1. (a) Scope and applicability. This policy applies to the Office of Health Information Technology, all participating entities, and their BAs and contractors.

2. (b) Requests.

   1. (1) Each participating entity shall request only the minimum amount of health information through the State Health Alliance for Records Exchange as is necessary for the intended purpose of the request.
   2. (2) The minimum necessary policy does not apply to requests by health care providers for treatment purposes.

3. (c) Uses and disclosures.

   1. (1) Each participating entity shall use and disclose only the minimum amount of health information obtained through the State Health Alliance for Records Exchange as is necessary for the purpose of each use or disclosure.
   2. (2) Each participating entity shall share health information obtained through the State Health Alliance for Records Exchange and allow access to such information only those workforce members, agents, and contractors who need the information in connection with their job functions or duties.
   3. (3) Disclosures to a health care provider for treatment purposes and disclosures required by law are not subject to this minimum necessary policy.
4. (d) Workforce, BAs, and contractors. Each participating entity shall adopt and apply policies to limit access to the State Health Alliance for Records Exchange to members of its workforce who qualify as authorized users and only to the extent needed by such authorized users to perform their job functions or duties for the participating entity.

5. (e) Entire medical record.

   1. (1) A participating entity shall not use, disclose, or request an individual's entire medical record except where justified as the amount that is reasonably necessary to accomplish the purpose of the use, disclosure, or request.
   2. (2) This limit does not apply to disclosures to or requests by a health care provider for treatment purposes or disclosures required by law.
6. (f) Application to providers for treatment purposes. While this minimum necessary policy is not required by HIPAA for providers accessing, using, and disclosing health information for treatment purposes, they are encouraged to follow it when consistent with treatment needs.
7. (g) Application to BAs and contractors. Participating entities shall make this policy applicable to their BAs and to the contractors and subcontractors of their BAs as they deem appropriate through the terms of their BA agreements.

Codification Notes: "HIPAA” means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191. "BA" means business associate.