What does minimum necessary refer to?
Only the minimum necessary information can be used or disclosed. There are two important exceptions: minimum necessary does not apply when protective health information (PHI) is being used or disclosed for treatment purposes, or if there is an authorization for use and disclosure. Consequently, for research, the minimum necessary requirement does apply to situations in which a waiver of informed consent/authorization has been obtained, or a limited data set is used or disclosed. Note the minimum necessary standard does apply to limited data sets.
