HIPAA principle (45 CFR §164.502(b)) requiring use/disclosure of only the minimum PHI needed for the purpose.
The Minimum Necessary Standard requires covered entities and business associates to make reasonable efforts to use, disclose, or request only the minimum PHI needed to accomplish the intended purpose. Exceptions apply for treatment, individual's own request, HHS, and legally required disclosures.
Run a free ComplianceIQ audit against HIPAA and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.