"Minimum necessary" means that the laboratory will use and disclose only the minimum PHI necessary to accomplish its intended purpose. The regulation recognizes that there are situations when all of the PHI on a patient can be released. These include:
- When releasing PHI to another covered entity for treatment
- When releasing PHI to the individual who is the subject of the information
- When an individual has signed an authorization to release the PHI
- When required to do so by law
