Under HIPAA, the minimum necessary standard requires that covered entities make all “reasonable” efforts to limit the protected health information to the minimum necessary to accomplish the purpose of use of disclosure. Treatment is excluded from the standard.
