The short answer
HIPAA’s minimum necessary standard requires covered entities and business associates to make reasonable efforts to limit PHI to the minimum necessary for the intended purpose of a use, disclosure or request. It doesn’t apply to disclosures to or requests by a health care provider for treatment, to the individual, under an authorisation, to HHS, where required by law, or where required to meet the rules themselves.1 Most AI uses outside direct treatment, such as billing, coding, prior authorisation, quality and analytics, fall under it. Design the tool so it requests and sends only the fields the task needs, and scope its access by role. This isn’t legal advice.
Deedglass
A sealed record you can check offline
Record 1043
- What ran
- Medication order, Bed 12
- Approved by
- Dr. N. Shah
- Check
- Matches
- Time
- 09:12
- The request
- Not keptA fingerprint only: 77d2…c41a
Each record is linked to the one before
- Record 1041
- Record 1042
- Record 1043
What the rule says
Two parts matter. The standard: reasonable efforts to limit PHI to the minimum necessary for the purpose.1 And for uses inside the organisation, the covered entity must identify the people or classes of people who need access to PHI and, for each, the categories of PHI they need and any conditions.1
| Doesn’t apply to | Example |
|---|---|
| Disclosures to or requests by a provider for treatment | A clinician’s AI assistant pulling a chart for the visit |
| Uses or disclosures to the individual | Patient portal assistant answering a patient about their own record |
| Under an authorisation | A patient-authorised research use |
| To HHS | Investigations |
| Required by law | Mandated reporting |
| Required to meet the rules | As the rule specifies |
Sources:1.
When it applies to AI
The rule follows the purpose, not the technology.
| AI use | Purpose | Minimum necessary? |
|---|---|---|
| Ambient scribe during a visit | Treatment | Generally no, for the treating provider’s use |
| Coding assistant | Payment | Yes |
| Prior authorisation agent | Payment | Yes |
| Denial appeal drafting | Payment | Yes |
| Quality dashboard summariser | Operations | Yes |
| Model evaluation on real records | Operations or research | Yes, or de-identify |
Even where treatment is the purpose, the vendor’s own handling (logs, analytics, model provider) has purposes of its own. Vendors handling PHI for a covered entity are generally business associates4, and the standard applies to business associates too.1
Why AI pulls the other way
Models answer better with more context, so the easy design is to send everything: the whole chart, every note, all history. A coding assistant doesn’t need the social history; a prior auth agent doesn’t need ten years of unrelated visits. Sending them anyway widens exposure in every place the data travels: the prompt, the provider’s logs, caches and traces.
Agents make this sharper. A chat assistant sees what a person pastes in. An agent with API access decides for itself what to fetch, and a model asked to be thorough will fetch more. Without limits below the model, “minimum necessary” depends on the model’s judgement about relevance on each request, which isn’t something you can document or test in advance. Limits set in scopes, field lists and database privileges are.
The standard says reasonable efforts, not zero context. The job is to make the narrow design the default, so a person has to choose to widen it.
Five design patterns
1. Scope access by role and resource. SMART v2 scopes name exact resource types and interactions, such as patient/Observation.rs, and can be narrowed with query parameters such as a category.3 Give each AI tool its own client with the narrowest scopes for its task.
2. Select fields before the model sees them. Build the prompt from named fields, not by dumping resources. A coding task might need diagnoses, procedures and dates of service, not contact details.
3. Hide columns at the database. If an agent queries a database, column-level privileges let a role read some columns and not others.5 Our column grants post shows the setup.
4. Mask or tokenise identifiers the task doesn’t need. Replace names and record numbers with tokens the tool can’t reverse; resolve them after, outside the model. Properly de-identified data isn’t PHI at all2, though most operational AI needs identifiable data at the end.
5. Log what was sent. Record which fields each request sent to a model, so a reviewer can check the minimum necessary claim against reality.
A worked example
A prior authorisation agent needs to submit an imaging request.
| Field | Needed? | Why |
|---|---|---|
| Patient name, date of birth, member id | Yes | Identify the member to the payer |
| Requested procedure and codes | Yes | The request itself |
| Relevant diagnoses | Yes | Medical necessity |
| Recent related notes | Some | Supporting documentation the payer asks for |
| Full medication list | Only if the payer’s criteria ask | Often not |
| Social history, unrelated visits | No | Not relevant to the request |
| Contact details, address | Usually no | The payer has them |
The default prompt carries the “Yes” rows. “Some” and “Only if” rows are added when the payer’s documentation rules call for them, and the addition is logged. That’s the pattern Da Vinci DTR encourages too: questionnaires ask for specific items rather than the whole chart.
Questions people ask
Does minimum necessary apply to AI scribes?
For the treating provider’s use during care, the treatment exception generally applies.1 The vendor’s other handling, such as logs and analytics, still deserves limits.
Is sending the whole chart to a model a violation?
It depends on the purpose. For non-treatment purposes, you need reasonable efforts to limit PHI to what’s necessary.1 Sending everything by default is hard to defend.
How do we show we followed it?
Document which roles and tools need which categories of PHI1, configure access to match, and keep logs of what was sent.
For how agent access can be limited and recorded, see our healthcare page and the provenance spec. To try approvals and read-backs on a real database in your browser, open the playground; to grade what an agent can reach on your own machine, run npx deedglass scan (the grade, explained).
Written with AI assistance and checked against our claims register.