HITECH Act 13405b: Section 13405(b): limit uses, disclosures and requests to the limited data set or the minimum necessary, determined by the discloser

A covered entity complies with the minimum necessary standard of 45 CFR 164.502(b)(1) only if it limits protected health information, to the extent practicable, to the limited data set or, if it needs more, to the minimum necessary for the purpose, until the Secretary's guidance on minimum necessary supersedes that rule; the covered entity or business associate disclosing the information determines what is the minimum necessary; the 164.502(b)(2) exceptions continue to apply and de-identified information is unaffected.