- On October 5, 2026
A carrier sends you a large-claimant report. HR forwards a spreadsheet to “the benefits group.” An employee emails you an EOB and asks for help. All routine, but each one raises the same HIPAA question: did that person need that much information to do the job?
That’s the minimum necessary standard, one of the most practical (and most quietly violated) rules in the Privacy Rule.
The rule in one line: when PHI is used, disclosed, or requested, it has to be limited to what’s actually needed for the purpose. That third word, requested, is the one brokers forget. If a summary gets the job done, don’t ask for claim-level detail.
The narrow exceptions: provider treatment, disclosures to the individual, a signed authorization, disclosures to HHS, and disclosures required by law. Nearly everything else a broker does, including renewals, claims help, and plan-sponsor requests, falls inside the rule.
Three Places Brokers Slip Up
1. Renewal data: You usually don’t need names to market a plan. Ask for de-identified or summary health information. Watch out in small groups, though: “female, 50s, oncology, $410,000” can still identify someone in a 40-life company, even without a name attached.
2. The plan-sponsor firewall: The employer isn’t the plan. PHI can only move from the plan to the employer, as sponsor, for plan administration, after the plan document is amended and the right safeguards are certified under §164.504(f), and only to the specific people behind that firewall. Before anything lands in an HR inbox, ask who’s actually going to see it.
3. Claim advocacy: Helping an employee with a denied claim is good work, but it’s cleanest when the employee contacts you directly, or you get a signed authorization first. Share only what’s needed to solve the problem, not the full file.
Why It’s Worth Getting Right
OCR enforcement regularly includes minimum necessary violations, and the real risk usually isn’t the rule itself. It’s that oversharing turns a small mistake into a reportable breach. Information that shouldn’t have gone out is information you may now have to notify people about.
Three Things to Check This Week
- Look at your standard data requests. Cut any fields you don’t actually use.
- Default to de-identified or summary data for renewals and marketing.
- Keep a signed HIPAA authorization ready before helping with any employee’s claim.
Bottom line: Before you send or request PHI, ask what the job actually requires, and send only that.
This article is for general informational purposes only and is not legal advice. Brokers are not attorneys. Employers with specific HIPAA questions should consult qualified legal counsel.