"Minimum necessary" means that the laboratory will use and disclose only the minimum PHI necessary to accomplish its intended purpose, such as reporting the requested test results. The regulation recognizes situations when all of the PHI on a patient can be released. These include when:
- Releasing PHI to another covered entity for treatment
- Releasing PHI to the patient who is the subject of the information
- A patient has signed an authorization to release the PHI
- Required by law
