SF 3109

as introduced - 90th Legislature (2017 - 2018) Posted on 03/09/2018 09:12am

A bill for an act
relating to health; modifying provisions governing access to health records;
conforming certain requirements with federal law; amending Minnesota Statutes
2016, sections 13.05, subdivision 4a; 13.3805, subdivision 1; 13.384, subdivision
3; 13.386, subdivision 3; 72A.501, subdivision 4; 72A.502, subdivisions 6, 12;
144.291, subdivision 2; 144.293, subdivisions 2, 7, 8; Minnesota Statutes 2017
Supplement, section 13.46, subdivision 2; proposing coding for new law in
Minnesota Statutes, chapter 13; repealing Minnesota Statutes 2016, section 144.293,
subdivisions 4, 6, 10.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

Minnesota Statutes 2016, section 13.05, subdivision 4a, is amended to read:

Subd. 4a.

Informed consent for insurance purposes.

Informed consent for insurance
purposes must comply with this subdivision, unless otherwise prescribed by the HIPAA
Standards for Privacy of Individually Identifiable Health Information, Code of Federal
Regulations, title 45, section 164. Informed consent for insurance purposes is not considered
to have been given by an individual subject of data by the signing of a statement authorizing
a government entity to disclose information about the individual to an insurer or its authorized
representative, unless the statement is:

(1) in plain language;

(2) dated;

(3) specific in designating the government entity the data subject is authorizing to disclose
information about the data subject;

(4) specific as to the nature of the information the data subject is authorizing to be
disclosed;

(5) specific as to the persons to whom the data subject is authorizing information to be
disclosed; new text begin and
new text end

(6) specific as to the purpose or purposes for which the information may be used by any
of the persons named in clause (5), both at the time of the disclosure and at any time in the
future deleted text begin ; and deleted text end new text begin .
new text end

deleted text begin (7) specific as to its expiration date, which must be within a reasonable period of time,
not to exceed one year.
deleted text end

deleted text begin Notwithstanding clause (7), in the case of authorizations given in connection with
applications for life insurance or noncancelable or guaranteed renewable health insurance
that is so identified, the expiration date must not exceed two years after the date of the
policy. deleted text end new text begin The duration of an authorization to disclose a health record is governed by the Health
Insurance Portability and Accountability Act of 1996, title II, subtitle F, as amended,
including federal regulations adopted under that act. new text end An authorization in connection with
medical assistance under chapter 256B or MinnesotaCare under chapter 256L or for
individualized education program health-related services provided by a school district under
section 125A.21, subdivision 2, is valid during all terms of eligibility.

Sec. 2.

Minnesota Statutes 2016, section 13.3805, subdivision 1, is amended to read:

Subdivision 1.

Health data generally.

(a) Definitions. As used in this subdivision:

(1) "Commissioner" means the commissioner of health.

(2) "Health data" are data on individuals created, collected, received, or maintained by
the Department of Health, political subdivisions, or statewide systems relating to the
identification, description, prevention, and control of disease or as part of an epidemiologic
investigation the commissioner designates as necessary to analyze, describe, or protect the
public health.

(b) Data on individuals. (1) Health data are private data on individuals. Notwithstanding
section 13.05, subdivision 9, health data may not be disclosed except as provided in this
subdivision and section 13.04.

(2) The commissioner or a community health board as defined in section 145A.02,
subdivision 5, may disclose health data to the data subject's physician as necessary to locate
or identify a case, carrier, or suspect case, to establish a diagnosis, to provide treatment, to
identify persons at risk of illness, or to conduct an epidemiologic investigation.

(3) With the approval of the commissioner, health data may be disclosed to the extent
necessary to assist the commissioner to locate or identify a case, carrier, or suspect case, to
alert persons who may be threatened by illness as evidenced by epidemiologic data, to
control or prevent the spread of serious disease, or to diminish an imminent threat to the
public health.

new text begin (4) If permitted or required under the Health Insurance Portability and Accountability
Act of 1996, title II, subtitle F, as amended, including federal regulations adopted under
that act.
new text end

(c) Health summary data. Summary data derived from data collected under section
145.413 may be provided under section 13.05, subdivision 7.

Sec. 3.

Minnesota Statutes 2016, section 13.384, subdivision 3, is amended to read:

Subd. 3.

Classification of medical data.

Unless the data is summary data or a statute
specifically provides a different classification, medical data are private but are available
only to the subject of the data as provided in sections 144.291 to 144.298, and shall not be
disclosed to others except:

(a) pursuant to section 13.05;

(b) pursuant to section 253B.0921;

(c) pursuant to a valid court order;

(d) to administer federal funds or programs;

(e) to the surviving spouse, parents, children, siblings, and health care agent of a deceased
patient or client or, if there are no surviving spouse, parents, children, siblings, or health
care agent to the surviving heirs of the nearest degree of kindred;

(f) to communicate a patient's or client's condition to a family member, health care agent,
or other appropriate person in accordance with acceptable medical practice, unless the
patient or client directs otherwise; deleted text begin or
deleted text end

(g) as otherwise required by law deleted text begin . deleted text end new text begin ; or
new text end

new text begin (h) as permitted or required under the Health Insurance Portability and Accountability
Act of 1996, title II, subtitle F, as amended, including federal regulations adopted under
that act.
new text end

Sec. 4.

Minnesota Statutes 2016, section 13.386, subdivision 3, is amended to read:

Subd. 3.

Collection, storage, use, and dissemination of genetic information.

(a) Unless
otherwise expressly provided by law, genetic information about an individual:

(1) may be collected by a government entity, as defined in section 13.02, subdivision
7a, or any other person only with the written informed consent of the individual;

(2) may be used only for purposes to which the individual has given written informed
consent;

(3) may be stored only for a period of time to which the individual has given written
informed consent; and

(4) may be disseminated only:

(i) with the individual's written informed consent; or

(ii) if necessary in order to accomplish purposes described by clause (2). A consent to
disseminate genetic information under item (i) must be signed and dated. Unless otherwise
provided by law, such a consent is valid for one year or for a lesser period specified in the
consent.

(b) Newborn screening activities conducted under sections 144.125 to 144.128 are subject
to paragraph (a). Other programs and activities governed under section 144.192 are not
subject to paragraph (a).

new text begin (c) Notwithstanding paragraph (a), genetic information may be collected, used, stored,
or disseminated as permitted or required under the Health Insurance Portability and
Accountability Act of 1996, title II, subtitle F, as amended, including federal regulations
adopted under that act.
new text end

Sec. 5.

new text begin [13.388] HEALTH RECORDS.
new text end

new text begin A health record, as defined in section 144.291, subdivision 2, paragraph (c), is private
data on individuals. A health record may not be disclosed except as provided in this chapter
or as permitted or required under the Health Insurance Portability and Accountability Act
of 1996, title II, subtitle F, as amended, including federal regulations adopted under that
act.
new text end

Sec. 6.

Minnesota Statutes 2017 Supplement, section 13.46, subdivision 2, is amended to
read:

Subd. 2.

General.

(a) Data on individuals collected, maintained, used, or disseminated
by the welfare system are private data on individuals, and shall not be disclosed except:

(1) according to section 13.05;

(2) according to court order;

(3) according to a statute specifically authorizing access to the private data;

(4) to an agent of the welfare system and an investigator acting on behalf of a county,
the state, or the federal government, including a law enforcement person or attorney in the
investigation or prosecution of a criminal, civil, or administrative proceeding relating to the
administration of a program;

(5) to personnel of the welfare system who require the data to verify an individual's
identity; determine eligibility, amount of assistance, and the need to provide services to an
individual or family across programs; coordinate services for an individual or family;
evaluate the effectiveness of programs; assess parental contribution amounts; and investigate
suspected fraud;

(6) to administer federal funds or programs;

(7) between personnel of the welfare system working in the same program;

(8) to the Department of Revenue to assess parental contribution amounts for purposes
of section 252.27, subdivision 2a, administer and evaluate tax refund or tax credit programs
and to identify individuals who may benefit from these programs. The following information
may be disclosed under this paragraph: an individual's and their dependent's names, dates
of birth, Social Security numbers, income, addresses, and other data as required, upon
request by the Department of Revenue. Disclosures by the commissioner of revenue to the
commissioner of human services for the purposes described in this clause are governed by
section 270B.14, subdivision 1. Tax refund or tax credit programs include, but are not limited
to, the dependent care credit under section 290.067, the Minnesota working family credit
under section 290.0671, the property tax refund and rental credit under section 290A.04,
and the Minnesota education credit under section 290.0674;

(9) between the Department of Human Services, the Department of Employment and
Economic Development, and when applicable, the Department of Education, for the following
purposes:

(i) to monitor the eligibility of the data subject for unemployment benefits, for any
employment or training program administered, supervised, or certified by that agency;

(ii) to administer any rehabilitation program or child care assistance program, whether
alone or in conjunction with the welfare system;

(iii) to monitor and evaluate the Minnesota family investment program or the child care
assistance program by exchanging data on recipients and former recipients of food support,
cash assistance under chapter 256, 256D, 256J, or 256K, child care assistance under chapter
119B, medical programs under chapter 256B or 256L, or a medical program formerly
codified under chapter 256D; and

(iv) to analyze public assistance employment services and program utilization, cost,
effectiveness, and outcomes as implemented under the authority established in Title II,
Sections 201-204 of the Ticket to Work and Work Incentives Improvement Act of 1999.
Health records governed by sections 144.291 to 144.298 and "protected health information"
as defined in Code of Federal Regulations, title 45, section 160.103, and governed by Code
of Federal Regulations, title 45, parts 160-164, including health care claims utilization
information, must not be exchanged under this clause;

(10) to appropriate parties in connection with an emergency if knowledge of the
information is necessary to protect the health or safety of the individual or other individuals
or persons;

(11) data maintained by residential programs as defined in section 245A.02 may be
disclosed to the protection and advocacy system established in this state according to Part
C of Public Law 98-527 to protect the legal and human rights of persons with developmental
disabilities or other related conditions who live in residential facilities for these persons if
the protection and advocacy system receives a complaint by or on behalf of that person and
the person does not have a legal guardian or the state or a designee of the state is the legal
guardian of the person;

(12) to the county medical examiner or the county coroner for identifying or locating
relatives or friends of a deceased person;

(13) data on a child support obligor who makes payments to the public agency may be
disclosed to the Minnesota Office of Higher Education to the extent necessary to determine
eligibility under section 136A.121, subdivision 2, clause (5);

(14) participant Social Security numbers and names collected by the telephone assistance
program may be disclosed to the Department of Revenue to conduct an electronic data
match with the property tax refund database to determine eligibility under section 237.70,
subdivision 4a;

(15) the current address of a Minnesota family investment program participant may be
disclosed to law enforcement officers who provide the name of the participant and notify
the agency that:

(i) the participant:

(A) is a fugitive felon fleeing to avoid prosecution, or custody or confinement after
conviction, for a crime or attempt to commit a crime that is a felony under the laws of the
jurisdiction from which the individual is fleeing; or

(B) is violating a condition of probation or parole imposed under state or federal law;

(ii) the location or apprehension of the felon is within the law enforcement officer's
official duties; and

(iii) the request is made in writing and in the proper exercise of those duties;

(16) the current address of a recipient of general assistance may be disclosed to probation
officers and corrections agents who are supervising the recipient and to law enforcement
officers who are investigating the recipient in connection with a felony level offense;

(17) information obtained from food support applicant or recipient households may be
disclosed to local, state, or federal law enforcement officials, upon their written request, for
the purpose of investigating an alleged violation of the Food Stamp Act, according to Code
of Federal Regulations, title 7, section 272.1(c);

(18) the address, Social Security number, and, if available, photograph of any member
of a household receiving food support shall be made available, on request, to a local, state,
or federal law enforcement officer if the officer furnishes the agency with the name of the
member and notifies the agency that:

(i) the member:

(A) is fleeing to avoid prosecution, or custody or confinement after conviction, for a
crime or attempt to commit a crime that is a felony in the jurisdiction the member is fleeing;

(B) is violating a condition of probation or parole imposed under state or federal law;
or

(C) has information that is necessary for the officer to conduct an official duty related
to conduct described in subitem (A) or (B);

(ii) locating or apprehending the member is within the officer's official duties; and

(iii) the request is made in writing and in the proper exercise of the officer's official duty;

(19) the current address of a recipient of Minnesota family investment program, general
assistance, or food support may be disclosed to law enforcement officers who, in writing,
provide the name of the recipient and notify the agency that the recipient is a person required
to register under section 243.166, but is not residing at the address at which the recipient is
registered under section 243.166;

(20) certain information regarding child support obligors who are in arrears may be
made public according to section 518A.74;

(21) data on child support payments made by a child support obligor and data on the
distribution of those payments excluding identifying information on obligees may be
disclosed to all obligees to whom the obligor owes support, and data on the enforcement
actions undertaken by the public authority, the status of those actions, and data on the income
of the obligor or obligee may be disclosed to the other party;

(22) data in the work reporting system may be disclosed under section 256.998,
subdivision 7;

(23) to the Department of Education for the purpose of matching Department of Education
student data with public assistance data to determine students eligible for free and
reduced-price meals, meal supplements, and free milk according to United States Code,
title 42, sections 1758, 1761, 1766, 1766a, 1772, and 1773; to allocate federal and state
funds that are distributed based on income of the student's family; and to verify receipt of
energy assistance for the telephone assistance plan;

(24) the current address and telephone number of program recipients and emergency
contacts may be released to the commissioner of health or a community health board as
defined in section 145A.02, subdivision 5, when the commissioner or community health
board has reason to believe that a program recipient is a disease case, carrier, suspect case,
or at risk of illness, and the data are necessary to locate the person;

(25) to other state agencies, statewide systems, and political subdivisions of this state,
including the attorney general, and agencies of other states, interstate information networks,
federal agencies, and other entities as required by federal regulation or law for the
administration of the child support enforcement program;

(26) to personnel of public assistance programs as defined in section 256.741, for access
to the child support system database for the purpose of administration, including monitoring
and evaluation of those public assistance programs;

(27) to monitor and evaluate the Minnesota family investment program by exchanging
data between the Departments of Human Services and Education, on recipients and former
recipients of food support, cash assistance under chapter 256, 256D, 256J, or 256K, child
care assistance under chapter 119B, medical programs under chapter 256B or 256L, or a
medical program formerly codified under chapter 256D;

(28) to evaluate child support program performance and to identify and prevent fraud
in the child support program by exchanging data between the Department of Human Services,
Department of Revenue under section 270B.14, subdivision 1, paragraphs (a) and (b),
without regard to the limitation of use in paragraph (c), Department of Health, Department
of Employment and Economic Development, and other state agencies as is reasonably
necessary to perform these functions;

(29) counties operating child care assistance programs under chapter 119B may
disseminate data on program participants, applicants, and providers to the commissioner of
education;

(30) child support data on the child, the parents, and relatives of the child may be
disclosed to agencies administering programs under titles IV-B and IV-E of the Social
Security Act, as authorized by federal law;

(31) to a health care provider governed by sections 144.291 to 144.298, to the extent
necessary to coordinate services;

(32) to the chief administrative officer of a school to coordinate services for a student
and family; data that may be disclosed under this clause are limited to name, date of birth,
gender, and address; deleted text begin or
deleted text end

(33) to county correctional agencies to the extent necessary to coordinate services and
diversion programs; data that may be disclosed under this clause are limited to name, client
demographics, program, case status, and county worker information deleted text begin . deleted text end new text begin ; or
new text end

new text begin (34) as permitted or required under the Health Insurance Portability and Accountability
Act of 1996, title II, subtitle F, as amended, including federal regulations adopted under
that act.
new text end

(b) Information on persons who have been treated for drug or alcohol abuse may only
be disclosed according to the requirements of Code of Federal Regulations, title 42, sections
2.1 to 2.67.

(c) Data provided to law enforcement agencies under paragraph (a), clause (15), (16),
(17), or (18), or paragraph (b), are investigative data and are confidential or protected
nonpublic while the investigation is active. The data are private after the investigation
becomes inactive under section 13.82, subdivision 5, paragraph (a) or (b).

(d) Mental health data shall be treated as provided in subdivisions 7, 8, and 9, but are
not subject to the access provisions of subdivision 10, paragraph (b).

For the purposes of this subdivision, a request will be deemed to be made in writing if
made through a computer interface system.

Sec. 7.

Minnesota Statutes 2016, section 72A.501, subdivision 4, is amended to read:

Subd. 4.

Authorization; noninsurers.

If an authorization is submitted to an insurer,
insurance-support organization, or insurance agent by a person other than an insurer,
insurance-support organization, or insurance agent, the authorization must be dated, signed
by the person deleted text begin , and obtained one year or less before the date a disclosure is sought deleted text end . new text begin Unless
otherwise required by law, this authorization does not expire, unless an expiration date or
event is specified in the authorization.
new text end

Sec. 8.

Minnesota Statutes 2016, section 72A.502, subdivision 6, is amended to read:

Subd. 6.

Other laws or order.

Personal or privileged information may be disclosed
without a written authorization if permitted or required by another new text begin state or federal new text end law new text begin or
regulation new text end or in response to a facially valid administrative or judicial order, including a
search warrant or subpoena.

Sec. 9.

Minnesota Statutes 2016, section 72A.502, subdivision 12, is amended to read:

Subd. 12.

Notice.

Whenever an insurer, insurance agent, or insurance-support organization
discloses personal or privileged information about a person that requires the written
authorization of that person under this section, the insurer, insurance agent, or
insurance-support organization shall notify that person in writing within ten days of the date
the information was disclosed. The notification must specify the identity of the person to
whom information was disclosed and the nature and substance of the information that was
disclosed. A notice is not required to be given under this subdivision if an insurer is disclosing
personal information for underwriting purposes to another insurer, or to an insurance-support
organization if the person had signed an authorization authorizing the disclosure. new text begin A notice
is not required under this subdivision if the disclosing entity is subject to and complies with
Code of Federal Regulations, title 45, chapter A, subchapter C, part 164, subpart D, sections
164.400 to 164.414.
new text end

Sec. 10.

Minnesota Statutes 2016, section 144.291, subdivision 2, is amended to read:

Subd. 2.

Definitions.

For the purposes of sections 144.291 to 144.298, the following
terms have the meanings given.

(a) "Group purchaser" has the meaning given in section 62J.03, subdivision 6.

(b) "Health information exchange" means a legal arrangement between health care
providers and group purchasers to enable and oversee the business and legal issues involved
in the electronic exchange of health records between the entities for the delivery of patient
care.

(c) "Health record" means any deleted text begin information, whether oral or recorded in any form or
medium, that relates to the past, present, or future physical or mental health or condition of
a patient; the provision of health care to a patient; or the past, present, or future payment
for the provision of health care to a deleted text end patient new text begin information that is protected health information
as defined in HIPAA new text end .

(d) new text begin "HIPAA" means the Health Insurance Portability and Accountability Act of 1996,
title II, subtitle F, as amended, including federal regulations adopted under that act.
new text end

new text begin (e) new text end "Identifying information" means the patient's name, address, date of birth, gender,
parent's or guardian's name regardless of the age of the patient, and other nonclinical data
which can be used to uniquely identify a patient.

deleted text begin (e) deleted text end new text begin (f) new text end "Individually identifiable form" means a form in which the patient is or can be
identified as the subject of the health records.

deleted text begin (f) deleted text end new text begin (g) new text end "Medical emergency" means medically necessary care which is immediately
needed to preserve life, prevent serious impairment to bodily functions, organs, or parts, or
prevent placing the physical or mental health of the patient in serious jeopardy.

deleted text begin (g) deleted text end new text begin (h) new text end "Patient" means a natural person who has received health care services from a
provider for treatment or examination of a medical, psychiatric, or mental condition, the
surviving spouse and parents of a deceased patient, or a person the patient appoints in writing
as a representative, including a health care agent acting according to chapter 145C, unless
the authority of the agent has been limited by the principal in the principal's health care
directive. Except for minors who have received health care services under sections 144.341
to 144.347, in the case of a minor, patient includes a parent or guardian, or a person acting
as a parent or guardian in the absence of a parent or guardian.

deleted text begin (h) deleted text end new text begin (i) new text end "Patient information service" means a service providing the following query
options: a record locator service as defined in paragraph deleted text begin (j) deleted text end new text begin (k) new text end or a master patient index or
clinical data repository as defined in section 62J.498, subdivision 1.

deleted text begin (i) deleted text end new text begin (j) new text end "Provider" deleted text begin means deleted text end new text begin or "health care provider" has the meaning given in Code of
Federal Regulations, title 45, chapter A, subchapter C, part 160, subpart A, section 160.103,
and includes new text end :

(1) any person who furnishes health care services and is regulated to furnish the services
under chapter 147, 147A, 147B, 147C, 147D, 148, 148B, 148D, 148F, 150A, 151, 153, or
153A;

(2) a home care provider licensed under section 144A.471;

(3) a health care facility licensed under this chapter or chapter 144A; and

(4) a physician assistant registered under chapter 147A.

deleted text begin (j) deleted text end new text begin (k) new text end "Record locator service" means an electronic index of patient identifying
information that directs providers in a health information exchange to the location of patient
health records held by providers and group purchasers.

deleted text begin (k) deleted text end new text begin (l) new text end "Related health care entity" means an affiliate, as defined in section 144.6521,
subdivision 3, paragraph (b), of the provider releasing the health records.

Sec. 11.

Minnesota Statutes 2016, section 144.293, subdivision 2, is amended to read:

Subd. 2.

deleted text begin Patient consent to release deleted text end new text begin Disclosure new text end of new text begin patient new text end records.

A provider deleted text begin , or a
person who receives health records from a provider, may not release a patient's health records
to a person without:
deleted text end

deleted text begin (1) a signed and dated consent from the patient or the patient's legally authorized
representative authorizing the release;
deleted text end

deleted text begin (2) specific authorization in law; or
deleted text end

deleted text begin (3) a representation from a provider that holds a signed and dated consent from the
patient authorizing the release. deleted text end new text begin may disclose health records if that disclosure is in compliance
with Code of Federal Regulations, title 45, chapter A, subchapter C, part 164, subpart E,
sections 164.500 to 164.514, regardless of whether the provider is a covered entity under
HIPAA, or if the disclosure is permitted or required by other federal or state law.
new text end

Sec. 12.

Minnesota Statutes 2016, section 144.293, subdivision 7, is amended to read:

Subd. 7.

deleted text begin Exception to consent deleted text end new text begin Encryption required new text end .

deleted text begin Subdivision 2 does not apply to
the release of deleted text end new text begin If a new text end health deleted text begin records deleted text end new text begin record is disclosed new text end to the commissioner of health or the
Health Data Institute under chapter 62J, deleted text begin provided that the commissioner encrypts deleted text end the patient
identifier new text begin must be encrypted new text end upon receipt of the data.

Sec. 13.

Minnesota Statutes 2016, section 144.293, subdivision 8, is amended to read:

Subd. 8.

Record locator or patient information service.

(a) A provider or group
purchaser may release patient identifying information and information about the location
of the patient's health records to a record locator or patient information service without
consent from the patient, unless the patient has elected to be excluded from the service under
paragraph (d). The Department of Health may not access the record locator or patient
information service or receive data from the service. Only a provider may have access to
patient identifying information in a record locator or patient information service. Except in
the case of a medical emergency, a provider participating in a health information exchange
using a record locator or patient information service does not have access to patient
identifying information and information about the location of the patient's health records
unless the patient deleted text begin specifically consents to the deleted text end new text begin elects not to allow new text end access. deleted text begin A consent does not
expire but may be revoked by the patient at any time by providing written notice of the
revocation to the provider.
deleted text end

(b) A health information exchange maintaining a record locator or patient information
service must maintain an audit log of providers accessing information in the service that at
least contains information on:

(1) the identity of the provider accessing the information;

(2) the identity of the patient whose information was accessed by the provider; and

(3) the date the information was accessed.

(c) No group purchaser may in any way require a provider to participate in a record
locator or patient information service as a condition of payment or participation.

(d) new text begin Upon request, new text end a provider or an entity operating a record locator or patient information
service must provide a mechanism under which patients may exclude their identifying
information and information about the location of their health records from a record locator
or patient information service. deleted text begin At a minimum, a consent form that permits a provider to
access a record locator or patient information service must include a conspicuous check-box
option that allows a patient to exclude all of the patient's information from the service. deleted text end A
provider participating in a health information exchange with a record locator or patient
information service who receives a patient's request to exclude all of the patient's information
from the service or to have a specific provider contact excluded from the service is
responsible for removing that information from the service.

Sec. 14. new text begin REPEALER.
new text end

new text begin Minnesota Statutes 2016, section 144.293, subdivisions 4, 6, and 10, new text end new text begin are repealed.
new text end

APPENDIX

Repealed Minnesota Statutes: 18-6502

144.293 RELEASE OR DISCLOSURE OF HEALTH RECORDS.

Subd. 4.

Duration of consent.

Except as provided in this section, a consent is valid for one year or for a period specified in the consent or for a different period provided by law.

Subd. 6.

Consent does not expire.

Notwithstanding subdivision 4, if a patient explicitly gives informed consent to the release of health records for the purposes and restrictions in clause (1), (2), or (3), the consent does not expire after one year for:

(1) the release of health records to a provider who is being advised or consulted with in connection with the releasing provider's current treatment of the patient;

(2) the release of health records to an accident and health insurer, health service plan corporation, health maintenance organization, or third-party administrator for purposes of payment of claims, fraud investigation, or quality of care review and studies, provided that:

(i) the use or release of the records complies with sections 72A.49 to 72A.505;

(ii) further use or release of the records in individually identifiable form to a person other than the patient without the patient's consent is prohibited; and

(iii) the recipient establishes adequate safeguards to protect the records from unauthorized disclosure, including a procedure for removal or destruction of information that identifies the patient; or

(3) the release of health records to a program in the welfare system, as defined in section 13.46, to the extent necessary to coordinate services for the patient.

Subd. 10.

Warranties regarding consents, requests, and disclosures.

(a) When requesting health records using consent, a person warrants that the consent:

(1) contains no information known to the person to be false; and

(2) accurately states the patient's desire to have health records disclosed or that there is specific authorization in law.

(b) When requesting health records using consent, or a representation of holding a consent, a provider warrants that the request:

(1) contains no information known to the provider to be false;

(2) accurately states the patient's desire to have health records disclosed or that there is specific authorization in law; and

(3) does not exceed any limits imposed by the patient in the consent.

(c) When disclosing health records, a person releasing health records warrants that the person:

(1) has complied with the requirements of this section regarding disclosure of health records;

(2) knows of no information related to the request that is false; and

(3) has complied with the limits set by the patient in the consent.