size and how it uses health information. A few strategies show up almost everywhere.

Role-Based Access Controls

The most direct way to enforce the standard is to restrict electronic health record access by job function. A front-desk scheduler sees appointment and contact information, not clinical notes. A treating physician sees the full clinical record. Federal EHR certification standards require certified systems to support user-specific access controls and role-based configuration.⁶

Written Policies and Training

Standard protocols for common transactions eliminate guesswork. A policy might say insurance verification requests include only the patient’s name, date of birth, insurance ID, and diagnosis code, with anything beyond that requiring supervisor approval. HIPAA also requires every covered entity to train all workforce members on privacy policies, retrain them when policies materially change, and document the training.⁷

De-Identification and Limited Data Sets

When identifiable data is not truly needed, de-identification takes the information out of HIPAA entirely. The safe harbor method requires removing 18 categories of identifiers, including names, dates more specific than year, geographic data smaller than a state, phone numbers, email addresses, Social Security numbers, medical record numbers, and biometrics. A limited data set sits between full identifiability and complete de-identification: most direct identifiers are stripped, but dates and city, state, and zip code can remain. Limited data sets can only be used for research, public health, and healthcare operations, and require a data use agreement with the recipient.³

Penalties for Violations

Minimum necessary failures are HIPAA violations. The HHS Office for Civil Rights handles civil enforcement, and the Department of Justice handles criminal referrals.

Civil Penalties

Civil penalties come in four tiers keyed to culpability. The inflation-adjusted amounts published in the January 2026 Federal Register are:

Did not know, and could not have known through reasonable diligence: $145 to $73,011 per violation, with an annual cap of $2,190,294.
Reasonable cause, not willful neglect: $1,461 to $73,011 per violation, same annual cap.
Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation, same annual cap.
Willful neglect, not corrected within 30 days: $73,011 to $2,190,294 per violation, same annual cap.

A single breach can involve thousands of individual violations, so per-violation amounts add up quickly. The annual cap of roughly $2.19 million applies separately to each tier.⁸

Criminal Penalties

Criminal prosecution targets individuals who knowingly obtain or disclose health information in violation of HIPAA. The tiers escalate with intent:

Knowing violation: up to $50,000 in fines and one year in prison.
Violation under false pretenses: up to $100,000 and five years.
Violation for commercial advantage, personal gain, or malicious harm: up to $250,000 and ten years.

These penalties apply to individuals, not just organizations. An employee who snoops through records out of curiosity, or sells patient information, can face personal prosecution.⁹

State Attorney General Actions

HITECH also authorized state attorneys general to bring civil actions on behalf of state residents for Privacy and Security Rule violations. An organization facing a minimum necessary violation can be dealing with federal OCR enforcement and a state-level lawsuit at the same time.¹⁰

Breach Notification When a Violation Exposes PHI

A minimum necessary failure that results in unauthorized access to unsecured protected health information may trigger HIPAA’s breach notification rules. The reporting timeline depends on how many people were affected:

500 or more individuals: notify HHS within 60 calendar days of discovering the breach, through the HHS online breach reporting portal.
Fewer than 500 individuals: notify HHS within 60 days after the end of the calendar year in which the breach was discovered, though earlier reporting is encouraged.

Affected individuals must also be notified, and breaches affecting 500 or more people in a single state or jurisdiction require media notification.¹¹

Patient Rights and Complaints

If you think a covered entity shared more of your health information than the situation required, you can file a complaint with the HHS Office for Civil Rights.¹²

You can also ask a covered entity to restrict how it uses or discloses your information for treatment, payment, or healthcare operations. The entity usually does not have to agree, with one exception: if you paid for a healthcare item or service entirely out of pocket, the provider must honor your request to withhold that information from your health plan when the disclosure would otherwise be for payment or healthcare operations purposes.¹³

1
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information
2
U.S. Department of Health & Human Services. Minimum Necessary Requirement
3
eCFR. 45 CFR 164.514 – Other Requirements Relating to Uses and Disclosures of Protected Health Information
4
HHS.gov. Summary of the HIPAA Privacy Rule
5
HHS.gov. Direct Liability of Business Associates
6
eCFR. ONC Certification Criteria for Health IT – Section 170.315
7
eCFR. 45 CFR 164.530 – Administrative Requirements
8
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
9
Office of the Law Revision Counsel. 42 U.S. Code 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
10
HHS.gov. State Attorneys General
11
HHS.gov. Submitting Notice of a Breach to the Secretary
12
HHS.gov. Filing with OCR
13
eCFR. 45 CFR 164.522 – Rights to Request Privacy Protection for Protected Health Information