The minimum necessary standard: who at the company sees plan information.
HIPAA asks a health plan to limit what it uses, shares and requests to the least amount needed for the purpose. For an employer, that turns into a practical question: who inside the company can see claims detail, and why.
How the standard works.
The Core Rule
Covered entities must take reasonable steps to limit uses, disclosures and requests of protected health information to the minimum needed for the intended purpose. For an employer-sponsored plan, this means staff should see only the health information their job requires. Ask counsel or a privacy adviser to help turn that idea into simple, written practices for your plan.
Policies Fit The Organization
HHS says each entity builds policies suited to its own operations, business practices and workforce, and reviews them to prevent unnecessary access. There is no single template, so a plan should write policies that describe how it really operates. Review them after any change in vendors, staffing or systems, and ask counsel to confirm they remain suitable.
Role-Based Access
Policies identify who needs access, which categories of information they need and the conditions of that access. If a role needs the whole record, the policy says so and why. A simple access chart showing each role, what it can see and why helps staff and auditors. Review it when people change jobs, and remove access that is no longer needed.
Routine And Non-Routine Requests
Recurring disclosures can follow a standard protocol. One-off requests are reviewed individually against criteria the entity sets in advance. Keep a short written protocol for repeating reports, and send unusual requests to a named reviewer. Counsel can help set the criteria that fit the plan, and a log helps show how decisions were made.
Putting it to work for your plan.
List Who Handles Plan Information
Write down the roles that touch claims or enrollment detail, such as HR, finance and the benefits team, and what each one actually needs. Include job titles and backups, note what each role can see and why, and review the list at least once a year. Counsel or a privacy adviser can help confirm that it reflects the plan’s actual practices.
Keep The Group Small
Limit claims-level detail to the people who administer the plan, and keep it apart from the personnel file. Consider separating plan files from general personnel files, using restricted folders and permissions, and reminding managers that they should not ask for or receive claims details. Counsel can advise on the details.
Set A Protocol For Routine Requests
Decide what a standard report from a carrier or administrator contains, so it does not include more than the task requires. Agree on the report format in writing with the carrier or administrator, and ask for summary figures where possible. Review the standard reports once a year to confirm they still contain only what is needed.
Review One-Off Requests
Give someone the job of reviewing unusual requests, such as a manager asking about an employee’s claim. Ask the reviewer to record what was asked, why it was needed and what was shared, and involve counsel for sensitive requests such as questions about a specific employee’s claims.
Where the standard does not apply.
Disclosures To The Individual
The standard does not apply when information goes to the person it is about. Staff should still confirm identity before releasing information to the person it concerns, and follow the plan’s access procedures. Counsel can confirm how this fits with the plan’s other rules.
Disclosures With Authorization
Uses and disclosures made under an individual’s authorization are outside the standard, because the person has agreed to that exact sharing. Staff should check that the authorization is signed, current and broad enough for the request, and share only what it covers. Counsel can help prepare the form and review unusual requests.
Disclosures Required By Law
The standard does not apply to disclosures required by other law, or to treatment disclosures to a provider. Staff should check with counsel before relying on a legal requirement, so they know the exact scope and share only what is required. A short note in the file records the basis for the disclosure.
Common Questions About The Minimum Necessary Standard
Does the standard stop HR from seeing any claims data?
It does not name specific job titles. It requires the plan to decide, in writing, who needs access to what and to limit access to that.
Can the plan rely on a request from a vendor?
Yes, within reason. HHS permits reasonable reliance when another covered entity, or a business associate, says its request is the minimum necessary. The plan keeps discretion to decide.
Does it apply to treatment?
No. Disclosures to or requests by a provider for treatment are exceptions.
What about information sent to the employee?
The standard does not apply to disclosures to the individual who is the subject of the information.
How does this relate to the plan sponsor rules?
They work together. The plan documents say what the sponsor may receive, and the minimum necessary standard limits how much is requested and who sees it.
Is this legal advice?
No. For a question specific to your company, involve your counsel. We can help you map who sees what and frame the questions.
Send us your renewal.
We’ll tell you whether it looks competitive, where we see opportunity, and the five questions we’d put to your carrier. No cost, and no obligation to move anything.
The renewal letter
Your current plan summary
Contribution split by tier
Enrolled counts by tier
Four documents — two more if your group is 50 or more. Nothing else; every extra one is a reason to postpone.
Laws and rules referenced
45 C.F.R. § 164.502 — General rules on uses and disclosures, including the minimum necessary standard.
This page is general information, not legal or tax advice. Rules change and facts matter, so confirm your situation with counsel or a qualified advisor.
An independent employee benefits consulting firm. We look at the entire benefits program: cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential: needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics: tell us which pages get read, so we know what is worth writing more of.
- Advertising: set by third parties such as ad and social platforms to measure and target campaigns.