Health record rights in Minnesota: what state law adds
In Minnesota, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a free copy of your record in some cases; your records join the health information exchange only if you agree; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue over misuse of your records; breach notices need not cover medical or health insurance information; and a law on AI in care is signed but not yet in force (it takes effect January 1, 2027). Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general. Same answer in 11 of the 50 states, counting this one.
Are there rules for AI used in your care?Signed, not yet in forceNot yet. A law is signed and takes effect January 1, 2027. Until then, none is in force. Same answer in 2 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
MCDPA requires opt-in consent for health data from 2025-07-31. It is not a dedicated consumer health data law and has no separate sale authorization. 325F.995 adds consent rules for genetic testing companies.
Minnesota Consumer Data Privacy Act, responsibilities of controllers (sensitive data consent). Minn. Stat. 325M.16, subd. 2(d)
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
a controller may not process sensitive data concerning a consumer without obtaining the consumer's consent
Who it binds, in our words: during a calendar year, controls or processes personal data of 100,000 consumers or more (325M.12, subd. 1); HIPAA protected health information and 144.291 health records are excluded
Minnesota Consumer Data Privacy Act, definition of sensitive data. Minn. Stat. 325M.11(v)
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis
Who it binds, in our words: Controllers within 325M.12 scope
Minnesota Consumer Data Privacy Act, scope and exclusions. Minn. Stat. 325M.12, subd. 1 and 2
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
during a calendar year, controls or processes personal data of 100,000 consumers or more
Who it binds, in our words: Or derives over 25 percent of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more. Excludes protected health information, as defined by and for purposes of the Health Insurance Portability and Accountability Act.
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
obtain a consumer's express consent to collect, use, and disclose the consumer's genetic data
Who it binds, in our words: Direct-to-consumer genetic testing companies; enforced by the commissioner of commerce under 45.027
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy element met: no fee for reviewing current medical care, and for Social Security disability appeals. Both go beyond HIPAA and 45 CFR 171.302. Deadline is 30 calendar days, not shorter than HIPAA.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Free copy: Copy requested for purposes of reviewing current medical care (144.292, subd. 6(a))
Free copy: Copy for appealing a denial of Social Security disability benefits: no per page or x-ray fee; no fee at all, including retrieval, when the patient receives public assistance or has a civil legal services or volunteer attorney (144.292, subd. 6(d))
Free copy: Up to two medical record updates without charge for further Social Security disability appeals (144.292, subd. 6(d))
Fee rule: Paper copies: $1 per page, plus $10 for time spent retrieving and copying the records
Fee rule: X-rays: a total of $30 for retrieving and reproducing x-rays
Fee rule: Electronic copies: a total of $20 for retrieving the records
Fee rule: Paper totals capped: $10 if no records; $30 up to 25 pages; $50 up to 100 pages; $50 plus 20 cents per page from page 101; $500 for any request
Goes beyond the federal floor: yes.
Minnesota Health Records Act, patient rights, cost of copies. Minn. Stat. 144.292, subd. 6
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
When a patient requests a copy of the patient's record for purposes of reviewing current medical care, the provider must not charge a fee.
Who it binds, in our words: Providers as defined in 144.291, subd. 2
Minnesota Health Records Act, free copies for Social Security disability appeals. Minn. Stat. 144.292, subd. 6(d)
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
must not charge a fee, including a retrieval fee, to provide copies of records requested by a patient or the patient's authorized representative if the request for copies of records is for purposes of appealing a denial of Social Security disability income
Who it binds, in our words: Providers and their representatives; full waiver when the patient receives public assistance or is represented by a civil legal services or volunteer attorney program
Minnesota Health Records Act, copies of health records to patients (deadline). Minn. Stat. 144.292, subd. 5
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
a provider, at a reasonable cost to the patient, shall furnish to the patient within 30 calendar days of receiving a written request for medical records
Who it binds, in our words: Providers as defined in 144.291, subd. 2
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-in. Your records go through the exchange only after you agree.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Release of records needs signed patient consent. Only the record locator index is opt-out, and providers need specific consent to access it. Because routine data already needs consent, stricterForSensitive is false.
Set by state law.
Designated exchange: No single state-designated HIE. MDH certifies HIOs under 62J.4981; Koble-MN is listed as certified through May 15, 2027.
Minnesota Health Records Act, patient consent to release of records. Minn. Stat. 144.293, subd. 2
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
A provider, or a person who receives health records from a provider, may not release a patient's health records to a person without:
Who it binds, in our words: Providers and persons receiving records from providers; exceptions in subd. 5 for emergencies and related health care entities for current treatment
Minnesota Health Records Act, record locator or patient information service. Minn. Stat. 144.293, subd. 8
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
unless the patient has elected to be excluded from the service under paragraph (d)
Who it binds, in our words: Providers, group purchasers and HIEs operating a record locator or patient information service
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
An out-of-state subpoena law or court order on reproductive health care records is not a specific authorization in law under 144.293, subd. 2. Release then needs patient consent.
Health records; reproductive health care services. Minn. Stat. 144.2935, subd. 2
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
Neither a law in another state authorizing a civil or criminal subpoena to obtain a patient's health records relating to the provision of reproductive health care services to the patient, nor an order issued by a court in another state
Who it binds, in our words: Health records relating to reproductive health care services
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
144.294 sets disclosure rules for mental health records to family members and law enforcement. A 2026 cross-reference change to subd. 2 takes effect 2028-01-01.
Records relating to mental health, release to family and caretaker. Minn. Stat. 144.294, subd. 3
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
If a provider reasonably determines that providing information under this subdivision would be detrimental to the physical or mental health of the patient or is likely to cause the patient to inflict self harm or to harm another, the provider must not disclose the information.
Who it binds, in our words: Providers of mental health care and treatment
Signed, not yet in force · effective · read October 3, 2026 · source(revisor.mn.gov)
Notwithstanding section 144.293, subdivisions 2 and 4, a provider must disclose health records relating to a patient's mental health to a law enforcement agency if the law enforcement agency provides the name of the patient and communicates that the:
Who it binds, in our words: Providers; changes the mental health crisis definition reference to 245I.24
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The rule covers court-ordered HIV tests of offenders. Results are private or released only with consent. Bloodborne pathogen test results for emergency workers fall under 144.7411.
Testing sex offender for human immunodeficiency virus, disclosure of test results. Minn. Stat. 611A.19, subd. 2
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
The date and results of a test performed under subdivision 1 are private data as defined in section 13.02, subdivision 12, when maintained by a person subject to chapter 13, or may be released only with the subject's consent, if maintained by a person not subject to chapter 13.
Who it binds, in our words: HIV tests of offenders ordered under 611A.19, subd. 1
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
13.386 requires written informed consent to collect, use, store or disseminate genetic information. 325F.995 requires express consent from genetic testing companies.
Treatment of genetic information held by government entities and other persons. Minn. Stat. 13.386, subd. 3
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
or any other person only with the written informed consent of the individual;
Who it binds, in our words: Government entities and any other person collecting genetic information
Genetic Information Privacy Act. Minn. Stat. 325F.995, subd. 2
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
obtain a consumer's express consent to collect, use, and disclose the consumer's genetic data
Who it binds, in our words: Direct-to-consumer genetic testing companies
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Patients may sue for unauthorized release of health records under 144.298. The MCDPA, which covers non-HIPAA health data, has no private right of action.
Damages a court may award: None set. Compensatory damages plus costs and reasonable attorney fees (144.298, subd. 2 and 3).
Minnesota Health Records Act, liability of provider or other person. Minn. Stat. 144.298, subd. 2
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
is liable to the patient for compensatory damages caused by an unauthorized release or an intentional, unauthorized access, plus costs and reasonable attorney fees
Who it binds, in our words: Any person who negligently or intentionally requests or releases a health record in violation of 144.291 to 144.297
Minnesota Consumer Data Privacy Act, attorney general enforcement. Minn. Stat. 325M.20(d)
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
Nothing in sections 325M.10 to 325M.21 establishes a private right of action
Who it binds, in our words: Controllers and processors under the MCDPA
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Personal information lists only Social Security, driver's license or state ID, and financial account numbers. No medical or health insurance data. Consumer reporting agencies get notice when over 500 people. No attorney general notice.
Deadline to tell people: In the most expedient time possible and without unreasonable delay.
No duty found to tell the attorney general or a regulator.
Data warehouses; notice required for certain disclosures. Minn. Stat. 325E.61, subd. 1(e)
In force · effective · read October 3, 2026 · source(revisor.mn.gov)
means an individual's first name or first initial and last name in combination with any one or more of the following data elements
Who it binds, in our words: Any person or business that conducts business in this state and owns or licenses data that includes personal information; financial institutions exempt
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
Signed, not yet in force Not yet. A law is signed and takes effect January 1, 2027. Until then, none is in force.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Clinician review of automated adverse determinations starts 2027-01-01. The MCDPA right to question profiling (325M.14) does not require human review, so it is not counted.
Signed, not yet in force · effective · read October 3, 2026 · source(revisor.mn.gov)
A utilization review organization is prohibited from using any form of automated processing alone without a clinician review by an appropriate health professional, as required under this section, when making an adverse determination.
Who it binds, in our words: Utilization review organizations; applies to health plans offered, sold, issued, or renewed on or after January 1, 2027
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
6.0%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
94.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
89.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
6.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$84,313 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.2%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
6.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
12.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
11.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
