1.1 	A bill for an act
1.2 	relating to data practices; modifying requirements related to access to and 
1.3 	transfer of MNsure data; amending Minnesota Statutes 2014, section 62V.06, 
1.4 	subdivisions 5, 8.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. Minnesota Statutes 2014, section 62V.06, subdivision 5, is amended to read:
1.7 		Subd. 5.Data sharing. (a) MNsure may share or disseminate data classified as 
1.8 	private or nonpublic in subdivision 3 as follows:
1.9 	(1) to the subject of the data, as provided in section 13.04;
1.10 	(2) according to a court order;
1.11 	(3) according to a state or federal law specifically authorizing access to the data;
1.12 	(4) with other state or federal agencies, only to the extent necessary to verify the 
1.13 	identity of, determine the eligibility of, process premiums for, process enrollment of, or 
1.14 	investigate fraud related to an individual, employer, or employee participating in MNsure, 
1.15 	provided that MNsure must enter into a data-sharing agreement with the agency prior to 
1.16 	sharing data under this clause; and
1.17 	(5) with a nongovernmental person or entity, only to the extent necessary to verify 
1.18 	the identity of, determine the eligibility of, process premiums for, process enrollment of, or 
1.19 	investigate fraud related to an individual, employer, or employee participating in MNsure, 
1.20 	provided that MNsure must enter into a contract with the person or entity, as provided in 
1.21 	section 13.05, subdivision 6 or 11, prior to disseminating data under this clause.
1.22 	(b) MNsure may share or disseminate data classified as private or nonpublic in 
1.23 	subdivision 4 as follows:
1.24 	(1) to the subject of the data, as provided in section 13.04;
2.1 	(2) according to a court order;
2.2 	(3) according to a state or federal law specifically authorizing access to the data;
2.3 	(4) with other state or federal agencies, only to the extent necessary to carry out the 
2.4 	functions of MNsure, provided that MNsure must enter into a data-sharing agreement with 
2.5 	the agency prior to sharing data under this clause; and
2.6 	(5) with a nongovernmental person or entity, only to the extent necessary to carry 
2.7 	out the functions of MNsure, provided that MNsure must enter a contract with the person 
2.8 	or entity, as provided in section 13.05, subdivision 6 or 11, prior to disseminating data 
2.9 	under this clause.
2.10 	(c) Sharing or disseminating data outside of MNsure in a manner not authorized by 
2.11 	this subdivision is prohibited. The list of authorized dissemination and sharing contained 
2.12 	in this subdivision must be included in the Tennessen warning required by section 13.04, 
2.13 	subdivision 2.
2.14 	(d) Until July 1, 2014, state agencies must share data classified as private or 
2.15 	nonpublic on individuals, employees, or employers participating in MNsure with MNsure, 
2.16 	only to the extent such data are necessary to verify the identity of, determine the eligibility 
2.17 	of, process premiums for, process enrollment of, or investigate fraud related to a MNsure 
2.18 	participant. The agency must enter into a data-sharing agreement with MNsure prior 
2.19 	to sharing any data under this paragraph.
2.20 	(e) Notwithstanding paragraphs (a) and (b), MNsure may only transfer or allow 
2.21 	access to data under this subdivision if MNsure has implemented, and the receiving entity 
2.22 	has agreed to implement, adequate control procedures to ensure and verify that all data that 
2.23 	is transferred or authorized for access is accurate, complete, and secure. Where applicable, 
2.24 	the control procedures must include, but not be limited to, the requirements of subdivision 
2.25 	8. To the extent that a contract or data-sharing agreement is required by this subdivision, 
2.26 	the control procedures must be included in the terms of the contract or agreement.

2.27 	Sec. 2. Minnesota Statutes 2014, section 62V.06, subdivision 8, is amended to read:
2.28 		Subd. 8.Access to data; audit trail. (a) Only individuals with explicit authorization 
2.29 	from the board may enter, update, or access not public data collected, created, or 
2.30 	maintained by MNsure. The ability of authorized individuals to enter, update, or access 
2.31 	data must be limited through the use of role-based access that corresponds to the official 
2.32 	duties or training level of the individual, and the statutory authorization that grants access 
2.33 	for that purpose. All queries and responses, and all actions in which data are entered, 
2.34 	updated, accessed, or shared or disseminated outside of MNsure, must be recorded in a 
3.1 	data audit trail. Data contained in the audit trail are public, to the extent that the data 
3.2 	are not otherwise classified by this section.
3.3 	The board shall immediately and permanently revoke the authorization of any 
3.4 	individual determined to have willfully entered, updated, accessed, shared, or disseminated 
3.5 	data in violation of this section, or any provision of chapter 13. If an individual is 
3.6 	determined to have willfully gained access to data without explicit authorization from the 
3.7 	board, the board shall forward the matter to the county attorney for prosecution.
3.8 	(b) This subdivision shall not limit or affect the authority of the legislative auditor 
3.9 	to access data needed to conduct audits, evaluations, or investigations of MNsure or the 
3.10 	obligation of the board and MNsure employees to comply with section 3.978, subdivision 2.
3.11 	(c) This subdivision does not apply to actions taken by a MNsure participant to enter, 
3.12 	update, or access data held by MNsure, if the participant is the subject of the data that 
3.13 	is entered, updated, or accessed.
3.14 	(d) To the extent that data collected, created, or maintained by MNsure are 
3.15 	transferred to another state agency pursuant to an authorization under subdivision 5, the 
3.16 	requirements of this subdivision apply to the receiving agency.

3.17 	Sec. 3. EFFECTIVE DATE.
 3.18 	This act is effective the day following final enactment provided that, to the extent 
3.19 	that a new or revised contract or data-sharing agreement is required according to the 
3.20 	provisions of this act, the new or revised contract or agreement must be entered no later 
3.21 	than July 1, 2016.