the minimum necessary standard is intended to be consistent with and not override professional judgment and standards and that practices must implement policies and procedures based on their own assessment of what phi is reasonably necessary for a particular purpose