When a covered entity has an authorized request to release PHI, the entity should generally release:

A.
The information determined by the hospital’s own internal policy.

B.
Only the Legal Health Record.

C.
The minimum necessary to achieve the goal.

D.
The entire patient medical record to ensure complete data.