Q&A: Minimum necessary standards for public health screenings

Q. What is the minimum necessary information that needs to be provided to people regarding HIPAA for public health screening environments?

A. If disclosures for public health screening fall in the category of treatment, the minimum necessary standard does not apply (it’s still a good idea to only disclose what is necessary as it relates to screening). If the disclosures fall under disclosures to public health agencies, often you can look to state statute and determine what is required to be disclosed to state public health agencies for public health activities. That would likely represent the minimum necessary standard for public health disclosures. If the disclosure falls into the category of healthcare operations, the rule of thumb is to only disclose what needs to be disclosed to satisfy that particular healthcare operations activity. OCR was required, pursuant to the HITECH Act, to define minimum necessary, but it has yet to do so.

Editor's note: This question was answer by Chris Apgar, CISSP. Apgar is president of Apgar & Associates, LLC, in Portland, Oregon. He is also a Briefings on HIPAA editorial advisory board member. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are that of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Editor Nicole Votta at nvotta@hcpro.com.