# Minimum-data task worksheet

Synthetic administrative examples. No actual patient record, legal approval or control test is represented.

An invented clinic reviews three staff tasks after separately approving their destination and purpose. The selections illustrate minimisation reasoning, not permission to disclose real PHI.

| Task | Keep for the example | Omit or review | Reason |
| --- | --- | --- | --- |
| Rewrite a generic appointment reminder | Clinic’s public contact instructions and neutral wording. | Names, booking date, diagnosis and patient list. | The wording task can be completed without an individual’s record. |
| Explain an approved payment exception | Only the transaction facts needed for the defined question. | Unrelated diagnoses, other patients and complete chart. | A billing question does not justify unrelated clinical context. |
| Review an unusual disclosure request | Purpose, recipient and a proposed field list for internal review. | Do not upload the full record while the criteria are unresolved. | Non-routine requests need the organisation’s individual review. |
| New attachment added to a routine task | Recheck that attachment against the protocol. | Hidden or unrelated rows, comments and extra records. | The protocol applies to what is actually sent, not only the prompt title. |

## Review steps

- Confirm purpose and recipient: Identify the otherwise permitted use or disclosure before applying this worksheet.
- Resolve applicability: Record the relevant minimum-necessary rule or exception without treating all clinician AI use alike.
- Justify included fields: For each field, explain what the approved task cannot accomplish without it.

## Safe reminder fixture

Please improve this generic wording: “Contact the clinic reception team if you need to discuss a booking.” Preserve the meaning and do not invent patient details.

## Example decision

The wording task needs no patient list. Use the generic fixture. This example does not establish approval of any external AI service. For a real case, retain the applicable protocol and accountable decision.

## Source and scope

Guide: https://aona.ai/resources/guides/hipaa-minimum-necessary-ai-prompts/

Source check: 21 September 2026. General information; no professional approval or installed-product result is represented.

- HHS: Minimum necessary requirement: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html
- HHS: Guidance on HIPAA and cloud computing: https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html