The term that refers to sharing or examining PHI within an organization is "disclosure" (or "use," depending on direction), and both are governed by the HIPAA Privacy Rule. Use means internal employment of protected health information; disclosure means releasing it to another party, including another department or workforce member. Either action triggers minimum necessary, authorization, and accounting safeguards. This article explains the mechanics, thresholds, and edge cases in depth.
To understand why these terms carry legal weight, you need the underlying architecture. The Privacy Rule does not treat all movement of health data as equivalent. It splits internal handling into two legally distinct acts, then attaches different obligations to each. Getting the terminology right is not pedantry; it determines which compliance controls apply.
Use versus disclosure: the regulatory mechanism
The HIPAA Privacy Rule defines "use" as the sharing, employment, application, utilization, examination, or analysis of individually identifiable health information within an entity that maintains it. "Disclosure" means the release, transfer, provision of access to, or divulging of information in any other manner outside the entity holding it. The distinction hinges on whether information crosses the boundary of the covered entity.
This boundary is more subtle than a building's walls. A hospital and its affiliated physician group may be separate legal entities but a single "organized health care arrangement" for some purposes. A business associate sits outside the covered entity but inside a contractual perimeter. So "within an organization" is a legal question, not a geographic one. The same act of examining a chart can be a use in one configuration and a disclosure in another.
Why does the law care? Because internal use is where treatment happens, and blocking it would break care delivery. External disclosure is where privacy risk concentrates, so it carries heavier procedural duties. The rule channels scrutiny toward the boundary. One plain-language way to hold it: use stays home, disclosure leaves home, and the law polices the doorway.
The minimum necessary standard sits on top of both. It requires reasonable efforts to limit use and disclosure to the minimum needed to accomplish the purpose. Treatment disclosures to providers are exempt; most other purposes are not.
Quantified context: how often and how much
Protected health information is exchanged constantly, and the volume dwarfs most people's intuition. A single hospital admission can generate hundreds of individual data elements across billing, pharmacy, laboratory, and nursing systems. Each internal examination by a different role is a separate use event under audit.
Breach statistics illuminate where disclosure controls fail. The HHS Office for Civil Rights maintains a breach portal; unauthorized access and disclosure remain among the most common breach categories reported by covered entities. Hacking and IT incidents have grown as a share of large breaches over the past decade, but improper disclosure through misdirected email, fax, and unauthorized internal access persists as a steady baseline (HHS OCR).
Compliance costs are real but hard to pin precisely. Industry surveys place average breach costs per record in the hundreds of dollars for healthcare, though ranges vary widely by size. Treat those figures as directional, not precise; methodology differs across sources.
The minimum necessary standard has measurable operational cost. Each disclosure outside treatment requires a determination, and organizations build role-based access matrices to automate it. A well-designed matrix can reduce unnecessary internal access events substantially, though published before-and-after numbers are sparse and organization-specific.
Edge cases that change the analysis
Several configurations break the simple inside-outside model, and professionals routinely misclassify them.
Treatment, payment, and operations carve-outs. Disclosures for treatment are exempt from minimum necessary and from authorization. Disclosures for payment and operations are subject to minimum necessary but not authorization. Organized health care arrangements. Joint activities among clinically integrated providers can share information as if internal, but only for the joint activities specified. Business associates. A vendor processing claims or hosting records is outside the covered entity, so transfers are disclosures, yet the business associate agreement substitutes for authorization. Research uses. De-identified data falls outside PHI entirely; limited data sets require a data use agreement rather than authorization. Psychotherapy notes. These carry heightened protection and separate authorization rules that override general use provisions. Adolescent and minor consent laws. State law can make a parent a third party for certain records, turning a family conversation into a disclosure.
A counterintuitive detail: an internal examination can be an impermissible use even when no data leaves the building. An employee who opens a celebrity's chart out of curiosity commits a privacy violation with no external transfer at all. The audit trail, not the network perimeter, is the real control surface.
Misconceptions and red flags
The most common error is treating "within an organization" as a physical location. It is a legal relationship. A remote workforce member on a home network is still inside; a contractor onsite without a business associate agreement is outside. Location tells you almost nothing.
A second error conflates "sharing" with "disclosing" in casual usage. The keyword question itself reflects this ambiguity. When someone asks which term refers to sharing or examining PHI within an organization, the precise answer depends on direction: internal examination is use, and release to a separate party is disclosure. Both can occur in a single workflow.
Red flags to watch for:
Staff emailing PHI to personal accounts, which converts an internal use into an uncontrolled disclosure. Access matrices that grant broad permissions "just in case," violating minimum necessary at the role level. No accounting of disclosures log, which is required for most non-treatment disclosures. Fax and print workflows without verification steps, a persistent source of misdirected disclosures. Assuming a signed business associate agreement covers every purpose; it covers specified services only.
One professional caveat: the phrase "minimum necessary" is not a numeric threshold. It is a reasonableness standard judged against the purpose. Organizations sometimes invent arbitrary field-level rules and mistake them for compliance.
Comparison: how the major rules treat PHI movement
| Action | Internal or external | Minimum necessary applies | Authorization typically required | Accounting of disclosures |
|---|---|---|---|---|
| Clinician reviews chart for treatment | Internal use | No | No | No |
| Billing department reviews claim data | Internal use | Yes | No | No |
| Referral to outside specialist | External disclosure | No (treatment) | No | No |
| Release to attorney or insurer | External disclosure | Yes | Yes (usually) | Yes |
| Business associate processing claims | External disclosure | Yes | No (BAA substitutes) | Varies |
| Research with limited data set | External disclosure | Yes | No (DUA substitutes) | Varies |
| De-identified data sharing | Outside PHI | Not applicable | Not applicable | No |
The table's logic is consistent: risk rises at the boundary, and procedural substitutes (agreements, authorizations) scale with purpose. Treatment is the great exception because delay harms patients.
Timeline: what happens after a PHI incident
| Timeframe | Event | Governing rule |
|---|---|---|
| Immediately | Contain the incident, stop further access | Internal policy |
| Within hours | Preserve logs and audit trails | Internal policy |
| Within days | Assess whether PHI was compromised | Risk assessment standard |
| Within 60 days of discovery | Notify affected individuals | Breach Notification Rule |
| Within 60 days | Notify HHS (timing depends on breach size) | Breach Notification Rule |
| Within 60 days | Media notice if 500+ residents in a state or jurisdiction | Breach Notification Rule |
| Annually | Update accounting of disclosures | Privacy Rule |
The 60-day clock is the anchor. Everything upstream exists to determine whether that clock starts and what it obligates. Organizations that skip the preservation step often cannot make a defensible risk assessment.
Practical actions and thresholds
Translate the concepts into controls.
Build a role-based access matrix mapped to minimum necessary, and review it at least annually. Separate treatment pathways from payment and operations pathways in your systems, so exemptions apply cleanly. Require verification before any fax, email, or portal release; two-step confirmation reduces misdirection. Maintain an accounting of disclosures log for every non-treatment external release. Train staff on the use-versus-disclosure distinction, using real internal-access examples. Audit access logs quarterly for curiosity-driven views, which are uses, not disclosures.
Thresholds worth stating plainly: the 60-day individual notification window, the 500-resident media trigger, and the annual accounting review cycle. These are the numbers that convert policy into deadlines. A plain-language summary: know your boundary, apply minimum necessary outside treatment, and log what leaves.
Limitations and what the evidence cannot settle
The regulatory definitions are stable, but operational best practices evolve faster than published evidence. Most compliance statistics come from breach reporting, which captures failures, not routine successful use. That creates survivorship bias in how the field understands risk.
State law layers on top of federal rules, and the interaction varies by jurisdiction in ways this article cannot catalog. Organizational size, clinical specialty, and technology stack all shift the practical answer. Where sources conflict on cost or frequency figures, treat the direction as reliable and the magnitude as uncertain. No single threshold defines minimum necessary; reasonableness is contextual.
For medical, legal, or compliance decisions about specific records or incidents, this article is general educational information, not a diagnosis, legal opinion, or compliance determination. It does not promise outcomes and cannot substitute for advice from a qualified health privacy attorney or your organization's privacy officer. If a breach is underway, contact your privacy officer and legal counsel immediately.