The HIPAA minimum necessary standard requires an AI agent to use, disclose and request only the protected health information its task needs. For agents, that means scoping access per capability, not per agent, setting role-based rules for routine tasks, sending unusual requests to a person, and enforcing the limits outside the model so a prompt cannot widen them.
What does the minimum necessary standard require?
In substance, covered entities and business associates must make reasonable efforts to limit uses, disclosures and requests of protected health information to the minimum necessary to accomplish the intended purpose.
The standard is implemented through policies:
- For uses inside the organisation, identify the people or classes of people who need access, the categories of PHI each needs, and any conditions on that access.
- For routine, recurring disclosures and requests, set standard protocols limiting the PHI to what is reasonably necessary.
- For non-routine disclosures and requests, review each one individually against set criteria.
Several situations are excluded, including disclosures to a provider for treatment, disclosures to the patient, uses under the patient's authorisation, and disclosures required by law. Treatment is the big one: a clinician treating a patient is not limited by the standard in what they can receive.
Who does it apply to?
Covered entities and their business associates, including an AI agent platform acting for them. The wider scope question is covered in do AI agents need to comply with HIPAA, and the platform's contractual position in HIPAA business associates and AI agent platforms.
Why is minimum necessary hard to apply to agents?
The standard assumes the user knows what they need before they look. An agent often does not. It decides what to retrieve as it reasons. Three habits follow, and each breaches the standard unless controlled.
Retrieving the whole record. It is simpler to hand an agent the full chart than to work out which parts a billing query needs. A billing agent then reads psychiatric notes it has no use for.
Broad search. Agents that search across patients to find a match can pull back detail on many people to resolve one case.
Carrying data between tasks. An agent that keeps what it read for one task and uses it in the next has, in effect, requested PHI for a purpose it was not needed for.
There is also a design trap. If the minimum necessary rule lives only in the agent's instructions ("only look at what you need"), it is advice to the model, not a control. It must be enforced where the data is released.
How do you scope agent access to the minimum?
Think of each agent capability as a class of user under the standard, and write the same three answers you would for a staff role: what it does, which PHI categories it needs, and on what conditions.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Identify who needs access | Each agent capability defined as a user class with its purpose | Capability register |
| Categories of PHI per class | Field-level access map per capability, for example billing codes and dates but not clinical notes | Access map; data source configuration |
| Conditions on access | Access only within an open case and after identity checks | Case-linked access logs |
| Routine disclosures limited | Standard outbound payloads per recipient type, such as payer or lab | Payload templates; transmission logs |
| Non-routine requests reviewed | Requests outside the protocol held for a named person | Hold records with decisions |
| Searches limited | Search returns identifiers or minimal fields until a match is confirmed | Search configuration; result logs |
| No carry-over | Task memory cleared when the task ends | Memory configuration |
| Enforcement outside the model | Access enforced by the platform at the moment of each request | Refused-request records |
The refused-request records are worth emphasis. They prove the limit exists and works. An agent that has never been refused anything either has a perfect scope or no scope at all.
How does minimum necessary relate to the minimum chain?
The two ideas share a name but answer different questions. Minimum necessary limits which data an agent may reach. The minimum chain, explained in what is the minimum chain, limits whether an action may proceed: role scope, certificate, sources, the customer's own limits and platform guardrails all apply at once, and the lowest bound wins. Sources and role scope are where minimum necessary is enforced inside that chain. Our longer piece, the minimum chain, explained, shows how the verdict records which bound decided.
What will an auditor or investigator ask?
- What PHI can each agent capability access, and why?
- Are limits enforced by the platform or only described in the agent's instructions?
- How does the agent search for a patient, and what does the search return?
- Which requests were refused or held last month, and why?
- Show us a treatment disclosure and a billing disclosure: how do the payloads differ?
What does the standard not cover?
It does not limit disclosures for treatment, to the patient, under authorisation or as required by law. It does not decide whether a use is permitted in the first place; that comes first. It does not cover security of the data once accessed, which is a security rule matter covered in HIPAA and AI agents handling protected health information. For the wider map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
In Pryme, sources are named per capability in the agent's brief, and the minimum chain checks role scope and sources at the moment of each action. A request outside the brief is refused, and the verdict, naming the bound that decided, is filed in an append-only record. Attest's scope gate tests on your own past cases that the agent stays inside its sources.
Questions people ask
Does minimum necessary apply when an agent supports a clinician's treatment decisions?
Disclosures to a provider for treatment are excluded, so the standard does not cap what the clinician receives. Good practice still limits an agent to what the clinical task requires, because broader access raises security risk.
Can the agent decide for itself what is necessary?
It can select within its permitted scope, but the scope must be set by policy and enforced by the platform. Letting the agent define its own scope turns a control into a suggestion.
Is a full record ever the minimum necessary?
Sometimes, and when it is, the policy must say why. HIPAA expects a specific justification where the entire medical record is used or disclosed outside the exclusions.