Which statement best describes appropriate PHI sharing with an external consultant to support a quality improvement project?

• A. Share the full patient chart with the consultant.
• B. Provide PHI to the consultant without limits.
• C. Share only the specific data required for the consultant's role.
• D. Refuse to share any PHI with external parties.

Answer: (C)

The key idea is to share only the data elements that the external consultant actually needs to perform their role in the quality improvement project. This follows the minimum necessary principle under HIPAA: PHI should be disclosed in a way that supports the task while limiting exposure of information beyond what is required.

To apply this, first define the consultant’s specific responsibilities and determine exactly which data fields are essential for those tasks (for example, certain encounter details or outcome metrics) and provide only that subset. Use formal safeguards like a business associate agreement that specifies permitted uses and require secure data transmission and access controls. When possible, de-identify data to further reduce risk. Sharing full patient charts or PHI without limits increases privacy risk and isn’t appropriate, while withholding PHI entirely would hinder the project. This approach protects patient privacy while enabling the needed quality improvement work.