Healthcare providers in Minnesota must adhere to both federal HIPAA laws and the state’s MHRA when it comes to releasing personal health information. While some states only follow HIPAA standards without additional state requirements, Minnesota healthcare providers have been working to simplify certain aspects of the MHRA to allow for assumed consent under certain circumstances. This effort aims to avoid the need to repeatedly obtain patient consent before sharing personal health information. However, until such changes are implemented, healthcare providers in Minnesota will continue to comply with both federal and state standards.

 

All the PHI disclosures mentioned below are unique and may require the involvement of legal counsel for proper execution.

 

HIPAA Compliance

Unless required by law, the covered entity must determine the minimum necessary information for disclosures to law enforcement (45 CFR 164.502(b), 164.514(d)). When appropriate, the covered entity can rely on the law enforcement official’s representations regarding the necessary information for their lawful purpose (45 CFR 164.514(d)(3)(iii)(A)). Additionally, if the covered entity is unfamiliar with the requesting law enforcement official, they must confirm the person’s identity and authority before sharing the information (45 CFR 164.514(h)).

 

Court Order/Warrant

In order to comply with legal requirements, patient information may be disclosed under certain circumstances:

 

1. To comply with a court order, court-ordered warrant, subpoena, or summons issued by a judicial officer, or a grand jury subpoena. The Rule acknowledges that these legal processes offer protections for an individual’s private information (45 CFR 164.512(f)(1)(ii)(A)-(B)).

 

2. To respond to an administrative request, such as an administrative subpoena or investigative demand, or any other written request from a law enforcement official. Since administrative requests may not involve judicial oversight, the Rule mandates that all administrative requests must include a written statement indicating that the requested information is relevant, material, specific, limited in scope, and that de-identified information cannot be used (45 CFR 164.512(f)(1)(ii)(C)).

 

Regarding grand jury subpoenas, a hospital may disclose patient information in response to a subpoena issued by a grand jury, but only the information explicitly described in the subpoena can be shared. The hospital must ensure that its employees can differentiate between a legitimate court-issued document (subpoena, warrant, or summons) and other requests (45 CFR § 164.512(f)(1)(ii)).

 

The information provided in response to court orders, warrants, etc., must meet certain criteria, including demonstrating that the information sought is relevant and material to a lawful law enforcement inquiry, the request is specific and limited in scope, and de-identified information cannot be reasonably used.

 

When Required by Law

In order to assist in identifying or locating a suspect, fugitive, material witness, or missing person, the covered entity may disclose certain PHI (Protected Health Information). The disclosed information is limited to the individual’s name and address, date and place of birth, social security number, ABO blood type, rh factor, type of injury, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics. However, any other information related to the individual’s DNA, dental records, body fluid or tissue typing, samples, or analysis cannot be disclosed under this provision. Instead, these additional details may only be shared in response to a court order, warrant, or written administrative request (45 CFR 164.512(f)(2)).

Law enforcement may receive the same limited information under various circumstances, as described below:

 

1. If the report is made by the victim, who is a member of the covered entity’s workforce, regarding a suspected perpetrator of a crime (45 CFR 164.502(j)(2)).

 

2. If the covered entity reasonably believes that an individual has admitted participation in a violent crime that may have caused serious physical harm to a victim, provided the admission wasn’t related to therapy, counseling, or treatment for the propensity to commit such acts (45 CFR 164.512(j)(1)(ii)(A), (j)(2)-(3)).

 

3. When required by law, such as reporting incidents of violent injuries like gunshot or stab wounds (45 CFR 164.512(f)(1)(i)).

 

4. If there is suspicion that an individual’s death resulted from criminal conduct (45 CFR 164.512(f)(4)), and the information may also be shared with medical examiners or coroners for identification or determining the cause of death (45 CFR 164.512(g)(1)).

 

5. If the covered entity believes in good faith that certain PHI (Protected Health Information) is evidence of a crime that occurred on their premises (45 CFR 164.512(f)(5)).

 

6. When responding to an off-site medical emergency, the covered entity may share information with law enforcement to alert them about criminal activity, including details about the crime, its location, victims, and the perpetrator (45 CFR 164.512(f)(6)). However, this provision doesn’t apply if the emergency involves a victim of abuse, neglect, or domestic violence, as specified under 45 CFR 164.512(c).

 

7. Information may be disclosed to a law enforcement official reasonably capable of preventing or lessening a serious and imminent threat to an individual’s or the public’s health and safety (45 CFR 164.512(j)(1)(i)), or to identify and apprehend an individual who appears to have escaped from lawful custody (45 CFR 164.512(j)(1)(ii)(B)), as long as it complies with applicable law and ethical standards.

 

8. Information may be shared for certain specialized governmental law enforcement purposes, including intelligence, counter-intelligence, and national security activities under the National Security Act (45 CFR 164.512(k)(2)), or to provide protective services to the President and conduct related investigations (45 CFR 164.512(k)(3)).

 

9. Information may be provided to correctional institutions or law enforcement officials having lawful custody of inmates, when necessary for healthcare, safety, security, and order within the correctional facility (45 CFR 164.512(k)(5)).

 

Permitted but not Required

In response to a request for PHI (Protected Health Information) regarding a crime victim, the covered entity can disclose the information if the victim provides consent. However, if the victim is unable to provide consent due to an emergency or incapacity, the covered entity may still disclose the PHI if certain conditions are met. Law enforcement officials must assure that the PHI will not be used against the victim, and they need the information to determine if another person committed the crime. Furthermore, waiting for the victim’s consent would materially and adversely affect the investigation. In such cases, the covered entity, based on its professional judgment, can disclose the PHI if it is deemed to be in the best interests of the individual whose information is being requested (45 CFR 164.512(f)(3)).

 

Regarding hospital directories, covered hospitals and health care providers are allowed to maintain a facility directory containing specific patient information. This information includes the patient’s name, location in the facility, general health condition (without specific medical details), and religious affiliation. However, before including a patient’s information in the directory, the patient must be informed about what information will be included and to whom it may be released. The patient should also have the opportunity to restrict the information, limit disclosure, or opt out of being included in the directory altogether (45 CFR 164.510(a)).

 

Other Considerations

For cases involving child abuse victims or adult victims of abuse, neglect, or domestic violence, different provisions of the Rule come into effect:

 

1. Child abuse or neglect can be reported to any law enforcement official who is authorized by law to receive such reports, and the consent of the individual is not required (45 CFR 164.512(b)(1)(ii)).

 

2. Adult abuse, neglect, or domestic violence can be reported to a law enforcement official authorized by law to receive such reports (45 CFR 164.512(c)) under the following circumstances:

 

   – If the individual gives their consent.

   – If the report is required by law.

   – If expressly authorized by law, and based on professional judgment, the report is necessary to prevent serious harm to the individual or others, or in certain other emergency situations (see 45 CFR 164.512(c)(1)(iii)(B)).

 

Notice to the individual about the report may be mandated (see 45 CFR 164.512(c)(2)).

 

Minnesota Health Records Act (MHRA) Compliance

Under the MHRA (Minnesota Health Records Act), disclosing records to an external provider or other individuals necessitates one of the following:

 

– A consent form signed and dated by the patient.

– Confirmation from the provider holding the patient’s consent.

– Specific authorization as mandated by the law.

 

When Required by Law

Emergency interaction with law enforcement requires a health care provider to disclose a patient’s mental health records to a law enforcement agency under the following conditions:

 

1. The law enforcement agency provides the patient’s name and communicates that the patient is currently involved in an emergency interaction with them.
2. The disclosure of the records is necessary to protect the health or safety of the patient or another person.

 

However, the disclosure in such cases is limited to the minimum necessary for law enforcement to respond to the emergency (Minn. Stat. 144.294, Subd. 2.).

 

In the case of a facility caring for a person under an emergency hold (pursuant to Minn. Stat. 253B.05), the facility must notify the law enforcement agency that initiated the emergency hold when the person is discharged or released during the 72-hour period or leaves without the facility’s consent (Minn. Stat. 253B.05, Subd. 3(d)).

 

For missing children, law enforcement may execute a written declaration stating that an active investigation is underway to locate the child, and identifying data (such as dental or skeletal X-rays and related information) is necessary solely for the purpose of furthering the investigation (Minn. Stat. 299C.56).

 

In cases involving the report of deprivation of parental rights or kidnapping, individuals mandated to report such violations must inform the local police department or county sheriff if they know or have reason to believe such violations of the law (section 609.25 or 609.26) have occurred. Reports received by a local welfare agency in such instances do not trigger additional duties beyond reporting the potential violation and do not include additional PHI (Minn. Stat. 626.556 sub (3a)).

 

If a health professional comes across any injuries caused by a gun, they must immediately report them to the local police or county sheriff. The report must be made by telephone and promptly supplemented by a letter (Minn. Stat. 626.52 subd. 2, 626.53).

 

Likewise, a health professional must report to the appropriate police authorities any wound they have reasonable cause to believe has been inflicted on a perpetrator of a crime using a dangerous weapon other than a firearm as defined under (Minn. Stat. 609.02, subdivision 6).

 

Reporting burns: If a health professional treats, dresses, or bandages a burn injury and the victim has sustained second- or third-degree burns to five percent or more of their body, burns to the upper respiratory tract, laryngeal edema from inhaling superheated air, or a burn injury that may result in death, they must file a written report with the state fire marshal within 72 hours. The state fire marshal provides the necessary form for the report (Minn. Stat. 609.02, subdivision 3).

 

Reporting maltreatment of minors: Individuals required to report suspected maltreatment of minors must inform the local welfare agency, the agency responsible for assessing or investigating the report, the police department, county sheriff, tribal social services, or tribal police department (Minn. Stat. 626.556 sub 3) (C.F.R. I 64.512(b)(ii)).

 

Mandatory reporting to medical examiner or coroner: If a person who is required to report suspected maltreatment of minors knows or has reason to believe that a child has died as a result of neglect or physical or sexual abuse, they must report that information to the appropriate medical examiner or coroner, rather than the local welfare agency, police department, or county sheriff (Minn. Stat. 626.556 sub (9)).

 

Reporting entity’s staff suspected of maltreating a minor: The reporting entity’s staff who suspect maltreatment of a minor must comply with Minn. Stat. 626.556 (sub 10h) and follow the necessary reporting procedures.

 

Permitted but not Required

Anyone has the option to make a voluntary report to the local welfare agency, the agency responsible for assessing or investigating such reports, the police department, county sheriff, tribal social services agency, or tribal police department if they have knowledge of, reason to believe, or suspect that a child is currently being or has been neglected or subjected to physical or sexual abuse (Minn. Stat. 626.556 sub (3), 2, (b)).