Explain the HIPAA minimum necessary standard and how it limits uses, disclosures, and requests of protected health information.
Identify treatment, payment, and health care operations (TPO) uses and disclosures that are permitted without an individual's authorization.
Recognize the exceptions to the minimum necessary standard, including treatment disclosures, disclosures to the individual, authorized disclosures, disclosures to HHS, and disclosures required by law.
Apply role-based access, reasonable safeguards, and office policy to share only the information needed for a given task.
Distinguish activities that require a valid authorization (such as marketing and psychotherapy notes) from those permitted under TPO.