The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires that an individual’s access to Protected Health Information (PHI) be the “minimum necessary” to fulfill his/her duties and responsibilities. Security levels will be set up such that only the PHI needed by an individual to fulfill their duties and responsibilities will be available to them.