"In general, use or disclosure of PHI for purposes other than treatment or a disclosure requested by the patient is limited to the minimum necessary." . . . . . . . . .