HIPAA privacy: "individual rights" and the "minimum necessary" requirements

This Article focuses on two key aspects of the proposed regulations related to health information privacy published by the Department of Health and Human Services ("DHHS") pursuant to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). These two aspects, the provisions regarding individual rights and the provisions requiring use of the minimum amount of information necessary to accomplish a given purpose, will be particularly burdensome for the healthcare industry. Furthermore, they are likely to generate a significant number of complaints to the DHHS Secretary relating to alleged violations of the regulations. This Article analyzes the proposed regulations governing these two issues and offers practical advice regarding steps that entities should take in anticipation of the final regulations.