The “minimum necessary" rule of the HIPAA Privacy Rule
encourages:
Identify which pieces of PHI need to be accessed
Identify the conditions PHI will be accessed
CEs and BAs determine who needs to have access to what information to
perform the duties of their job
All of the above