"Minimum necessary" means that the laboratory will use and disclose only the minimum PHI necessary to accomplish its intended purpose, such as reporting the results of the requested test. The regulation recognizes that there are situations when all of the PHI on a patient can be released. These include when:
- Releasing PHI to another covered entity for treatment
- Releasing PHI to the patient who is the subject of the information
- A patient has signed an authorization to release the PHI
- Required by law
