Common use of Minimum Necessary Uses and Disclosures Clause in Contracts

Minimum Necessary Uses and Disclosures. 1. When requesting, Using, or Disclosing PHI, the AGO will take reasonable steps to help ensure that it requests and uses PHI to the minimum extent necessary to accomplish the intended purpose of the request, Use, or Disclosure. 42 C.F.R. §164.502(b)(1). Whenever possible, the AGO will Use or Disclose only a Limited Data Set, as that term is defined in 45 C.F.R. §164.514(e)(2). 2. This policy does not limit the AGO’s ability to Use or Disclose PHI regarding: i. Disclosures to or requests by a health care provider for Treatment; ii. Uses or disclosures made to an individual who is the subject of the PHI being used or disclosed, including requests by an individual requesting copies of his PHI under 45 C.F.R. §164.524 or an accounting of the uses and disclosures of his PHI within the previous 6 years, under 45 C.F.R. §164.528; iii. Uses or disclosures made pursuant to a written, HIPAA-compliant authorization for the release of PHI, under 45 C.F.R. §164.508. When an individual authorizes the AGO to Use or Disclose of PHI, the AGO’s ability to Use and Disclose PHI will be determined by the authorization; iv. Disclosures of PHI made to the Secretary of the Dept. of Health and Human Services for the purpose of investigating and determining compliance with HIPAA under 45 C.F.R. §§160.300 through 160.316; v. Uses or Disclosures of PHI that are required by law under 45 C.F.R. §164.512(a); or

Minimum Necessary Uses and Disclosures. 1. When requesting, Using, or Disclosing PHI, the AGO will take reasonable steps to help ensure that it requests and uses PHI to the minimum extent necessary to accomplish the intended purpose of the request, Use, or Disclosure. 42 C.F.R. §164.502(b)(1). Whenever possible, the AGO will Use or Disclose only a Limited Data Set, as that term is defined in 45 C.F.R. §164.514(e)(2). 2. This policy does not limit the AGO’s ability to Use or Disclose PHI regarding: i. Disclosures to or requests by a health care provider for Treatment; ii. Uses or disclosures made to an individual who is the subject of the PHI being used or disclosed, including requests by an individual requesting copies of his PHI under 45 C.F.R. §164.524 or an accounting of the uses and disclosures of his PHI within the previous 6 years, under 45 C.F.R. §164.528; iii. Uses or disclosures made pursuant to a written, HIPAA-compliant authorization for the release of PHI, under 45 C.F.R. §164.508. When an individual authorizes the AGO to Use or Disclose of PHI, the AGO’s ability to Use and Disclose PHI will be determined by the authorization; iv. Disclosures of PHI made to the Secretary of the Dept. of Health and Human Services for the purpose of investigating and determining compliance with HIPAA under 45 C.F.R. §§160.300 through 160.316; ; v. Uses or Disclosures of PHI that are required by law under 45 C.F.R. §164.512(a); or vi. Uses and Disclosures of PHI that are required to comply with the HIPAA Rules. 3. Upon request and written agreement, the AGO shall comply with the a minimum-necessary policy of a covered entity with which the AGO has a Business Associate agreement, if that policy is more stringent than the AGO’s minimum-necessary policy. 4. The AGO will take reasonable steps to help ensure that PHI is shared only with individuals who need access to the PHI to perform their jobs. 5. AGO Sections that routinely handle PHI will achieve this goal by establishing protocols that define the minimum amount of PHI necessary for routine Uses, Disclosures, and requests. Example 1 – Attorney X works in the Health & Human Services Section and represents the Ohio Medicaid program. Attorney X routinely has cases and other matters that involve PHI. Attorney X is assigned to defend against a new lawsuit filed against the Medicaid program. Defense of the case will require the Use of PHI. Pursuant to the Section’s written protocols, when the Document Management System workspace for the case is created, only attorneys and administrative staff in the Health & Human Services Section to access the workspace. Attorney X will secure hard copies of all PHI by placing them in a locked file cabinet when not in use. Later in the case, Attorneys X and Y receive discovery from their client that includes PHI. The discovery (including the PHI) is loaded into the Review Platform for review and production. Pursuant to the Section’s written protocols, the only people who have permission to review this information in the Review Platform are other individuals in the Health & Human Services Section. Example 2 – Employee Z is a non-attorney who works in the Collections Enforcement Section. He receives calls that might involve a wide variety of collection matters, including those involving PHI. Pursuant to the Section’s written protocols, Employee Z has access to all collection matters in the Debt Collection System computer system, including those involving PHI, because he does not know which matters he might be called about.