Its simple.

You put your PHI in one place and you encrypt it. Add all of the obvious controls like authentication, access control and monitoring.

Each record gets a UUID. Everywhere else you reference that record by UUID.

- Patient ABC123 called and requested modifications to their record

- Meds delivered to ABC123

- Insurance confirmed for patient ABC123

That’s how you ensure MINIMUM NECESSARY.

And if you want to go crazy there’s literally a crosswalk document published by HHS OCR and NIST:

https://www.hhs.gov/hipaa/for-professionals/security/nist-se...