Under HIPAA's Minimum Necessary Standard, covered entities must:
-
A
Share all PHI upon any patient request
-
B
Limit PHI disclosures to the least amount needed for the intended purpose
-
C
Obtain written authorization for all internal PHI use
-
D
Report all PHI disclosures to HHS within 24 hours