Which action would violate minimum necessary?

• A. Accessing only data needed for the task
• B. Logging authorization for access
• C. Requesting patient consent for disclosure
• D. Disclosing the entire patient chart to a supervisor

Answer: (D)

Minimum necessary means expose or share only the amount of information needed to accomplish the task. Accessing only data required for the task shows you’re following this rule, avoiding unnecessary exposure. Logging authorization supports accountability by recording who accessed what data and when. Requesting patient consent aligns with patient autonomy and helps ensure disclosure happens only with permission. Disclosing the entire patient chart to a supervisor goes beyond what is needed for supervision and reveals information that isn’t necessary for the task, violating the minimum necessary standard. In practice, a supervisor should see only the specific data needed for the review, or use summarized or de-identified information when possible.