§164.514(d)(5) Implementation specification: Other content requirement. For all uses, disclosures, or requests to which the requirements in paragraph (d) of this section apply, a covered entity may not use, disclose or request an entire medical record, except when the entire medical record is specifically justified as the amount that is reasonably necessary to accomplish the purpose of the use, disclosure, or request.
Audit Inquiry
Are policies and procedures in place to address uses, disclosures, or requests for an entire medical record?
Obtain and review policies and procedures related to minimum necessary uses, disclosures, or requests for an entire medical record for consistency with the established performance criterion.
Obtain and review a sample of use, disclosure, or request for an entire medical record and determine if it is limited to the PHI reasonably necessary to achieve the purpose of the use, disclosure, or request as required by §164.514(d)(5).