1.1 	A bill for an act
1.2 	relating to health care; establishing a statutory form to provide consent for the 
1.3 	disclosure of health care records;amending Minnesota Statutes 2018, section 
1.4 	144.293, subdivision 2; proposing coding for new law in Minnesota Statutes, 
1.5 	chapter 144.
1.6 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.7 	Section 1. Minnesota Statutes 2018, section 144.293, subdivision 2, is amended to read:
1.8 		Subd. 2.Patient consent to release of records. A provider, or a person who receives 
1.9 	health records from a provider, may not release a patient's health records to a person without:
1.10 	(1) a signed and dated consent form made as provided in section 144.2975 or section 
1.11 	144.292, subdivision 8, from the patient or the patient's legally authorized representative 
1.12 	authorizing the release;
1.13 	(2) specific authorization in law; or
1.14 	(3) a representation from a provider that holds a signed and dated consent form as 
1.15 	provided in section 144.2975 or 144.292, subdivision 8, from the patient authorizing the 
1.16 	release.

1.17 	Sec. 2. [144.2975] STATUTORY CONSENT FORM FOR PATIENT DATA 
1.18 	DISCLOSURE.
1.19 		Subdivision 1.Form. Except for disclosures and releases permitted when a patient uses 
1.20 	the "Minnesota Standard Consent Form to Release Health Information" prepared pursuant 
1.21 	to section 144.292, subdivision 8, a provider must use the following form to obtain patient 
2.1 	consent to disclose, release, or use health care records as provided in sections 144.291 to 
2.2 	144.298:
2.3 	Minnesota Patient Data Consent Form.
2.4 	Patient's Notice of Data Rights:
2.5 	(a) Your treatment is not conditioned upon granting or refusing consent below for use, 
2.6 	sharing, or release of health information.
2.7 	(b) To authorize more limited disclosures of health information to specific health care 
2.8 	providers and other third parties, or to obtain copies of your own medical records, use the 
2.9 	"Minnesota Standard Consent Form to Release Health Information" available through the 
2.10 	Minnesota Department of Health's website.
2.11 	(c) Minnesota law guarantees certain patient privacy and consent rights under Minnesota 
2.12 	Statutes, sections 144.291 to 144.298.
2.13 	(d) You may revoke or modify your consent to share health records in writing at any 
2.14 	time, except that a revocation or modification has no effect on any health records released 
2.15 	prior to the date of revocation or modification.
2.16 	Patient's Medical Consent.
2.17 	Please read the following carefully and check either "yes" or "no" to each item 
2.18 	below.
2.19 	....... Yes ....... No Obtaining Medical Records: I consent to [the above health care 
2.20 	provider] communicating with my current and future health care providers to obtain any 
2.21 	and all previous medical records necessary for my treatment as defined under the federal 
2.22 	Health Insurance Portability and Accountability Act (HIPAA). See attached definition.
2.23 	....... Yes ....... No Releasing Information for Treatment: I consent to [the above health 
2.24 	care provider] sharing information from my medical record with current and future health 
2.25 	care providers involved in my treatment as defined under HIPAA. See attached definition.
2.26 	....... Yes ....... No Releasing Information for Payment: I consent to [the above health 
2.27 	care provider] sharing my information for the purpose of billing and payment as defined 
2.28 	under HIPAA. See attached definition. This sharing of information includes insurers or 
2.29 	third parties responsible for payment of my medical bills.
2.30 	....... Yes ....... No Releasing Information for Health Care Operations: I consent to 
2.31 	[the above health care provider] sharing my information for health care operations as defined 
3.1 	under HIPAA. See attached definition. This includes information sharing for activities 
3.2 	unrelated to treatment for my medical condition.
3.3 	....... Yes ....... No Releasing Information for Medical or Scientific Research: I consent 
3.4 	to [the above health care provider] releasing my medical information for medical or scientific 
3.5 	research.
3.6 	....... Yes ....... No Disclosure of Presence: I authorize [the above health care provider] 
3.7 	to disclose my presence to any person who inquires about me using my full name. This 
3.8 	disclosure is limited to acknowledging my presence and a one-word description of my 
3.9 	condition: critical, serious, fair, or good.
3.10 	Health Information Exchange.
3.11 	....... Yes ....... No Access: I authorize [the above health care provider] to use a health 
3.12 	information exchange (HIE), record locator service (RLS), patient information service (PIS), 
3.13 	clinical data repository (CDR), or master patient index (MPI) for the purpose of accessing 
3.14 	my patient identifying information and information about the location of my medical records. 
3.15 	See attached definitions.
3.16 	....... Yes ....... No Release: I authorize [the above health care provider] to release my 
3.17 	patient identifying information and information about where my medical records are located 
3.18 	to an HIE, RLS, PIS, CDR, or MPI. See attached definitions.
3.19 	Consent Duration.
3.20 	I understand that under Minnesota law, my consent to release my health records for 
3.21 	certain limited purposes listed in Minnesota Statutes, section 144.293, subdivision 6 or 8, 
3.22 	does not expire but may be revoked at any time. For all other purposes described above, I 
3.23 	authorize my consent to be valid for the following length of time:
3.24 	....... One year
3.25 	....... Three years
3.26 	....... Indefinitely (unless I revoke or modify)
3.27 	PATIENT SIGNATURE
3.28 	Patient Name: ..........................................   Date of Birth: ......./......./.......
3.29 	If patient is not signing, name and relationship to patient: ..........................................
3.30 	Signature: ..........................................  Date: ......./......./.......
3.31 	Federal HIPAA Definitions (Code of Federal Regulations, title 45, section 164.501)
4.1 	(a) "Health care operations" means any of the following activities of the covered entity 
4.2 	to the extent that the activities are related to covered functions:
4.3 	(1) conducting quality assessment and improvement activities, including outcomes, 
4.4 	evaluation, and development of clinical guidelines, provided that the obtaining of 
4.5 	generalizable knowledge is not the primary purpose of any studies resulting from the 
4.6 	activities; patient safety activities, as defined in Code of Federal Regulations, title 42, section 
4.7 	3.20; population-based activities relating to improving health or reducing  health care costs, 
4.8 	protocol development, case management and care coordination, contacting of health care 
4.9 	providers and patients with information about  treatment alternatives; and related functions 
4.10 	that do not include treatment;
4.11 	(2) reviewing the competence or qualifications of health care professionals, evaluating 
4.12 	practitioner and provider performance, health plan performance, conducting training programs 
4.13 	in which students, trainees, or practitioners in areas of health care learn under supervision 
4.14 	to practice or improve their skills as health care providers, training of nonhealth care 
4.15 	professionals, accreditation, certification, licensing, or credentialing activities;
4.16 	(3) except as prohibited under Code of Federal Regulations, title 45, section 
4.17 	164.502(a)(5)(i), underwriting, enrollment, premium rating, and other activities related to 
4.18 	the creation, renewal, or replacement of a contract of health insurance or health benefits, 
4.19 	and ceding, securing, or placing a contract for reinsurance of risk relating to claims for 
4.20 	health care, including stop-loss insurance and excess of loss insurance, provided that the 
4.21 	requirements of Code of Federal Regulations, title 45, section 164.514(g), are met, if 
4.22 	applicable;
4.23 	(4) conducting or arranging for medical review, legal services, and auditing functions, 
4.24 	including fraud and abuse detection and compliance programs;
4.25 	(5) business planning and development, such as conducting cost-management and 
4.26 	planning-related analyses related to managing and operating the entity, including formulary 
4.27 	development and administration, development, or improvement of methods of payment or 
4.28 	coverage policies; and
4.29 	(6) business management and general administrative activities of the entity, including, 
4.30 	but not limited to:
4.31 	(i) management activities relating to implementation of and compliance with the 
4.32 	requirements of this subchapter;
5.1 	(ii) customer service, including the provision of data analyses for policyholders, plan 
5.2 	sponsors, or other customers, provided that protected health information is not disclosed to 
5.3 	the policyholder, plan sponsor, or customer;
5.4 	(iii) resolution of internal grievances;
5.5 	(iv) the sale, transfer, merger, or consolidation of all or part of the covered entity with 
5.6 	another covered entity, or an entity that following the activity will become a covered entity 
5.7 	and due diligence related to the activity; and
5.8 	(v) consistent with the applicable requirements of Code of Federal Regulations, title 45, 
5.9 	section 164.514, creating de-identified health information or a limited data set, and 
5.10 	fund-raising for the benefit of the covered entity.
5.11 	(b) "Payment" means:
5.12 	(1) the activities undertaken by:
5.13 	(i) a health plan to obtain premiums or to determine or fulfill its responsibility for 
5.14 	coverage and provision of benefits under the health plan, except as prohibited under Code 
5.15 	of Federal Regulations, title 45, section 164.502(a)(5)(i); or
5.16 	(ii) a health care provider or health plan to obtain or provide reimbursement for the 
5.17 	provision of health care; and
5.18 	(2) the activities in clause (1) relate to the individual to whom health care is provided 
5.19 	and include, but are not limited to:
5.20 	(i) determinations of eligibility or coverage (including coordination of benefits or the 
5.21 	determination of cost-sharing amounts), and adjudication or subrogation of health benefit 
5.22 	claims;
5.23 	(ii) risk-adjusting amounts due based on enrollee health status and demographic 
5.24 	characteristics;
5.25 	(iii) billing, claims management, collection activities, obtaining payment under a contract 
5.26 	for reinsurance (including stop-loss insurance and excess of loss insurance), and related 
5.27 	health care data processing;
5.28 	(iv) review of health care services with respect to medical necessity, coverage under a 
5.29 	health plan, appropriateness of care, or justification of charges;
5.30 	(v) utilization review activities, including precertification and preauthorization of services, 
5.31 	concurrent and retrospective review of services; and
6.1 	(vi) disclosure to consumer reporting agencies of any of the following protected health 
6.2 	information relating to collection of premiums or reimbursement:
6.3 	(A) Name and address;
6.4 	(B) Date of birth;
6.5 	(C) Social Security number;
6.6 	(D) Payment history;
6.7 	(E) Account number; and
6.8 	(F) Name and address of the health care provider or health plan.
6.9 	(c) "Treatment" means the provision, coordination, or management of health care and 
6.10 	related services by one or more health care providers, including the coordination or 
6.11 	management of health care by a health care provider with a third party; consultation between 
6.12 	health care providers relating to a patient; or the referral of a patient for health care from 
6.13 	one health care provider to another.
6.14 	Minnesota Definitions (Minnesota Statutes, sections 62J.498 and 144.291).
6.15 	(a) "Clinical data repository" means a realtime database that consolidates data from a 
6.16 	variety of clinical sources to present a unified view of a single patient and is used by a 
6.17 	state-certified health information exchange service provider to enable health information 
6.18 	exchange among health care providers that are not related health care entities as defined in 
6.19 	section 144.291, subdivision 2, paragraph (j). This does not include clinical data that are 
6.20 	submitted to the commissioner for public health purposes required or permitted by law, 
6.21 	including any rules adopted by the commissioner.
6.22 	(b) "Health care provider" means a person, hospital, or health care facility, organization, 
6.23 	or corporation that is licensed, certified, or otherwise authorized by the laws of this state to 
6.24 	provide health care.
6.25 	(c) "Health information exchange" means a legal arrangement between health care 
6.26 	providers and group purchasers to enable and oversee the business and legal issues involved 
6.27 	in the electronic exchange of health records between the entities for the delivery of patient 
6.28 	care.
6.29 	(d) "Master patient index" means an electronic database that holds unique identifiers of 
6.30 	patients registered at a care facility and is used by a state-certified health information 
6.31 	exchange service provider to enable health information exchange among health care providers 
6.32 	that are not related health care entities as defined in section 144.291, subdivision 2, paragraph 
7.1 	(k). This does not include data that are submitted to the commissioner for public health 
7.2 	purposes required or permitted by law, including any rules adopted by the commissioner.
7.3 	(e) "Patient information service" means a service providing the following query options: 
7.4 	a record locator service or a master patient index or clinical repository.
7.5 	(f) "Record locator service" means an electronic index of patient-identifying information 
7.6 	that directs providers in a health information exchange to the location of patient health 
7.7 	records held by providers and group purchasers.
7.8 		Subd. 2.Failure to check "Yes" or "No." A failure to check "Yes" or "No" on a form 
7.9 	prepared pursuant to this section is presumed to be a "No" and a provider must not disclose 
7.10 	or release any health record under the relevant paragraph.
7.11 		Subd. 3.Exceptions. (a) This section does not apply to a release of or a request for 
7.12 	psychotherapy notes as defined under Code of Federal Regulations, title 45, section 164.501, 
7.13 	as amended. Pursuant to federal law, providers must use a separate consent form.
7.14 	(b) Patient records may not be shared with an insurance company if the patient pays 
7.15 	out-of-pocket in full and requests nondisclosure, as required in Code of Federal Regulations, 
7.16 	title 45, section 164.522(a)(1)(vi).