Why accessing only what you need is one of the most important habits your team can build
July 2nd, 2026
By: Laura Manser, CPC, CPCO, CDEO, CIRCC, CPMA, CEMC, RCC, Director of Provider Education
Every day, revenue cycle management professionals interact with patient information in billing systems, on screens, and across the workflows that keep their organizations running. In our industry, access to protected health information (PHI) is simply part of the job. But having access to information is not the same as having permission to use all of it, and that distinction is at the heart of one of HIPAA’s most practical and most frequently overlooked requirements: the Minimum Necessary Standard.
What Does “Minimum Necessary” Actually Mean?
The HIPAA Privacy Rule, at 45 CFR § 164.502(b) with implementation specifications at § 164.514(d), requires covered entities and business associates to make reasonable efforts to limit the PHI they use, disclose, or request to the minimum necessary to accomplish the intended purpose. In plain terms: if you do not need it for the task in front of you, you should not be looking at it.
For workforce members, this applies to pulling up a patient record out of curiosity, sharing more information than necessary when communicating with a payer, or accessing accounts that fall outside a normal workflow. It is worth noting that the standard does not apply to every situation; disclosures to or requests by a health care provider for treatment, disclosures to the individual, uses or disclosures made pursuant to a valid authorization, disclosures to the Secretary of HHS, and uses or disclosures required by law are all excepted. For nearly everything a billing company touches day to day, however, minimum necessary is the operating rule.
This is not about distrust. It is about building habits that protect patients, clients, and our organizations every single day. When an employee pauses and asks, “Do I actually need this information to complete my task?”, they are already doing it right.
Why It Matters in Revenue Cycle Management
In a billing environment, it can feel natural to pull a full patient record when only one piece of it is needed, or to look up a case simply because a name is recognized. Those small moments add up. Regulators and auditors pay close attention to access logs, and unexplained or unnecessary access to PHI, even without any intent to misuse it, can trigger reviews and put both the employee and the organization at risk.
There is an additional reason this standard deserves attention from billing companies specifically: as business associates, we are directly liable under the HITECH Act and the 2013 Omnibus Rule for failing to limit uses and disclosures of PHI to the minimum necessary. This is not an obligation that flows only through our business associate agreements; it is enforceable against us directly.
Making the Standard Operational
The good news is that compliance here is largely about awareness, supported by a few structural practices that the Privacy Rule itself points to:
- Role-based access. Identify the classes of workforce members who need access to PHI, the categories of PHI they need, and any conditions appropriate to that access, then configure systems to match.
- Standard protocols for routine disclosures. For recurring disclosures and requests, such as claim submissions and payer correspondence, define in advance what information is reasonably necessary and limit to that.
- Case-by-case review for non-routine requests. Develop criteria for evaluating one-off disclosures and requests against the minimum necessary standard.
- Periodic access reviews. Audit logs are only useful if someone looks at them; routine reviews catch drift before a regulator does.
Training that uses real workflow examples. Abstract policy language rarely changes behavior; a coder or AR specialist recognizing their own daily tasks in a training scenario does.
A Shared Responsibility
Following the Minimum Necessary Standard is something every person on a team contributes to, regardless of role or tenure. If an employee is ever unsure whether accessing certain information is appropriate for what they are working on, that is exactly the kind of question to bring to a supervisor or to compliance directly. There is no such thing as a small question when it comes to protecting the patients we serve.
Note: This article was originally shared in HBMA’s The Brief: RCM Compliance and Ethics Quick Takes Newsletter.
Laura Manser turns complexity into clarity. As Director of Provider Education at PBS Radiology Business Experts, she brings over 25 years of radiology expertise to one of the most specialized roles in the industry, bridging the gap between clinical documentation and coding accuracy, compliance, and revenue performance.
A nationally recognized radiology subject matter expert, Laura holds one of the most comprehensive credentialing portfolios in radiology coding, with certifications from both AAPC and RCCB spanning coding, auditing, compliance, documentation improvement, and evaluation and management. This breadth positions her to see the full picture, and to teach it effectively.
Laura designs and delivers targeted education programs for coders and physicians alike, equipping teams with the knowledge to improve documentation quality, reduce compliance risk, and optimize reimbursement. Her proactive leadership, dedication to continuous improvement, and deep commitment to excellence make her a trusted partner to providers and practices navigating the ever-evolving landscape of radiology coding and compliance.