Quick check
Guess first, no penalty. An insurer asks for records to support one claim for a knee X-ray. An AI tool offers to "export the full patient record". What do you send?
HIPAA is the US law that protects patients' health information. PHI (protected health information) is health information that can identify a patient.
The minimum necessary standard
HIPAA's minimum necessary standard says a covered entity must "make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request" (45 CFR 164.502(b)). The rule has exceptions, so follow your organization's release policy for what to send.
AI makes over-sharing easy. "Export everything" and "summarize the whole record" are one click, and they pull in far more than the request needs. So start from the request: what is it for, and which records answer it? The same habit helps inside an approved AI tool: give it only what the task needs.
Request: insurer, claim for right knee X-ray on 4 May.
Purpose: support that claim.
Send: the 4 May visit note, the X-ray order and the X-ray report.
Don't send: the rest of the record.
Checked against the release policy: yes.Fill the gaps
Fill the gaps in the same release note.
Note
Purpose: . Send: . Checked against .
Try it
Your steps, about 2 minutes
- 1.Add line 4 to your Record check sheet: "Share and paste only what the task needs." Then take one recent records request and write its purpose and send list in two lines.2 min