The minimum necessary standard is a principle under the HIPAA Privacy Rule that requires covered entities and business associates to take reasonable steps to limit the use, disclosure, and requests for PHI to the minimum necessary to accomplish the intended purpose. This standard applies to all uses and disclosures of PHI, except for disclosures to healthcare providers for treatment purposes.