Who determines what is the minimum necessary PHI for sharing with public health authorities?
Generally, the covered entity is responsible for determining the minimum amount of information reasonably needed to fulfill a request. In certain circumstances, however, the Privacy Rule permits a covered entity to rely on the judgment of the party requesting the disclosure as to the minimum amount of information that is needed. Such reliance must be reasonable under the particular circumstances of the request. This reliance is permitted, for example, when the request is made by a public official or agency for a disclosure permitted under §164.512 of the rule. §164.514(d) of the Rule describes this concept of reasonable reliance: “A covered entity may rely, if such reliance is reasonable under the circumstances, on a requested disclosure as the minimum necessary for the stated purpose when: (A) Making disclosures to public officials that are permitted under §164.512, if the public official represents that the information requested is the minimum necessary for the stated purpose(s); …
