HF 3259

as introduced - 91st Legislature (2019 - 2020) Posted on 02/13/2020 12:37pm

A bill for an act
relating to human services; requiring a license holder to destroy personal
information upon closure; providing remedies; proposing coding for new law in
Minnesota Statutes, chapter 245A.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

new text begin [245A.0415] TREATMENT OF PERSONAL INFORMATION UPON
CLOSURE.
new text end

new text begin Subdivision 1. new text end

new text begin Application. new text end

new text begin This section applies to a license holder operating a residential
program.
new text end

new text begin Subd. 2. new text end

new text begin Definition; personal information. new text end

new text begin (a) For purposes of this section, "personal
information" means the following information about a person receiving services in a
residential program: a person's first name or first initial and last name combined with:
new text end

new text begin (1) a nontruncated Social Security number or tax identification number;
new text end

new text begin (2) a nontruncated driver's license number, state-issued identification card number,
passport number, military identification number, or other unique identification number
issued on a government document used to verify the identity of a specific individual;
new text end

new text begin (3) a financial account number, including a bank account number, credit card number,
or debit card number, in combination with any security code, access code, password,
expiration date, or personal identification number, that is necessary to access the financial
account or to conduct a transaction that will credit or debit the financial account;
new text end

new text begin (4) any information regarding an individual's medical history, mental or physical
condition, or medical treatment or diagnosis by a health care professional;
new text end

new text begin (5) an individual's health insurance policy number, subscriber identification number, or
any unique identifier used by a health insurer to identify the individual; or
new text end

new text begin (6) a username or e-mail address, in combination with a password or security question
and answer that would permit access to an online account.
new text end

new text begin (b) Personal information does not include information that is encrypted or modified by
any other method or technology that removes elements that identify an individual or that
otherwise renders the information unusable, including encryption of the data, document, or
device containing the personal information, unless the license holder knows or has reason
to know that the encryption key or security credential that could render the personal
information readable or useable has been breached with the personal information.
new text end

new text begin Subd. 3. new text end

new text begin Duty to destroy. new text end

new text begin A license holder who ceases to provide services under this
chapter, or the responsible third party under section 245A.041, subdivision 3, paragraph
(b), must destroy all personal information within the license holder's or third party's custody
or control when retention of the information is no longer required by section 245A.041. A
license holder or the responsible third party must destroy personal information in a manner
that renders the information unreadable or undecipherable by any reasonable means consistent
with industry standards. A license holder or the responsible third party must submit a
certificate of destruction to the commissioner, providing a detailed description of compliance
with this section.
new text end

new text begin Subd. 4. new text end

new text begin Enforcement. new text end

new text begin (a) A person aggrieved by a violation of this section may bring
an action against a license holder or a responsible third party under section 13.08.
new text end

new text begin (b) The commissioner retains enforcement and oversight jurisdiction over a license
holder who ceases to provide services for purposes of enforcing this section. The
commissioner may seek penalties against a license holder or a responsible third party for a
violation of this section pursuant to any enforcement powers conferred upon the
commissioner.
new text end

new text begin Subd. 5. new text end

new text begin Exemption. new text end

new text begin This section does not apply if the license holder transfers ownership
of all or part of a residential program.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective August 1, 2020, and applies to license
holders who cease to provide services on or after that date.
new text end