1.1 	A bill for an act
1.2 	relating to health; modifying provisions of the Minnesota Health Records Act;
1.3 	amending Minnesota Statutes 2016, sections 72A.501, subdivision 4; 72A.502, 
1.4 	subdivision 6; 144.291, subdivision 2; 144.293, subdivisions 2, 3, 5, 8; 144.295, 
1.5 	subdivision 1.
1.6 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.7 	Section 1. Minnesota Statutes 2016, section 72A.501, subdivision 4, is amended to read:
1.8 		Subd. 4.Authorization; noninsurers. If an authorization is submitted to an insurer, 
1.9 	insurance-support organization, or insurance agent by a person other than an insurer, 
1.10 	insurance-support organization, or insurance agent, the authorization must be dated, and
1.11 	signed by the person, and obtained one year or less before the date a disclosure is sought is 
1.12 	valid for one year, or for a period specified in the authorization, or for a period as provided 
1.13 	in law.

1.14 	Sec. 2. Minnesota Statutes 2016, section 72A.502, subdivision 6, is amended to read:
1.15 		Subd. 6.Other laws or order. Personal or privileged information may be disclosed 
1.16 	without a written authorization if permitted or required by another state or federal law or 
1.17 	regulation or in response to a facially valid administrative or judicial order, including a 
1.18 	search warrant or subpoena.

1.19 	Sec. 3. Minnesota Statutes 2016, section 144.291, subdivision 2, is amended to read:
1.20 		Subd. 2.Definitions. For the purposes of sections 144.291 to 144.298, the following 
1.21 	terms have the meanings given.
1.22 	(a) "Group purchaser" has the meaning given in section 62J.03, subdivision 6.
2.1 	(b) "Health information exchange" means a legal arrangement between health care 
2.2 	providers and group purchasers to enable and oversee the business and legal issues involved 
2.3 	in the electronic exchange of health records between the entities for the delivery of patient 
2.4 	care.
2.5 	(c) "Health record" means any information, whether oral or recorded in any form or 
2.6 	medium, that relates to the past, present, or future physical or mental health or condition of 
2.7 	a patient; the provision of health care to a patient; or the past, present, or future payment 
2.8 	for the provision of health care to a patient protected health information as defined in HIPAA.
2.9 	(d) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, 
2.10 	title II, subtitle F, as amended, including federal regulations adopted under that act.
2.11 	(d) (e) "Identifying information" means the patient's name, address, date of birth, gender, 
2.12 	parent's or guardian's name regardless of the age of the patient, and other nonclinical data 
2.13 	which can be used to uniquely identify a patient.
2.14 	(e) (f) "Individually identifiable form" means a form in which the patient is or can be 
2.15 	identified as the subject of the health records.
2.16 	(f) (g) "Medical emergency" means medically necessary care which is immediately 
2.17 	needed to preserve life, prevent serious impairment to bodily functions, organs, or parts, or 
2.18 	prevent placing the physical or mental health of the patient in serious jeopardy.
2.19 	(g) (h) "Patient" means a natural person who has received health care services from a 
2.20 	provider for treatment or examination of a medical, psychiatric, or mental condition, the 
2.21 	surviving spouse and parents of a deceased patient, or a person the patient appoints in writing 
2.22 	as a representative, including a health care agent acting according to chapter 145C, unless 
2.23 	the authority of the agent has been limited by the principal in the principal's health care 
2.24 	directive. Except for minors who have received health care services under sections 144.341
2.25 	to 144.347, in the case of a minor, patient includes a parent or guardian, or a person acting 
2.26 	as a parent or guardian in the absence of a parent or guardian.
2.27 	(h) (i) "Patient information service" means a service providing the following query 
2.28 	options: a record locator service as defined in paragraph (j) (k) or a master patient index or 
2.29 	clinical data repository as defined in section 62J.498, subdivision 1.
2.30 	(i) (j) "Provider" means:
2.31 	(1) any person who furnishes health care services and is regulated to furnish the services 
2.32 	under chapter 147, 147A, 147B, 147C, 147D, 148, 148B, 148D, 148F, 150A, 151, 153, or 
2.33 	153A;
3.1 	(2) a home care provider licensed under section 144A.471;
3.2 	(3) a health care facility licensed under this chapter or chapter 144A; and
3.3 	(4) a physician assistant registered under chapter 147A.
3.4 	(j) (k) "Record locator service" means an electronic index of patient identifying 
3.5 	information that directs providers in a health information exchange to the location of patient 
3.6 	health records held by providers and group purchasers.
3.7 	(k) (l) "Related health care entity" means an affiliate, as defined in section 144.6521, 
3.8 	subdivision 3, paragraph (b), of the provider releasing the health records.

3.9 	Sec. 4. Minnesota Statutes 2016, section 144.293, subdivision 2, is amended to read:
3.10 		Subd. 2.Patient consent to release of records. A provider, or a person who receives 
3.11 	health records from a provider, may not release a patient's health records to a person without:
3.12 	(1) without a signed and dated consent from the patient or the patient's legally authorized 
3.13 	representative authorizing the release;
3.14 	(2) unless permitted or required under HIPAA or specific authorization in other applicable 
3.15 	federal or state law; or
3.16 	(3) without a representation from a provider that holds a signed and dated consent from 
3.17 	the patient authorizing the release.

3.18 	Sec. 5. Minnesota Statutes 2016, section 144.293, subdivision 3, is amended to read:
3.19 		Subd. 3.Release from one provider to another. In addition to release or disclosure of 
3.20 	health records authorized under subdivision 2, a patient's health record, including, but not 
3.21 	limited to, laboratory reports, x-rays, prescriptions, and other technical information used in 
3.22 	assessing the patient's condition, or the pertinent portion of the record relating to a specific 
3.23 	condition, or a summary of the record, shall promptly be furnished to another provider upon 
3.24 	the written request of the patient. The written request shall specify the name of the provider 
3.25 	to whom the health record is to be furnished. The provider who furnishes the health record 
3.26 	or summary may retain a copy of the materials furnished. The patient shall be responsible 
3.27 	for the reasonable costs of furnishing the information.

4.1 	Sec. 6. Minnesota Statutes 2016, section 144.293, subdivision 5, is amended to read:
4.2 		Subd. 5.Exceptions to consent requirement. (a) In addition to release or disclosure 
4.3 	of health records authorized under subdivision 2, this section does not prohibit the release 
4.4 	of health records:
4.5 	(1) for a medical emergency when the provider is unable to obtain the patient's consent 
4.6 	due to the patient's condition or the nature of the medical emergency;
4.7 	(2) to other providers within or related health care entities when necessary for the current 
4.8 	treatment of the patient; or
4.9 	(3) to a health care facility licensed by this chapter, chapter 144A, or to the same types 
4.10 	of health care facilities licensed by this chapter and chapter 144A that are licensed in another 
4.11 	state when a patient:
4.12 	(i) is returning to the health care facility and unable to provide consent; or
4.13 	(ii) who resides in the health care facility, has services provided by an outside resource 
4.14 	under Code of Federal Regulations, title 42, section 483.75(h), and is unable to provide 
4.15 	consent.
4.16 	(b) A provider may release a deceased patient's health care records to another provider 
4.17 	for the purposes of diagnosing or treating the deceased patient's surviving adult child.

4.18 	Sec. 7. Minnesota Statutes 2016, section 144.293, subdivision 8, is amended to read:
4.19 		Subd. 8.Record locator or patient information service. (a) In addition to release or 
4.20 	disclosure of health records authorized under subdivision 2, a provider or group purchaser 
4.21 	may release patient identifying information and information about the location of the patient's 
4.22 	health records to a record locator or patient information service without consent from the 
4.23 	patient, unless the patient has elected to be excluded from the service under paragraph (d). 
4.24 	The Department of Health may not access the record locator or patient information service 
4.25 	or receive data from the service. Only a provider may have access to patient identifying 
4.26 	information in a record locator or patient information service. Except in the case of a medical 
4.27 	emergency, a provider participating in a health information exchange using a record locator 
4.28 	or patient information service does not have access to patient identifying information and 
4.29 	information about the location of the patient's health records unless the patient specifically 
4.30 	consents to the access. A consent does not expire but may be revoked by the patient at any 
4.31 	time by providing written notice of the revocation to the provider.
5.1 	(b) A health information exchange maintaining a record locator or patient information 
5.2 	service must maintain an audit log of providers accessing information in the service that at 
5.3 	least contains information on:
5.4 	(1) the identity of the provider accessing the information;
5.5 	(2) the identity of the patient whose information was accessed by the provider; and
5.6 	(3) the date the information was accessed.
5.7 	(c) No group purchaser may in any way require a provider to participate in a record 
5.8 	locator or patient information service as a condition of payment or participation.
5.9 	(d) A provider or an entity operating a record locator or patient information service must 
5.10 	provide a mechanism under which patients may exclude their identifying information and 
5.11 	information about the location of their health records from a record locator or patient 
5.12 	information service. At a minimum, a consent form that permits a provider to access a record 
5.13 	locator or patient information service must include a conspicuous check-box option that 
5.14 	allows a patient to exclude all of the patient's information from the service. A provider 
5.15 	participating in a health information exchange with a record locator or patient information 
5.16 	service who receives a patient's request to exclude all of the patient's information from the 
5.17 	service or to have a specific provider contact excluded from the service is responsible for 
5.18 	removing that information from the service.

5.19 	Sec. 8. Minnesota Statutes 2016, section 144.295, subdivision 1, is amended to read:
5.20 		Subdivision 1.Methods of release. (a) Notwithstanding section 144.293, subdivisions 
5.21 	2 and 4 In addition to release or disclosure of health records authorized under section 
5.22 	144.293, health records may be released to an external researcher solely for purposes of 
5.23 	medical or scientific research only as follows:
5.24 	(1) health records generated before January 1, 1997, may be released if the patient has 
5.25 	not objected or does not elect to object after that date;
5.26 	(2) for health records generated on or after January 1, 1997, the provider must:
5.27 	(i) disclose in writing to patients currently being treated by the provider that health 
5.28 	records, regardless of when generated, may be released and that the patient may object, in 
5.29 	which case the records will not be released; and
5.30 	(ii) use reasonable efforts to obtain the patient's written general authorization that 
5.31 	describes the release of records in item (i), which does not expire but may be revoked or 
5.32 	limited in writing at any time by the patient or the patient's authorized representative;
6.1 	(3) the provider must advise the patient of the rights specified in clause (4); and
6.2 	(4) the provider must, at the request of the patient, provide information on how the 
6.3 	patient may contact an external researcher to whom the health record was released and the 
6.4 	date it was released.
6.5 	(b) Authorization may be established if an authorization is mailed at least two times to 
6.6 	the patient's last known address with a postage prepaid return envelope and a conspicuous 
6.7 	notice that the patient's medical records may be released if the patient does not object, and 
6.8 	at least 60 days have expired since the second notice was sent.