1.1 	A bill for an act
1.2 	relating to human services; requiring a license holder to destroy personal 
1.3 	information upon closure; providing remedies;amending Minnesota Statutes 2018, 
1.4 	section 245A.04, subdivision 15a; proposing coding for new law in Minnesota 
1.5 	Statutes, chapter 245A.
1.6 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.7 	Section 1. Minnesota Statutes 2018, section 245A.04, subdivision 15a, is amended to read:
1.8 		Subd. 15a.Plan for transfer of clients and records upon closure. (a) Except for license 
1.9 	holders who reside on the premises and child care providers, an applicant for initial or 
1.10 	continuing licensure or certification must submit a written plan indicating how the program 
1.11 	will ensure the transfer of clients and records for both open and closed cases if the program 
1.12 	closes. The plan must provide for managing private and confidential information concerning 
1.13 	program clients. The plan must also provide for notifying affected clients of the closure at 
1.14 	least 25 days prior to closure, including information on how to access their records. For 
1.15 	licensed residential programs, the plan must also indicate how the program will ensure 
1.16 	compliance with destruction of personal information as required under section 245A.0415. 
1.17 	A controlling individual of the program must annually review and sign the plan.
1.18 	(b) Plans for the transfer of open cases and case records must specify arrangements the 
1.19 	program will make to transfer clients to another provider or county agency for continuation 
1.20 	of services and to transfer the case record with the client.
1.21 	(c) Plans for the transfer of closed case records must be accompanied by a signed 
1.22 	agreement or other documentation indicating that a county or a similarly licensed provider 
2.1 	has agreed to accept and maintain the program's closed case records and to provide follow-up 
2.2 	services as necessary to affected clients.
2.3 	(d) Plans for destruction of personal information must be accompanied by a signed 
2.4 	agreement or other documentation indicating that the licensed residential program or 
2.5 	responsible third party will ensure compliance with section 245A.0415 and any other 
2.6 	applicable state or federal law regarding destruction of personal information.

2.7 	Sec. 2. [245A.0415] TREATMENT OF PERSONAL INFORMATION UPON 
2.8 	CLOSURE.
2.9 		Subdivision 1.Application. This section applies to license holders that operate and 
2.10 	former license holders that operated a residential program.
2.11 		Subd. 2.Definition; license holder. For purposes of this section, "license holder" 
2.12 	includes former license holders.
2.13 		Subd. 3.Definition; personal information. (a) For purposes of this section, "personal 
2.14 	information" means the following information about a person that received services in a 
2.15 	residential program: a person's first name or first initial and last name combined with:
2.16 	(1) a Social Security number, part of a Social Security number, or tax identification 
2.17 	number;
2.18 	(2) a nontruncated driver's license number, state-issued identification card number, 
2.19 	passport number, military identification number, or other unique identification number 
2.20 	issued on a government document used to verify the identity of a specific individual;
2.21 	(3) a financial account number, including a bank account number, credit card number, 
2.22 	or debit card number, in combination with any security code, access code, password, 
2.23 	expiration date, or personal identification number, that is necessary to access the financial 
2.24 	account or to conduct a transaction that will credit or debit the financial account;
2.25 	(4) any information regarding an individual's medical history, mental or physical 
2.26 	condition, or medical treatment or diagnosis by a health care professional;
2.27 	(5) an individual's health insurance policy number, subscriber identification number, or 
2.28 	any unique identifier used by a health insurer to identify the individual;
2.29 	(6) a username or e-mail address, in combination with a password or security question 
2.30 	and answer that would permit access to an online account; or
2.31 	(7) any other information maintained by the program.
3.1 	(b) Personal information does not include information that is encrypted or modified by 
3.2 	any other method or technology that removes elements that identify an individual or that 
3.3 	otherwise renders the information unusable, including encryption of the data, document, or 
3.4 	device containing the personal information, unless the license holder or responsible third 
3.5 	party knows or has reason to know that the encryption key or security credential that could 
3.6 	render the personal information readable or useable has been breached.
3.7 		Subd. 4.Duty to destroy. A license holder who ceases to provide services under this 
3.8 	chapter, or the responsible third party under section 245A.041, subdivision 3, paragraph 
3.9 	(b), must destroy all personal information within the license holder's or third party's custody 
3.10 	or control when retention of the information is no longer required by section 245A.041 or 
3.11 	any other applicable state or federal requirement, whichever is latest. A license holder or 
3.12 	the responsible third party must destroy personal information stored in paper, electronic, or 
3.13 	any other format in a manner that renders the information unreadable or undecipherable by 
3.14 	any reasonable means consistent with industry standards. A license holder or the responsible 
3.15 	third party must submit a certificate of destruction to the commissioner, providing a detailed 
3.16 	description of compliance with this section.
3.17 		Subd. 5.Enforcement. (a) A person aggrieved by a violation of this section may bring 
3.18 	an action under section 13.08 against a license holder or a responsible third party.
3.19 	(b) The commissioner retains enforcement and oversight jurisdiction over a license 
3.20 	holder who ceases to provide services for purposes of enforcing this section. The 
3.21 	commissioner may seek penalties against a license holder or a responsible third party for a 
3.22 	violation of this section pursuant to any enforcement powers conferred upon the 
3.23 	commissioner.
3.24 		Subd. 6.Exemption. This section does not apply if the license holder transfers ownership 
3.25 	of all or part of a residential program.

3.26 	EFFECTIVE DATE. This section is effective January 1, 2021, and applies to license 
3.27 	holders who cease to provide services on or after that date.