# Minimum-data task worksheet

An invented clinic reviews three staff tasks after separately approving their destination and purpose. The selections illustrate minimisation reasoning, not permission to disclose real PHI.

Synthetic administrative examples. No actual patient record, legal approval or control test is represented.

Source: https://aona.ai/resources/guides/hipaa-minimum-necessary-ai-prompts/
Sources checked: 2026-09-21

## A smaller input starts earlier

### Purpose

Improve reminder wording

### Necessary context

Public reception instructions

### Omitted

Patient identity, diagnosis and booking export

| Task | Keep for the example | Omit or review | Reason |
| --- | --- | --- | --- |
| Rewrite a generic appointment reminder | Clinic’s public contact instructions and neutral wording. | Names, booking date, diagnosis and patient list. | The wording task can be completed without an individual’s record. |
| Explain an approved payment exception | Only the transaction facts needed for the defined question. | Unrelated diagnoses, other patients and complete chart. | A billing question does not justify unrelated clinical context. |
| Review an unusual disclosure request | Purpose, recipient and a proposed field list for internal review. | Do not upload the full record while the criteria are unresolved. | Non-routine requests need the organisation’s individual review. |
| New attachment added to a routine task | Recheck that attachment against the protocol. | Hidden or unrelated rows, comments and extra records. | The protocol applies to what is actually sent, not only the prompt title. |

## Review checklist

- [ ] Confirm purpose and recipient
  Identify the otherwise permitted use or disclosure before applying this worksheet.
- [ ] Resolve applicability
  Record the relevant minimum-necessary rule or exception without treating all clinician AI use alike.
- [ ] Justify included fields
  For each field, explain what the approved task cannot accomplish without it.

## Included example files

- hipaa-ai-minimum-data.md
- hipaa-ai-minimum-data.csv

## Source references

- HHS: Minimum necessary requirement: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html (2026-09-21)
- HHS: Guidance on HIPAA and cloud computing: https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html (2026-09-21)

Use the worksheet within the relevant legal, contractual and technical scope. It is not a certification or a record of an installed-product test.