Key Takeaways
- The HIPAA minimum necessary rule says to limit uses, disclosures, and requests of client information to the minimum needed for the purpose.
- It applies to things like billing, insurance record requests, practice operations, and staff access.
- This rule doesn't apply in six situations, including sharing with other providers for treatment, sharing with the client, and sharing under a signed authorization (like an ROI).
- Even when the rule doesn't apply, professional ethics codes still ask you to share only what's relevant.
- Psychotherapy notes get extra protection and generally need the client's authorization before you share them.
- A quick "who, why, and how much" check before you share keeps you on solid ground.
Three requests land in your inbox on the same Tuesday.
An insurance reviewer wants "the complete record." A school counselor emails to ask, "How's she doing?" And your client's new psychiatrist wants to coordinate care.
Do they all get the same thing? Definitely not. Knowing how much to share with each one is what the HIPAA minimum necessary rule is all about.
Below, you'll find what the rule requires, when it applies, the six situations where it doesn't, and real-world examples for insurers, schools, and other providers.
What Is the Minimum Necessary Rule?
According to HHS, the HIPAA Privacy Rule requires covered entities to "take reasonable steps to limit the use or disclosure of, and requests for, protected health information to the minimum necessary to accomplish the intended purpose."
In plain English: share what's needed for the job, and nothing extra.
The rule covers three things:
- Uses: how client information is accessed and used inside your practice
- Disclosures: what you share with people outside your practice
- Requests: what you ask other organizations to send you
You'll find the minimum necessary standard in the Privacy Rule at 45 CFR 164.502(b) and 164.514(d). If you're a HIPAA covered entity, which includes most therapists who bill insurance electronically, it applies to you.
Want a refresher on the bigger picture? Our HIPAA compliance checklist for therapists covers the basics.
When the Minimum Necessary Standard Applies
For therapists, the rule shows up most often in a few places:
- Billing and insurance: responding to a plan's request for records, audits, and other payment-related requests
- Practice operations: quality reviews, billing services, and other vendors that handle client information for you
- Staff access: who on your team can see what in your records
- Your own requests: when you ask another organization for client information for a purpose other than treatment
HHS also splits disclosures into two types:
- Routine disclosures (like the same kind of insurance request you get every month) can follow a standard policy. You don't need to review each one individually.
- Non-routine disclosures (like an unusual one-off request) should be reviewed case by case.
And one big rule of thumb from HHS: when the minimum necessary standard applies, you shouldn't hand over the entire record unless it's specifically justified. "Send everything" is rarely the right default.
When the Minimum Necessary Standard Does Not Apply
This is the part that trips a lot of therapists up. HHS lists six situations where the minimum necessary standard doesn't apply. Here's what each looks like in a therapy practice:
That third one surprises a lot of therapists. When a client signs a release of information (ROI), the authorization itself defines what you can share. That's why writing a clear, specific ROI matters so much. Our guides to release of information best practices and when you need an ROI walk through the details.
"Doesn't Apply" Doesn't Mean "Send Everything"
Even when HIPAA's minimum necessary standard doesn't apply, your professional ethics still do.
The NASW Code of Ethics puts it clearly: "In all instances, social workers should disclose the least amount of confidential information necessary to achieve the desired purpose; only information that is directly relevant to the purpose for which the disclosure is made should be revealed."
Other professions' ethics codes have similar language, so check yours. Some states also have stricter rules for mental health records than HIPAA does, so it's worth knowing your state's requirements too.
Minimum Necessary Rule Examples for Therapists
Here's how the rule plays out with the people therapists share information with most.
Insurance Companies and Health Plans
Requests from insurers usually fall under payment, so the minimum necessary standard applies.
Routine claims are pretty straightforward. The claim format already spells out what's included, like the diagnosis code, CPT code, and dates of service.
Record requests and reviews take more thought. Say a plan asks for "all records" for a six-month utilization review. A reasonable response might be the intake assessment, the current treatment plan, and progress notes from those six months, not every document since the client's first session.
A few tips:
- Ask what's under review. Which dates? Which services? A quick clarification can shrink a big request fast.
- You can usually rely on the plan's request. HHS says you can reasonably rely on a request from another covered entity, like a health plan, as the minimum necessary. You still keep the discretion to make your own call.
- Leave psychotherapy notes out. More on those below.
Schools
Sharing with a school usually requires an authorization, from the client or from a parent or guardian when that's required for a minor. Since it's authorized, the minimum necessary standard doesn't technically apply. But schools rarely need clinical details, so keep both the ROI and what you share focused.
Schools often need things like:
- Confirmation that a student is in treatment
- Recommended accommodations
- Safety information that's relevant during the school day
What they usually don't need: diagnoses beyond what's required, trauma history, or session content.
There's another reason to keep it lean. According to HHS, student health information held by a school "generally is subject to the Family Educational Rights and Privacy Act (FERPA), not HIPAA." Once it's in the school's files, different rules apply.
Here's an example of a focused update (not about a real client):
"She's attending weekly sessions and working on managing anxiety. It may help if she can step out to the counseling office when she feels overwhelmed in class."
Other Providers
Sharing with other providers for treatment is one of the six exceptions. HHS guidance says HIPAA permits providers to share client information with other providers "for treatment, case management, and coordination of care."
Still, good coordination is focused coordination. A psychiatrist adjusting medication probably needs to know about symptoms, diagnosis, treatment response, and any safety concerns. They probably don't need a detailed account of every family conflict you've explored.
Two important caveats:
- Psychotherapy notes are different. They generally require the client's authorization, even when the other person is a provider.
- Substance use disorder records may have extra rules. Records from federally assisted substance use disorder programs fall under 42 CFR Part 2, which has its own requirements.
Family Members
When a family member or friend is involved in a client's care, HIPAA limits what you share. According to HHS, those disclosures "are to be limited to only the protected health information directly relevant to the person's involvement."
For example, a partner who drives the client to appointments might need scheduling information. They don't need to know what was discussed in session.
Courts, Attorneys, and Subpoenas
When a disclosure is required by law, like a court order, the minimum necessary standard doesn't apply. But you should share only what the law actually requires. Legal requests can get complicated fast, so it's smart to check with your liability insurer or an attorney before you respond. Our guide to what therapists have to report covers related obligations.
Minimum Necessary Inside Your Practice
The minimum necessary rule also covers who can see what is inside your practice.
HHS says your policies should identify which people (or roles) need access to client information to do their jobs, what kinds of information they need, and under what conditions.
In a group practice, that might look like:
- Billers: access to billing and insurance information, not session narratives
- Admin staff: access to scheduling and contact information
- Clinicians: access to the clinical records they need for the clients they treat
Running a solo practice? The rule still applies to your disclosures and requests. A short written policy for your routine situations, like insurance record requests and ROIs, goes a long way.
The same idea applies to vendors and tools. If a billing service or software tool doesn't need full session content to do its job, it shouldn't get it.
Psychotherapy Notes and the Minimum Necessary Rule
Psychotherapy notes have their own layer of protection. These are the separate notes some therapists keep about session content, apart from the main clinical record.
According to HHS, the Privacy Rule requires a covered entity to obtain a client's authorization before disclosing psychotherapy notes. So when an insurer asks for records, psychotherapy notes generally aren't part of the package.
Not sure what counts as a psychotherapy note versus a progress note? Our guide to psychotherapy notes vs. progress notes breaks it down.
What Happens If You Share More Than the Minimum Necessary?
Oversharing can turn an allowed disclosure into an impermissible one. And under HIPAA, that can trigger the breach rules.
According to HHS, an impermissible use or disclosure is presumed to be a breach unless you can show a low probability that the information was compromised. That determination is based on a risk assessment that looks at four factors:
- What information was involved, and how identifiable it is
- Who received it
- Whether it was actually acquired or viewed
- How much the risk has been reduced (for example, the recipient confirming they deleted it)
If it does count as a breach, affected clients must be notified without unreasonable delay and no later than 60 days after discovery.
Picture sending a full chart to an insurer when they asked for three months of notes, or emailing a school counselor a detailed treatment summary when they only needed accommodation recommendations. Both could land you in that risk assessment. That's a lot of stress for something a two-minute check could prevent.
If it happens, don't panic. Document what was sent, contact the recipient, and work through the risk assessment. Our article on HIPAA violation risks for therapists covers common pitfalls and how to avoid them.
How to Apply the Minimum Necessary Rule: A Quick Checklist
Before you share client information, run through these questions:
- Who's asking, and why? Treatment, payment, a school, a family member, a court?
- Does an exception apply? Treatment, the client, a signed authorization, or a legal requirement?
- If there's an authorization, what does it cover? Stay within its scope.
- What's the least they need? Could a short summary or letter work instead of records?
- Did you leave out what isn't needed? That includes psychotherapy notes and details that don't serve the purpose.
- Are you sending it securely? See our guides to HIPAA-compliant fax and HIPAA-compliant email.
- Did you document it? Note what you sent, to whom, when, and why.
Clear, well-organized notes make it much easier to pull only what's needed. Blueprint's AI-powered EHR helps therapists write session notes faster and track progress over time, so you can spend less time on admin and more time with clients. See how Blueprint works
Minimum Necessary Rule FAQ
What is the minimum necessary rule in simple terms?
It's the HIPAA rule that says to use, share, and request only the client information needed for a specific purpose, and nothing extra.
What is not required by HIPAA's minimum necessary rule?
The rule doesn't apply to six situations: disclosures to or requests by providers for treatment, disclosures to the client, disclosures under the client's authorization, disclosures required for HIPAA compliance, disclosures to HHS for enforcement, and disclosures required by other law.
Does the minimum necessary rule apply to treatment?
No. Sharing with other providers for treatment is an exception. Professional ethics still encourage sharing only what's relevant, and psychotherapy notes generally still need the client's authorization.
What happens if a therapist shares more than the minimum necessary?
It can be an impermissible disclosure. Under HIPAA's breach rules, that's presumed to be a breach unless a risk assessment shows a low probability the information was compromised.
Does the minimum necessary rule apply to insurance and billing?
Yes. Payment-related disclosures, like responding to a health plan's record request, fall under the minimum necessary standard.
Does the minimum necessary rule apply to a release of information?
No. When a client signs an authorization, the authorization defines what you can share. Keep ROIs specific, so you're not sharing more than the purpose requires.
What is the citation for the minimum necessary rule?
The minimum necessary standard is in the HIPAA Privacy Rule at 45 CFR 164.502(b) and 164.514(d).
Is there a new HIPAA rule in 2026?
The minimum necessary rule itself hasn't changed. Updated 42 CFR Part 2 rules for substance use disorder records had a compliance date of February 16, 2026. HHS also proposed updates to the HIPAA Security Rule in January 2025, but those haven't been finalized.
