02-Minimum Necessary

Approved by: William Voss	Effective: April 26, 2024
Review: Annual	Revised:
Renewed By:	Renewed:

---

Minimum Necessary Standard

Policy Statement

River City TMS, PLLC employs reasonable safeguards to limit a user’s access to only the protected health information (PHI) that is necessary for the workforce member to perform authorized job functions. Additionally, workforce members of River City TMS, PLLC will protect patient privacy by responding to requests for information with the least amount of information required to meet the intended purpose of the use, disclosure, or request.

Workforce members shall not access the protected health information (PHI) of any patient, including themselves, a coworker, a relative, or a friend that they do not require for the performance of their role(s) and responsibilities.

Procedure

• User Access Rules §164.524

  User access rights and privileges are based on their role or function to ensure they may access only the information necessary to perform the legitimate duties associated with the individual’s role. Access of patient information by staff for curiosity and personal business reasons is prohibited. River City TMS, PLLC’s role of business owner/ office manager will be responsible for reviewing and changing user access rights to ensure they are limited to information required by the user’s job functions.

• Routine Uses and Disclosures

  River City TMS, PLLC will ensure that workforce members comply to the minimum necessary standard for routine uses and disclosures of PHI related to treatment, associated payments, or health care operations for patient care. For all uses, disclosures, and requests, River City TMS, PLLC may not include an entire medical record, except when the use, disclosure, or request specifically requires it as reasonably necessary to accomplish the intended purpose. Workforce members will be trained, on ways they must limit the disclosures they make, through their security training and may face sanctions if they disclose more information than is required.

  Workforce members will be responsible for reviewing uses and disclosures prior to performing them, to ensure that only the minimum necessary amount of PHI is included for the specific purpose of the use, disclosure, or request. Workforce members should contact their office manager if they have any questions or concerns about specific disclosures.

• Requests for PHI §164.524

  River City TMS, PLLC will review non-routine requests for information on an individual basis, determine whether the PHI requested is the minimum necessary, and respond appropriately.

  • If a workforce member determines that it is necessary to use, disclose, or request an entire medical record for any purpose (except treatment), the individual must be able to justify the release of the entire medical record.

  • River City TMS, PLLC will not apply “minimum necessary” standards to requests for information from the patient, any disclosures required by the Secretary of the Department of Health and Human Services for the purpose of determining whether River City TMS, PLLC is compliant with HIPAA, nor any disclosures required by Federal, State, or local laws.

  • Any PHI or patient specimen being transferred or mailed should be placed in a sealed envelope or bag that restricts the view of the contained information. Whenever these packages are received with the seal broken, they will be investigated as a potential security incident.