Minnesota law takes several steps to protect the confidentiality of patient health information.  Patients in health care facilities have a right to have their medical records remain confidential.1  Like most other states, Minnesota requires a patient’s written, signed consent before a health care provider can release the patient’s health records.  Patient consent is also required before a provider may transfer a patient’s medical record to another provider.  The law validates patient consent for up to one year, with certain exceptions for treatment, payment and other purposes.2  Minnesota also has specific laws governing the permissible disclosure of a patient’s mental health information to family members and law enforcement.3  Consent is also needed before an insurance company or health maintenance organization is permitted to disclose individually identifiable information, unless the disclosure is to a health care provider for insurance verification purposes or to detect fraud or criminal activity.4  Minnesota law also requires health care providers and health plans to collect and report certain information to the Commissioner of Health.  While the law does not require patient consent to disclose the information to the Commissioner, it does require that the information remain confidential.5

            Individual level data collected for public health purposes and disease surveillance must remain private under Minnesota law.6  Similarly, test results for blood borne pathogens must not be disclosed without the patient’s written consent.7   The law is so protective of the confidentiality of these test results that it makes it a misdemeanor for any health care facility or individual to willfully violate the disclosure, consent or other laws pertaining to the blood borne pathogen testing, reporting or recording.8

            Minnesota also has certain laws put in place to ensure the privacy and confidentiality of health information used for research purposes.  Information collected by the Commissioner of Health for research studies must remain confidential and only be used for research purposes.9  The Commissioner must ensure that any such data does not identify the patient and is aggregated data.10  Health care providers must obtain patient authorization before releasing medical records created after Jan. 1, 1997 to researchers.  The researcher also has an obligation to ensure that individually identifiable information is not released without the patient’s consent.11  Health insurers, however, do not need patient authorization before disclosing personal information for research purposes, as long as the information is de-identified.12