164.502(b)

Uses and disclosures of protected health information: general rules : Minimum necessary - covered entity must make reasonable efforts to limit the use/disclosure of protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request; exceptions.