The rule
Use or disclose the minimum PHI the job needs, on an approved channel, with a documented permission.
If the permission or the identity is missing, stop and route. Do not send the chart to be helpful.
Never miss
- PHI is identifiable health information held by a covered entity or business associate.
- Minimum necessary still applies to payment and operations.
- The Security Rule is about ePHI: administrative, physical, and technical safeguards.
- Unsecured PHI has a breach presumption unless a documented assessment shows low probability of compromise.
- Treatment, payment, and operations do not need an authorization. Most extra disclosures do.
- A business associate agreement must exist before a vendor handles PHI.
Traps
- Curiosity looks in a celebrity or neighbor chart.
- Shared logins and unlocked cafe sessions.
- A later authorization used to erase an earlier disclosure.
- Reading a full lab report onto a voicemail the patient did not request.
Shortcuts
- Ask: who, what, why, which channel, and is there a permission.
- Two identifiers before you open the record.
- Incident: stop, document, follow the sanction path.
Memory hooks
- APT. Administrative, Physical, Technical The three Security Rule safeguard groups.
- WHO-WHAT-WHY. Who is asking, what they want, why they may have it A 10-second Privacy Rule screen before any send.
Agencies ask for a recent training certificate, not a government credential. RemoteNurse does not issue HIPAA certificates.
- Day 1Privacy Rule and PHIRead the Privacy Rule and PHI terms, then the never-miss lines that touch this domain.
- Day 2Security Rule safeguardsRead the Security Rule safeguards terms, then the never-miss lines that touch this domain.
- Day 3Breach notificationRead the Breach notification terms, then the never-miss lines that touch this domain.
- Day 4Individual rights and authorizationRead the Individual rights and authorization terms, then the never-miss lines that touch this domain.
- Day 5Workforce and business associatesRead the Workforce and business associates terms, then the never-miss lines that touch this domain.
- Day 6Mixed recallRun the term cards, then a short drill. Restate the one-line rule out loud.
- Day 7Full drillSit the 15-question exam and review every miss against this kit.
RemoteNurse is not affiliated with, sponsored by, or endorsed by HHS. These are original RemoteNurse practice items written against publicly described exam domains and federal workflow rules. They are not official examination questions. Scores are a practice signal only and do not predict whether you will pass any issuer exam.