HIPAA Frequent Questions > Limited Use and Disclosure
Limited Use and Disclosure FAQs
Does the HIPAA Privacy Rule require that covered entities document all oral communications?
Incidental Uses
Can health care providers engage in confidential conversations with other providers or with patients, even if there is a possibility that they could be overheard?
Are covered entities required to document incidental disclosures permitted by the HIPAA Privacy Rule, in an accounting of disclosures provided to an individual?
Do the HIPAA Privacy Rule's provisions permitting certain incidental uses and disclosures apply only to treatment situations or discussions among health care providers?
Is a covered entity required to prevent any incidental use or disclosure of protected health information?
Limited Data Set
If the only protected health information a business associate receives is a limited data set, does the HIPAA Privacy Rule require the covered entity to enter into both a business associate agreement and data use agreement with the business associate?
Must a covered entity provide an accounting for disclosures if the only information disclosed to a public health authority is in the form of a limited data set?
Minimum Necessary
How are covered entities expected to detemine what is the minimum necessary information that can be used, disclosed, or requested for a particular purpose?
Won't the HIPAA Privacy Rule's minimum necessary restrictions impede the delivery of quality health care by preventing or hindering necessary exchanges of patient medical information among health care providers involved in treatment?
Do the HIPAA Privacy Rule's minimum necessary requirements prohibit medical residents, medical students, nursing students, and other medical trainees from accessing patient medical information in the course of their training?
Must the HIPAA Privacy Rule's minimum necessary standard to be applied to uses or disclosure that are authorized by an individual?
Are providers required to make a minimum necessary determination to disclose to Federal or State agencies, such as the Social Security Administration (SSA) or its affiliated agencies, for individuals' applications for Federal or State benefits?
Doesn't the HIPAA Privacy Rule minimum necessary standard conflict with the HIPAA transaction standards?
May a covered entity accept documentation of an external Institutional Review Board's (IRB) waiver of authorization for purposes of reasonably relying on the request as the minimum necessary?
Are business associates required to restrict their uses and disclosures to the minimum necessary? May a covered entity reasonably rely on a request from a covered entity's business associate as the minimum necessary?