However, disclosures of protected health information to, or requests by, providers for treatment are exempt from the minimum necessary standard. The exemption of treatment by providers from the minimum necessary standard is certainly a benefit for providers. We are pleased to see this exception. Covered entities are required to make determinations of minimum necessary use, including use for treatment purposes, based on the role of the person or class of work force members rather than on the level of specific uses. The final regulations require a covered entity to establish policies and procedures that identify the types of persons who are to have access to designated categories of information and the conditions, if any, of that access.
Many providers do that already.
But to require providers to develop and implement role-based access policies and procedures would impose additional burdens on existing compliance programs. To monitor compliance with electronically transmitted information might be accomplished through audit trails. However, to monitor compliance with uses and disclosures of written or oral protected health information would be virtually impossible. It would seem that the level of complexity this would reach and the costs entailed would far outweigh the benefits. Medical Record Requests.