Should your support team see a patient's diagnosis? In most telehealth companies, no, because of the HIPAA minimum necessary rule. It asks covered entities to take reasonable steps to limit the use and disclosure of protected health information, and their requests for it, to the minimum needed for the purpose at hand.
A clinic with a front desk and an exam room has a few obvious roles. A telehealth company has more people near patient data who never treat anyone: support agents, fulfillment staff, billing, growth marketers, and engineers. The rule applies to what each of them sees, which makes it worth knowing which of your data is PHI in the first place.
What the Rule Requires, and Where It Doesn't Apply
The core requirement comes from 45 CFR 164.502(b) and 164.514(d): limit uses, disclosures, and requests to the minimum necessary. HHS's guidance on the minimum necessary requirement describes it as flexible enough "to accommodate the various circumstances of any covered entity," and says a covered entity "always retains discretion to make its own minimum necessary determination."
The standard does not apply to:
- Disclosures to or requests by a health care provider for treatment purposes
- Disclosures to the patient
- Uses or disclosures made under the patient's authorization
- Disclosures to HHS
- Uses or disclosures required by law
- Uses or disclosures required to comply with HIPAA's standard transactions
The treatment exception does a lot of work in telehealth. A clinician reviewing an intake form is providing treatment, and so is a pharmacy dispensing the prescription that follows. The rule's limits fall mostly on everyone else.
A Role Matrix for a Telehealth Company
The table below is an illustration, not a standard. Every company's roles are a little different, and the right answer depends on the job.
| Role | Usually needs | Usually doesn't need |
|---|
| Clinicians | Full intake answers, history, and visit notes | The rule doesn't limit disclosures for treatment |
| Pharmacy partner | Prescription and shipping details | The full intake history |
| Patient support | Order status, shipping status, account details | Diagnosis, intake answers, visit notes |
| Billing | Payment and plan details | Clinical notes |
| Marketing and growth | De-identified or aggregate data | Named patient records |
| Engineering and analytics | Access for a specific task, logged | Standing access to production patient data |
Clinicians work from the online intake and their own notes, and the pharmacy needs what it takes to fill and ship the prescription. In pharmacy fulfillment, that means the prescription and shipping address, while the questionnaire stays with the clinical team. Two other roles cause most of the trouble.
Patient Support
Support agents answer the questions patients ask most: where is my order, why was I charged, how do I change my address. None of those requires the diagnosis or the intake answers. The problem is that support tools often show the whole patient record on one screen. When choosing patient management software, check whether support views can be limited to order and account information, with clinical questions routed to a clinician.
Marketing and Growth
Growth teams want to know which campaigns bring patients who stay. They can usually learn that from de-identified or aggregate numbers: counts by channel, by program, by month. A named list of patients and their conditions is a different thing, and a CRM that holds both clinical and marketing data needs clear limits on who sees which. This guide to CRM setup for telehealth teams covers how to configure those limits.
Routine Requests and One-Off Requests
The rule treats repeated and unusual requests differently. For routine or recurring disclosures and requests, such as a pharmacy's standing need for prescription details, policies may be standard protocols. For non-routine requests, a covered entity must develop reasonable criteria and review each request individually against them.
A covered entity may reasonably rely on a request as the minimum necessary when it comes from a public official or agency, another covered entity, a workforce member or business associate in certain cases, or a researcher with documentation from an Institutional Review Board or Privacy Board. And when a purpose truly needs the entire medical record, HHS says the policies "must state so explicitly" and include the justification.
Setting Access in Practice
For uses inside the organization, HHS says policies must identify "persons or classes of persons within the covered entity who need access to the information," along with "the categories or types of protected health information needed, and conditions appropriate to such access." In practice, that becomes a written list of roles, what each role sees, and the controls that enforce it.
A 30-Minute Access Review
A regular review keeps the matrix accurate, and it fits in half an hour:
- List the roles that touch patient data.
- Export the current users of each system that holds it.
- Remove anyone who has left or changed jobs.
- Check which vendors and contractors still have access.
- Put the next review date on the calendar.
How Access Works on Bask
Fewer systems also means fewer user lists to review. On Bask, intake, visit notes, e-prescribing, and pharmacy fulfillment sit on one platform, and the roles in the matrix meet it at different points:
- Clinicians: Every Bask plan includes integrated doctor groups, and when those clinicians review a patient's questionnaire on the platform, that review is treatment, outside the standard.
- Pharmacy: The prescription goes from the platform's e-prescribing tools to a 503A or 503B pharmacy in its network, which ships the finished medication to the patient.
- Brand staff: Bask's security controls include two-factor authentication, a single place to manage user identities and connected devices, and system monitoring, logging, and alerting; the platform also keeps audit logs of who accessed what.
Those controls protect and record access. Deciding which people on a brand's team get which access is still the brand's call, and only the brand can answer that part of the rule.
FAQs
Does Minimum Necessary Apply to Doctors Treating a Patient?
No. Disclosures to or requests by a health care provider for treatment are outside the standard, so clinicians can see what they need to treat the patient.
Can Marketing Teams See Patient Data?
Marketing work can usually run on de-identified or aggregate data. If a marketing role needs identifiable information for a specific task, the policy should say what it can see and why.
What Is Not Covered by the Minimum Necessary Rule?
Treatment disclosures, disclosures to the patient, uses and disclosures under the patient's authorization, disclosures to HHS, uses and disclosures required by law, and those required for HIPAA's standard transactions. HHS answers related questions in its minimum necessary FAQs.
How Often Should Access Be Reviewed?
The minimum necessary guidance doesn't set an interval. Regular reviews, and reviews when someone changes roles or leaves, keep access aligned with the written policy.
References
- U.S. Department of Health and Human Services. (n.d.). Minimum necessary requirement. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html
- U.S. Department of Health and Human Services. (n.d.). Minimum necessary (FAQs). https://www.hhs.gov/hipaa/for-professionals/faq/minimum-necessary/index.html
