1.1 	A bill for an act
1.2 	relating to health; modifying provisions governing access to health records; 
1.3 	conforming certain requirements with federal law;amending Minnesota Statutes 
1.4 	2016, sections 13.05, subdivision 4a; 13.3805, subdivision 1; 13.384, subdivision 
1.5 	3; 13.386, subdivision 3; 72A.501, subdivision 4; 72A.502, subdivisions 6, 12; 
1.6 	144.291, subdivision 2; 144.293, subdivisions 2, 7, 8; Minnesota Statutes 2017 
1.7 	Supplement, section 13.46, subdivision 2; proposing coding for new law in 
1.8 	Minnesota Statutes, chapter 13; repealing Minnesota Statutes 2016, section 144.293, 
1.9 	subdivisions 4, 6, 10.
1.10 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.11 	Section 1. Minnesota Statutes 2016, section 13.05, subdivision 4a, is amended to read:
1.12 		Subd. 4a.Informed consent for insurance purposes. Informed consent for insurance 
1.13 	purposes must comply with this subdivision, unless otherwise prescribed by the HIPAA 
1.14 	Standards for Privacy of Individually Identifiable Health Information, Code of Federal 
1.15 	Regulations, title 45, section 164. Informed consent for insurance purposes is not considered 
1.16 	to have been given by an individual subject of data by the signing of a statement authorizing 
1.17 	a government entity to disclose information about the individual to an insurer or its authorized 
1.18 	representative, unless the statement is:
1.19 	(1) in plain language;
1.20 	(2) dated;
1.21 	(3) specific in designating the government entity the data subject is authorizing to disclose 
1.22 	information about the data subject;
1.23 	(4) specific as to the nature of the information the data subject is authorizing to be 
1.24 	disclosed;
2.1 	(5) specific as to the persons to whom the data subject is authorizing information to be 
2.2 	disclosed; and
2.3 	(6) specific as to the purpose or purposes for which the information may be used by any 
2.4 	of the persons named in clause (5), both at the time of the disclosure and at any time in the 
2.5 	future; and.
2.6 	(7) specific as to its expiration date, which must be within a reasonable period of time, 
2.7 	not to exceed one year.
2.8 	Notwithstanding clause (7), in the case of authorizations given in connection with 
2.9 	applications for life insurance or noncancelable or guaranteed renewable health insurance 
2.10 	that is so identified, the expiration date must not exceed two years after the date of the 
2.11 	policy. The duration of an authorization to disclose a health record is governed by the Health 
2.12 	Insurance Portability and Accountability Act of 1996, title II, subtitle F, as amended, 
2.13 	including federal regulations adopted under that act. An authorization in connection with 
2.14 	medical assistance under chapter 256B or MinnesotaCare under chapter 256L or for 
2.15 	individualized education program health-related services provided by a school district under 
2.16 	section 125A.21, subdivision 2, is valid during all terms of eligibility.

2.17 	Sec. 2. Minnesota Statutes 2016, section 13.3805, subdivision 1, is amended to read:
2.18 		Subdivision 1.Health data generally. (a) Definitions. As used in this subdivision:
2.19 	(1) "Commissioner" means the commissioner of health.
2.20 	(2) "Health data" are data on individuals created, collected, received, or maintained by 
2.21 	the Department of Health, political subdivisions, or statewide systems relating to the 
2.22 	identification, description, prevention, and control of disease or as part of an epidemiologic 
2.23 	investigation the commissioner designates as necessary to analyze, describe, or protect the 
2.24 	public health.
2.25 	(b) Data on individuals. (1) Health data are private data on individuals. Notwithstanding 
2.26 	section 13.05, subdivision 9, health data may not be disclosed except as provided in this 
2.27 	subdivision and section 13.04.
2.28 	(2) The commissioner or a community health board as defined in section 145A.02, 
2.29 	subdivision 5, may disclose health data to the data subject's physician as necessary to locate 
2.30 	or identify a case, carrier, or suspect case, to establish a diagnosis, to provide treatment, to 
2.31 	identify persons at risk of illness, or to conduct an epidemiologic investigation.
3.1 	(3) With the approval of the commissioner, health data may be disclosed to the extent 
3.2 	necessary to assist the commissioner to locate or identify a case, carrier, or suspect case, to 
3.3 	alert persons who may be threatened by illness as evidenced by epidemiologic data, to 
3.4 	control or prevent the spread of serious disease, or to diminish an imminent threat to the 
3.5 	public health.
3.6 	(4) If permitted or required under the Health Insurance Portability and Accountability 
3.7 	Act of 1996, title II, subtitle F, as amended, including federal regulations adopted under 
3.8 	that act.
3.9 	(c) Health summary data. Summary data derived from data collected under section 
3.10 	145.413 may be provided under section 13.05, subdivision 7.

3.11 	Sec. 3. Minnesota Statutes 2016, section 13.384, subdivision 3, is amended to read:
3.12 		Subd. 3.Classification of medical data. Unless the data is summary data or a statute 
3.13 	specifically provides a different classification, medical data are private but are available 
3.14 	only to the subject of the data as provided in sections 144.291 to 144.298, and shall not be 
3.15 	disclosed to others except:
3.16 	(a) pursuant to section 13.05;
3.17 	(b) pursuant to section 253B.0921;
3.18 	(c) pursuant to a valid court order;
3.19 	(d) to administer federal funds or programs;
3.20 	(e) to the surviving spouse, parents, children, siblings, and health care agent of a deceased 
3.21 	patient or client or, if there are no surviving spouse, parents, children, siblings, or health 
3.22 	care agent to the surviving heirs of the nearest degree of kindred;
3.23 	(f) to communicate a patient's or client's condition to a family member, health care agent, 
3.24 	or other appropriate person in accordance with acceptable medical practice, unless the 
3.25 	patient or client directs otherwise; or
3.26 	(g) as otherwise required by law.; or
3.27 	(h) as permitted or required under the Health Insurance Portability and Accountability 
3.28 	Act of 1996, title II, subtitle F, as amended, including federal regulations adopted under 
3.29 	that act.

4.1 	Sec. 4. Minnesota Statutes 2016, section 13.386, subdivision 3, is amended to read:
4.2 		Subd. 3.Collection, storage, use, and dissemination of genetic information. (a) Unless 
4.3 	otherwise expressly provided by law, genetic information about an individual:
4.4 	(1) may be collected by a government entity, as defined in section 13.02, subdivision 
4.5 	7a, or any other person only with the written informed consent of the individual;
4.6 	(2) may be used only for purposes to which the individual has given written informed 
4.7 	consent;
4.8 	(3) may be stored only for a period of time to which the individual has given written 
4.9 	informed consent; and
4.10 	(4) may be disseminated only:
4.11 	(i) with the individual's written informed consent; or
4.12 	(ii) if necessary in order to accomplish purposes described by clause (2). A consent to 
4.13 	disseminate genetic information under item (i) must be signed and dated. Unless otherwise 
4.14 	provided by law, such a consent is valid for one year or for a lesser period specified in the 
4.15 	consent.
4.16 	(b) Newborn screening activities conducted under sections 144.125 to 144.128 are subject 
4.17 	to paragraph (a). Other programs and activities governed under section 144.192 are not 
4.18 	subject to paragraph (a).
4.19 	(c) Notwithstanding paragraph (a), genetic information may be collected, used, stored, 
4.20 	or disseminated as permitted or required under the Health Insurance Portability and 
4.21 	Accountability Act of 1996, title II, subtitle F, as amended, including federal regulations 
4.22 	adopted under that act.

4.23 	Sec. 5. [13.388] HEALTH RECORDS.
4.24 	A health record, as defined in section 144.291, subdivision 2, paragraph (c), is private 
4.25 	data on individuals. A health record may not be disclosed except as provided in this chapter 
4.26 	or as permitted or required under the Health Insurance Portability and Accountability Act 
4.27 	of 1996, title II, subtitle F, as amended, including federal regulations adopted under that 
4.28 	act.

5.1 	Sec. 6. Minnesota Statutes 2017 Supplement, section 13.46, subdivision 2, is amended to 
5.2 	read:
5.3 		Subd. 2.General. (a) Data on individuals collected, maintained, used, or disseminated 
5.4 	by the welfare system are private data on individuals, and shall not be disclosed except:
5.5 	(1) according to section 13.05;
5.6 	(2) according to court order;
5.7 	(3) according to a statute specifically authorizing access to the private data;
5.8 	(4) to an agent of the welfare system and an investigator acting on behalf of a county, 
5.9 	the state, or the federal government, including a law enforcement person or attorney in the 
5.10 	investigation or prosecution of a criminal, civil, or administrative proceeding relating to the 
5.11 	administration of a program;
5.12 	(5) to personnel of the welfare system who require the data to verify an individual's 
5.13 	identity; determine eligibility, amount of assistance, and the need to provide services to an 
5.14 	individual or family across programs; coordinate services for an individual or family; 
5.15 	evaluate the effectiveness of programs; assess parental contribution amounts; and investigate 
5.16 	suspected fraud;
5.17 	(6) to administer federal funds or programs;
5.18 	(7) between personnel of the welfare system working in the same program;
5.19 	(8) to the Department of Revenue to assess parental contribution amounts for purposes 
5.20 	of section 252.27, subdivision 2a, administer and evaluate tax refund or tax credit programs 
5.21 	and to identify individuals who may benefit from these programs. The following information 
5.22 	may be disclosed under this paragraph: an individual's and their dependent's names, dates 
5.23 	of birth, Social Security numbers, income, addresses, and other data as required, upon 
5.24 	request by the Department of Revenue. Disclosures by the commissioner of revenue to the 
5.25 	commissioner of human services for the purposes described in this clause are governed by 
5.26 	section 270B.14, subdivision 1. Tax refund or tax credit programs include, but are not limited 
5.27 	to, the dependent care credit under section 290.067, the Minnesota working family credit 
5.28 	under section 290.0671, the property tax refund and rental credit under section 290A.04, 
5.29 	and the Minnesota education credit under section 290.0674;
5.30 	(9) between the Department of Human Services, the Department of Employment and 
5.31 	Economic Development, and when applicable, the Department of Education, for the following 
5.32 	purposes:
6.1 	(i) to monitor the eligibility of the data subject for unemployment benefits, for any 
6.2 	employment or training program administered, supervised, or certified by that agency;
6.3 	(ii) to administer any rehabilitation program or child care assistance program, whether 
6.4 	alone or in conjunction with the welfare system;
6.5 	(iii) to monitor and evaluate the Minnesota family investment program or the child care 
6.6 	assistance program by exchanging data on recipients and former recipients of food support, 
6.7 	cash assistance under chapter 256, 256D, 256J, or 256K, child care assistance under chapter 
6.8 	119B, medical programs under chapter 256B or 256L, or a medical program formerly 
6.9 	codified under chapter 256D; and
6.10 	(iv) to analyze public assistance employment services and program utilization, cost, 
6.11 	effectiveness, and outcomes as implemented under the authority established in Title II, 
6.12 	Sections 201-204 of the Ticket to Work and Work Incentives Improvement Act of 1999. 
6.13 	Health records governed by sections 144.291 to 144.298 and "protected health information" 
6.14 	as defined in Code of Federal Regulations, title 45, section 160.103, and governed by Code 
6.15 	of Federal Regulations, title 45, parts 160-164, including health care claims utilization 
6.16 	information, must not be exchanged under this clause;
6.17 	(10) to appropriate parties in connection with an emergency if knowledge of the 
6.18 	information is necessary to protect the health or safety of the individual or other individuals 
6.19 	or persons;
6.20 	(11) data maintained by residential programs as defined in section 245A.02 may be 
6.21 	disclosed to the protection and advocacy system established in this state according to Part 
6.22 	C of Public Law 98-527 to protect the legal and human rights of persons with developmental 
6.23 	disabilities or other related conditions who live in residential facilities for these persons if 
6.24 	the protection and advocacy system receives a complaint by or on behalf of that person and 
6.25 	the person does not have a legal guardian or the state or a designee of the state is the legal 
6.26 	guardian of the person;
6.27 	(12) to the county medical examiner or the county coroner for identifying or locating 
6.28 	relatives or friends of a deceased person;
6.29 	(13) data on a child support obligor who makes payments to the public agency may be 
6.30 	disclosed to the Minnesota Office of Higher Education to the extent necessary to determine 
6.31 	eligibility under section 136A.121, subdivision 2, clause (5);
6.32 	(14) participant Social Security numbers and names collected by the telephone assistance 
6.33 	program may be disclosed to the Department of Revenue to conduct an electronic data 
7.1 	match with the property tax refund database to determine eligibility under section 237.70, 
7.2 	subdivision 4a;
7.3 	(15) the current address of a Minnesota family investment program participant may be 
7.4 	disclosed to law enforcement officers who provide the name of the participant and notify 
7.5 	the agency that:
7.6 	(i) the participant:
7.7 	(A) is a fugitive felon fleeing to avoid prosecution, or custody or confinement after 
7.8 	conviction, for a crime or attempt to commit a crime that is a felony under the laws of the 
7.9 	jurisdiction from which the individual is fleeing; or
7.10 	(B) is violating a condition of probation or parole imposed under state or federal law;
7.11 	(ii) the location or apprehension of the felon is within the law enforcement officer's 
7.12 	official duties; and
7.13 	(iii) the request is made in writing and in the proper exercise of those duties;
7.14 	(16) the current address of a recipient of general assistance may be disclosed to probation 
7.15 	officers and corrections agents who are supervising the recipient and to law enforcement 
7.16 	officers who are investigating the recipient in connection with a felony level offense;
7.17 	(17) information obtained from food support applicant or recipient households may be 
7.18 	disclosed to local, state, or federal law enforcement officials, upon their written request, for 
7.19 	the purpose of investigating an alleged violation of the Food Stamp Act, according to Code 
7.20 	of Federal Regulations, title 7, section 272.1(c);
7.21 	(18) the address, Social Security number, and, if available, photograph of any member 
7.22 	of a household receiving food support shall be made available, on request, to a local, state, 
7.23 	or federal law enforcement officer if the officer furnishes the agency with the name of the 
7.24 	member and notifies the agency that:
7.25 	(i) the member:
7.26 	(A) is fleeing to avoid prosecution, or custody or confinement after conviction, for a 
7.27 	crime or attempt to commit a crime that is a felony in the jurisdiction the member is fleeing;
7.28 	(B) is violating a condition of probation or parole imposed under state or federal law; 
7.29 	or
7.30 	(C) has information that is necessary for the officer to conduct an official duty related 
7.31 	to conduct described in subitem (A) or (B);
8.1 	(ii) locating or apprehending the member is within the officer's official duties; and
8.2 	(iii) the request is made in writing and in the proper exercise of the officer's official duty;
8.3 	(19) the current address of a recipient of Minnesota family investment program, general 
8.4 	assistance, or food support may be disclosed to law enforcement officers who, in writing, 
8.5 	provide the name of the recipient and notify the agency that the recipient is a person required 
8.6 	to register under section 243.166, but is not residing at the address at which the recipient is 
8.7 	registered under section 243.166;
8.8 	(20) certain information regarding child support obligors who are in arrears may be 
8.9 	made public according to section 518A.74;
8.10 	(21) data on child support payments made by a child support obligor and data on the 
8.11 	distribution of those payments excluding identifying information on obligees may be 
8.12 	disclosed to all obligees to whom the obligor owes support, and data on the enforcement 
8.13 	actions undertaken by the public authority, the status of those actions, and data on the income 
8.14 	of the obligor or obligee may be disclosed to the other party;
8.15 	(22) data in the work reporting system may be disclosed under section 256.998, 
8.16 	subdivision 7;
8.17 	(23) to the Department of Education for the purpose of matching Department of Education 
8.18 	student data with public assistance data to determine students eligible for free and 
8.19 	reduced-price meals, meal supplements, and free milk according to United States Code, 
8.20 	title 42, sections 1758, 1761, 1766, 1766a, 1772, and 1773; to allocate federal and state 
8.21 	funds that are distributed based on income of the student's family; and to verify receipt of 
8.22 	energy assistance for the telephone assistance plan;
8.23 	(24) the current address and telephone number of program recipients and emergency 
8.24 	contacts may be released to the commissioner of health or a community health board as 
8.25 	defined in section 145A.02, subdivision 5, when the commissioner or community health 
8.26 	board has reason to believe that a program recipient is a disease case, carrier, suspect case, 
8.27 	or at risk of illness, and the data are necessary to locate the person;
8.28 	(25) to other state agencies, statewide systems, and political subdivisions of this state, 
8.29 	including the attorney general, and agencies of other states, interstate information networks, 
8.30 	federal agencies, and other entities as required by federal regulation or law for the 
8.31 	administration of the child support enforcement program;
9.1 	(26) to personnel of public assistance programs as defined in section 256.741, for access 
9.2 	to the child support system database for the purpose of administration, including monitoring 
9.3 	and evaluation of those public assistance programs;
9.4 	(27) to monitor and evaluate the Minnesota family investment program by exchanging 
9.5 	data between the Departments of Human Services and Education, on recipients and former 
9.6 	recipients of food support, cash assistance under chapter 256, 256D, 256J, or 256K, child 
9.7 	care assistance under chapter 119B, medical programs under chapter 256B or 256L, or a 
9.8 	medical program formerly codified under chapter 256D;
9.9 	(28) to evaluate child support program performance and to identify and prevent fraud 
9.10 	in the child support program by exchanging data between the Department of Human Services, 
9.11 	Department of Revenue under section 270B.14, subdivision 1, paragraphs (a) and (b), 
9.12 	without regard to the limitation of use in paragraph (c), Department of Health, Department 
9.13 	of Employment and Economic Development, and other state agencies as is reasonably 
9.14 	necessary to perform these functions;
9.15 	(29) counties operating child care assistance programs under chapter 119B may 
9.16 	disseminate data on program participants, applicants, and providers to the commissioner of 
9.17 	education;
9.18 	(30) child support data on the child, the parents, and relatives of the child may be 
9.19 	disclosed to agencies administering programs under titles IV-B and IV-E of the Social 
9.20 	Security Act, as authorized by federal law;
9.21 	(31) to a health care provider governed by sections 144.291 to 144.298, to the extent 
9.22 	necessary to coordinate services;
9.23 	(32) to the chief administrative officer of a school to coordinate services for a student 
9.24 	and family; data that may be disclosed under this clause are limited to name, date of birth, 
9.25 	gender, and address; or
9.26 	(33) to county correctional agencies to the extent necessary to coordinate services and 
9.27 	diversion programs; data that may be disclosed under this clause are limited to name, client 
9.28 	demographics, program, case status, and county worker information.; or
9.29 	(34) as permitted or required under the Health Insurance Portability and Accountability 
9.30 	Act of 1996, title II, subtitle F, as amended, including federal regulations adopted under 
9.31 	that act.
10.1 	(b) Information on persons who have been treated for drug or alcohol abuse may only 
10.2 	be disclosed according to the requirements of Code of Federal Regulations, title 42, sections 
10.3 	2.1 to 2.67.
10.4 	(c) Data provided to law enforcement agencies under paragraph (a), clause (15), (16), 
10.5 	(17), or (18), or paragraph (b), are investigative data and are confidential or protected 
10.6 	nonpublic while the investigation is active. The data are private after the investigation 
10.7 	becomes inactive under section 13.82, subdivision 5, paragraph (a) or (b).
10.8 	(d) Mental health data shall be treated as provided in subdivisions 7, 8, and 9, but are 
10.9 	not subject to the access provisions of subdivision 10, paragraph (b).
10.10 	For the purposes of this subdivision, a request will be deemed to be made in writing if 
10.11 	made through a computer interface system.

10.12 	Sec. 7. Minnesota Statutes 2016, section 72A.501, subdivision 4, is amended to read:
10.13 		Subd. 4.Authorization; noninsurers. If an authorization is submitted to an insurer, 
10.14 	insurance-support organization, or insurance agent by a person other than an insurer, 
10.15 	insurance-support organization, or insurance agent, the authorization must be dated, signed 
10.16 	by the person, and obtained one year or less before the date a disclosure is sought. Unless 
10.17 	otherwise required by law, this authorization does not expire, unless an expiration date or 
10.18 	event is specified in the authorization.

10.19 	Sec. 8. Minnesota Statutes 2016, section 72A.502, subdivision 6, is amended to read:
10.20 		Subd. 6.Other laws or order. Personal or privileged information may be disclosed 
10.21 	without a written authorization if permitted or required by another state or federal law or 
10.22 	regulation or in response to a facially valid administrative or judicial order, including a 
10.23 	search warrant or subpoena.

10.24 	Sec. 9. Minnesota Statutes 2016, section 72A.502, subdivision 12, is amended to read:
10.25 		Subd. 12.Notice. Whenever an insurer, insurance agent, or insurance-support organization 
10.26 	discloses personal or privileged information about a person that requires the written 
10.27 	authorization of that person under this section, the insurer, insurance agent, or 
10.28 	insurance-support organization shall notify that person in writing within ten days of the date 
10.29 	the information was disclosed. The notification must specify the identity of the person to 
10.30 	whom information was disclosed and the nature and substance of the information that was 
10.31 	disclosed. A notice is not required to be given under this subdivision if an insurer is disclosing 
10.32 	personal information for underwriting purposes to another insurer, or to an insurance-support 
11.1 	organization if the person had signed an authorization authorizing the disclosure. A notice 
11.2 	is not required under this subdivision if the disclosing entity is subject to and complies with 
11.3 	Code of Federal Regulations, title 45, chapter A, subchapter C, part 164, subpart D, sections 
11.4 	164.400 to 164.414.

11.5 	Sec. 10. Minnesota Statutes 2016, section 144.291, subdivision 2, is amended to read:
11.6 		Subd. 2.Definitions. For the purposes of sections 144.291 to 144.298, the following 
11.7 	terms have the meanings given.
11.8 	(a) "Group purchaser" has the meaning given in section 62J.03, subdivision 6.
11.9 	(b) "Health information exchange" means a legal arrangement between health care 
11.10 	providers and group purchasers to enable and oversee the business and legal issues involved 
11.11 	in the electronic exchange of health records between the entities for the delivery of patient 
11.12 	care.
11.13 	(c) "Health record" means any information, whether oral or recorded in any form or 
11.14 	medium, that relates to the past, present, or future physical or mental health or condition of 
11.15 	a patient; the provision of health care to a patient; or the past, present, or future payment 
11.16 	for the provision of health care to a patient information that is protected health information 
11.17 	as defined in HIPAA.
11.18 	(d) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, 
11.19 	title II, subtitle F, as amended, including federal regulations adopted under that act.
11.20 	(e) "Identifying information" means the patient's name, address, date of birth, gender, 
11.21 	parent's or guardian's name regardless of the age of the patient, and other nonclinical data 
11.22 	which can be used to uniquely identify a patient.
11.23 	(e) (f) "Individually identifiable form" means a form in which the patient is or can be 
11.24 	identified as the subject of the health records.
11.25 	(f) (g) "Medical emergency" means medically necessary care which is immediately 
11.26 	needed to preserve life, prevent serious impairment to bodily functions, organs, or parts, or 
11.27 	prevent placing the physical or mental health of the patient in serious jeopardy.
11.28 	(g)(h) "Patient" means a natural person who has received health care services from a 
11.29 	provider for treatment or examination of a medical, psychiatric, or mental condition, the 
11.30 	surviving spouse and parents of a deceased patient, or a person the patient appoints in writing 
11.31 	as a representative, including a health care agent acting according to chapter 145C, unless 
11.32 	the authority of the agent has been limited by the principal in the principal's health care 
12.1 	directive. Except for minors who have received health care services under sections 144.341
12.2 	to 144.347, in the case of a minor, patient includes a parent or guardian, or a person acting 
12.3 	as a parent or guardian in the absence of a parent or guardian.
12.4 	(h)(i) "Patient information service" means a service providing the following query 
12.5 	options: a record locator service as defined in paragraph (j)(k) or a master patient index or 
12.6 	clinical data repository as defined in section 62J.498, subdivision 1.
12.7 	(i)(j) "Provider" means or "health care provider" has the meaning given in Code of 
12.8 	Federal Regulations, title 45, chapter A, subchapter C, part 160, subpart A, section 160.103, 
12.9 	and includes:
12.10 	(1) any person who furnishes health care services and is regulated to furnish the services 
12.11 	under chapter 147, 147A, 147B, 147C, 147D, 148, 148B, 148D, 148F, 150A, 151, 153, or 
12.12 	153A;
12.13 	(2) a home care provider licensed under section 144A.471;
12.14 	(3) a health care facility licensed under this chapter or chapter 144A; and
12.15 	(4) a physician assistant registered under chapter 147A.
12.16 	(j)(k) "Record locator service" means an electronic index of patient identifying 
12.17 	information that directs providers in a health information exchange to the location of patient 
12.18 	health records held by providers and group purchasers.
12.19 	(k)(l) "Related health care entity" means an affiliate, as defined in section 144.6521, 
12.20 	subdivision 3, paragraph (b), of the provider releasing the health records.

12.21 	Sec. 11. Minnesota Statutes 2016, section 144.293, subdivision 2, is amended to read:
12.22 		Subd. 2.Patient consent to release Disclosure of patient records. A provider, or a 
12.23 	person who receives health records from a provider, may not release a patient's health records 
12.24 	to a person without:
12.25 	(1) a signed and dated consent from the patient or the patient's legally authorized 
12.26 	representative authorizing the release;
12.27 	(2) specific authorization in law; or
12.28 	(3) a representation from a provider that holds a signed and dated consent from the 
12.29 	patient authorizing the release. may disclose health records if that disclosure is in compliance 
12.30 	with Code of Federal Regulations, title 45, chapter A, subchapter C, part 164, subpart E, 
13.1 	sections 164.500 to 164.514, regardless of whether the provider is a covered entity under 
13.2 	HIPAA, or if the disclosure is permitted or required by other federal or state law.

13.3 	Sec. 12. Minnesota Statutes 2016, section 144.293, subdivision 7, is amended to read:
13.4 		Subd. 7.Exception to consent Encryption required. Subdivision 2 does not apply to 
13.5 	the release of If a health records record is disclosed to the commissioner of health or the 
13.6 	Health Data Institute under chapter 62J, provided that the commissioner encrypts the patient 
13.7 	identifier must be encrypted upon receipt of the data.

13.8 	Sec. 13. Minnesota Statutes 2016, section 144.293, subdivision 8, is amended to read:
13.9 		Subd. 8.Record locator or patient information service. (a) A provider or group 
13.10 	purchaser may release patient identifying information and information about the location 
13.11 	of the patient's health records to a record locator or patient information service without 
13.12 	consent from the patient, unless the patient has elected to be excluded from the service under 
13.13 	paragraph (d). The Department of Health may not access the record locator or patient 
13.14 	information service or receive data from the service. Only a provider may have access to 
13.15 	patient identifying information in a record locator or patient information service. Except in 
13.16 	the case of a medical emergency, a provider participating in a health information exchange 
13.17 	using a record locator or patient information service does not have access to patient 
13.18 	identifying information and information about the location of the patient's health records 
13.19 	unless the patient specifically consents to theelects not to allow access. A consent does not 
13.20 	expire but may be revoked by the patient at any time by providing written notice of the 
13.21 	revocation to the provider.
13.22 	(b) A health information exchange maintaining a record locator or patient information 
13.23 	service must maintain an audit log of providers accessing information in the service that at 
13.24 	least contains information on:
13.25 	(1) the identity of the provider accessing the information;
13.26 	(2) the identity of the patient whose information was accessed by the provider; and
13.27 	(3) the date the information was accessed.
13.28 	(c) No group purchaser may in any way require a provider to participate in a record 
13.29 	locator or patient information service as a condition of payment or participation.
13.30 	(d) Upon request, a provider or an entity operating a record locator or patient information 
13.31 	service must provide a mechanism under which patients may exclude their identifying 
13.32 	information and information about the location of their health records from a record locator 
14.1 	or patient information service. At a minimum, a consent form that permits a provider to 
14.2 	access a record locator or patient information service must include a conspicuous check-box 
14.3 	option that allows a patient to exclude all of the patient's information from the service. A 
14.4 	provider participating in a health information exchange with a record locator or patient 
14.5 	information service who receives a patient's request to exclude all of the patient's information 
14.6 	from the service or to have a specific provider contact excluded from the service is 
14.7 	responsible for removing that information from the service.

14.8 	Sec. 14.  REPEALER.
 14.9 	Minnesota Statutes 2016, section 144.293, subdivisions 4, 6, and 10, are repealed.

APPENDIX 

Repealed Minnesota Statutes: 18-6502 

144.293 RELEASE OR DISCLOSURE OF HEALTH RECORDS.Subd. 4.Duration of consent. 
Except as provided in this section, a consent is valid for one year or for a period specified in the consent or for a different period provided by law. 

Subd. 6.Consent does not expire. 
Notwithstanding subdivision 4, if a patient explicitly gives informed consent to the release of health records for the purposes and restrictions in clause (1), (2), or (3), the consent does not expire after one year for: 

(1) the release of health records to a provider who is being advised or consulted with in connection with the releasing provider's current treatment of the patient; 

(2) the release of health records to an accident and health insurer, health service plan corporation, health maintenance organization, or third-party administrator for purposes of payment of claims, fraud investigation, or quality of care review and studies, provided that: 

(i) the use or release of the records complies with sections 72A.49 to 72A.505; 

(ii) further use or release of the records in individually identifiable form to a person other than the patient without the patient's consent is prohibited; and 

(iii) the recipient establishes adequate safeguards to protect the records from unauthorized disclosure, including a procedure for removal or destruction of information that identifies the patient; or 

(3) the release of health records to a program in the welfare system, as defined in section 13.46, to the extent necessary to coordinate services for the patient. 

Subd. 10.Warranties regarding consents, requests, and disclosures. 
(a) When requesting health records using consent, a person warrants that the consent: 

(1) contains no information known to the person to be false; and 

(2) accurately states the patient's desire to have health records disclosed or that there is specific authorization in law. 

(b) When requesting health records using consent, or a representation of holding a consent, a provider warrants that the request: 

(1) contains no information known to the provider to be false; 

(2) accurately states the patient's desire to have health records disclosed or that there is specific authorization in law; and 

(3) does not exceed any limits imposed by the patient in the consent. 

(c) When disclosing health records, a person releasing health records warrants that the person: 

(1) has complied with the requirements of this section regarding disclosure of health records; 

(2) knows of no information related to the request that is false; and 

(3) has complied with the limits set by the patient in the consent.