HHS – April 2002
HOSPITAL:  The privacy rule allows doctors and nurses to see an patient’s entire medical record, if I think they need it to do their jobs.
The Privacy Rule do not prohibit use or disclosure of, or requests for an entire medical record.  The covered entity must document in its policies and procedures that the entire medical record is the amount reasonably necessary for certain identified purposes.
TRUE !
TRUE!    The Privacy Rule do not prohibit use or disclosure of, or requests for an entire medical record where appropriate.  An employee of a covered entity may use an entire medical record, without a case-by-case justification, if the covered entity has documented in its policies and procedures that the entire medical record is the amount reasonably necessary for certain identified purposes.

The policies and procedures would identify those persons or classes of person in the workforce that need to see the entire medical record and the conditions, if any, that are appropriate for such access.  No justification is needed in those instances where the minimum necessary standard does not apply, such as disclosures to or requests by a health care provider for treatment or disclosures to the individual.

The Privacy Rule provides the covered entity with substantial discretion as to how to implement the minimum necessary standard, and appropriately and reasonably limit access to and the use of identifiable health information within the covered entity.  The rule recognizes that the covered entity is in the best position to know and determine who in its workforce needs access to personal health information to perform their jobs.  Therefore, the covered entity can develop role-based access policies that allow its health care providers and other employees, as appropriate, access to patient information, including entire medical records, for treatment purposes.