What Protected Health Information can be released over the telephone?

Say I'm working in a hospital Health Information Management department and an out of state physician calls wanting to know PHI about one of our former patients. What is the Minimum Necessary Standard for this situation? Can I even confirm that the patient was hospitalized here? This is for a cl I'm taking and I can't seem to find a clear, concise answer anywhere!