Why this matters
HIPAA’s minimum necessary standard reduces exposure by limiting PHI to what’s required for a task.
When reading from PHI tables, project only authorized fields and avoid SELECT *. Implement whitelists per role and document them. Reject requests lacking a Purpose-Of-Use justification.
HIPAA’s minimum necessary standard reduces exposure by limiting PHI to what’s required for a task.
Side-by-side examples engineers can pattern-match during review.
@Query("SELECT * FROM patients WHERE id=:id") Patient find(@Param("id") Long id);interface PatientView { String getInitials(); LocalDate getDob(); }
@Query("SELECT p.initials AS initials, p.dob AS dob FROM Patient p WHERE p.id=:id") PatientView findView(@Param("id") Long id);SELECT * FROM patients WHERE id=?SELECT initials, dob FROM patients WHERE id=?From the same buckets as this rule.
Before persisting ePHI, encrypt using a data key protected by a Key Management Service (KMS). Use authenticated encryption (AES-256-GCM or equivalent), rotate keys, and store the key id and algorithm with the record.