OAR 407-014-0040
Minimum Necessary Standards
(1)
The Department shall limit the use and disclosure of protected information to that which is reasonably necessary to accomplish the intended purpose of the use or disclosure which is referred to in these rules as the minimum necessary standard.(2)
This minimum necessary standard is not intended to impede essential Department activities.(3)
The minimum necessary standard applies:(a)
When using protected information within the Department;(b)
When disclosing protected information to a third party in response to a request; or(c)
When requesting protected information from another covered entity.(4)
The minimum necessary standard does not apply to:(a)
Disclosures to or requests by a health care provider for treatment;(b)
Disclosures made to the individual, including disclosures made in response to a request for access or an accounting;(c)
Disclosures made with a valid authorization;(d)
Disclosures made to DHHS for the purposes of compliance and enforcement of federal regulations under 45 CFR part 160 and required for compliance with 45 CFR part 164; or(e)
Uses and disclosures required by law;(5)
When requesting protected information about an individual from another entity, the Department shall limit requests to those that are reasonably necessary to accomplish the purposes for which the request is made. The Department shall not request a person’s entire medical record unless the Department can specifically justify the need for the entire medical record.
Source:
Rule 407-014-0040 — Minimum Necessary Standards, https://secure.sos.state.or.us/oard/view.action?ruleNumber=407-014-0040.