Ask a Minnesota compliance officer what governs the release of a patient’s chart and you will usually hear one word: HIPAA.
That answer is not wrong so much as incomplete, and the incompleteness runs in one direction. HIPAA permits a large category of disclosures with no patient authorization at all. Minnesota does not permit most of them.
The gap is not academic. A provider operating a release process designed entirely around federal requirements is running a process that, on several recurring transactions, Minnesota law does not allow — and the Minnesota statute supplies a private action, attorney fees, and liability that reaches the party who asked for the record as well as the one who handed it over.
What HIPAA lets a covered entity do without asking
Start with the federal baseline, because the contrast is the whole article. 45 C.F.R. § 164.506(a):
Except with respect to uses or disclosures that require an authorization under § 164.508(a)(2) through (4) or that are prohibited under § 164.502(a)(5)(i), a covered entity may use or disclose protected health information for treatment, payment, or health care operations as set forth in paragraph (c) of this section, provided that such use or disclosure is consistent with other applicable requirements of this subpart.
And § 164.506(c)(1): “A covered entity may use or disclose protected health information for its own treatment, payment, or health care operations.”
Paragraph (c) then extends the permission outward — to another provider’s treatment activities, to another covered entity for that entity’s payment activities, and, on stated conditions, to another covered entity for its health care operations. 45 C.F.R. § 164.506(c)(2)–(4).
Consent is available under the federal rule but not required: “A covered entity may obtain consent of the individual to use or disclose protected health information to carry out treatment, payment, or health care operations.” § 164.506(b)(1) (emphasis added).
That is the federal default: treatment, payment, and operations — TPO — move without a signature.
What Minnesota requires instead
The Minnesota Health Records Act is Minn. Stat. §§ 144.291 to 144.298, and § 144.291, subd. 1 supplies the short title. Its consent rule is § 144.293, subd. 2:
A provider, or a person who receives health records from a provider, may not release a patient’s health records to a person without:
(1) a signed and dated consent from the patient or the patient’s legally authorized representative authorizing the release;
(2) specific authorization in Minnesota law; or
(3) a representation from a provider that holds a signed and dated consent from the patient authorizing the release.
Then read the exceptions, and read them for what is absent. Section 144.293, subd. 5(a) provides that the section “does not prohibit the release of health records”:
(1) for a medical emergency when the provider is unable to obtain the patient’s consent due to the patient’s condition or the nature of the medical emergency;
(2) to other providers within related health care entities when necessary for the current treatment of the patient; or
(3) to a health care facility licensed by this chapter, chapter 144A, and chapter 144G, or to the same types of health care facilities licensed by this chapter and chapter 144A that are licensed in another state when a patient:
(i) is returning to the health care facility and unable to provide consent; or
(ii) who resides in the health care facility, has services provided by an outside resource under Code of Federal Regulations, title 42, section 483.75(h), and is unable to provide consent.
There is a narrow treatment exception — clause (2) — and it is narrow twice over: the recipient must be a provider within a related health care entity, and the release must be necessary for the current treatment of the patient. “Related health care entity” is itself defined, at § 144.291, subd. 2(k), as an affiliate of the releasing provider as defined in § 144.6521, subd. 3(b).
There is no payment exception in subd. 5. There is no health-care-operations exception in subd. 5. Those are two of the three legs of HIPAA’s TPO permission, and Minnesota simply did not write them into the list of things that may happen without consent.
Minnesota handles the insurer-payment case in a materially different place and in a materially different way. Section 144.293, subd. 6 does not create an exception to consent; it addresses how long a consent lasts. Where “a patient explicitly gives informed consent,” the consent does not expire after one year for, among other things:
(2) the release of health records to an accident and health insurer, health service plan corporation, health maintenance organization, or third-party administrator for purposes of payment of claims, fraud investigation, or quality of care review and studies …
The premise of that subdivision is that the patient gave explicit informed consent in the first place. Under HIPAA the payment disclosure needs no signature at all; under Minnesota law it needs one, and the statute’s only concession is that this particular consent does not lapse in a year.
Why the stricter rule survives federal preemption
HIPAA is a floor, and the regulation says so. 45 C.F.R. § 160.203 opens by preempting contrary state law and then lists the exceptions, of which paragraph (b) is the one that matters here:
The provision of State law relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter.
“More stringent” is a defined term, and the definition is written provision by provision. 45 C.F.R. § 160.202 provides that a state law is more stringent if it meets one or more listed criteria, including:
(1) With respect to a use or disclosure, the law prohibits or restricts a use or disclosure in circumstances under which such use or disclosure otherwise would be permitted under this subchapter …
and
(2) With respect to the rights of an individual, who is the subject of the individually identifiable health information, regarding access to or amendment of individually identifiable health information, permits greater rights of access or amendment, as applicable.
Note the structure. The comparison is made provision against provision, not statute against statute. Minnesota law is not globally “more stringent than HIPAA,” and nobody should say that it is. What is true is that on the specific transaction — a payment or operations disclosure with no patient signature — Minnesota restricts what the federal rule would permit, which is precisely the situation § 160.202(1) describes.
| HIPAA (45 C.F.R. pts. 160, 164) | Minnesota Health Records Act (§§ 144.291–144.298) | |
|---|---|---|
| Disclosure for the entity’s own treatment, payment, or operations | Permitted without authorization, § 164.506(a), (c)(1) | Consent required, § 144.293, subd. 2, unless within a subd. 5 exception |
| Disclosure to another provider for treatment | Permitted, § 164.506(c)(2) | Permitted only to a provider “within related health care entities when necessary for the current treatment of the patient,” § 144.293, subd. 5(a)(2) |
| Disclosure to a payer for payment | Permitted, § 164.506(c)(3) | Not listed in subd. 5; addressed in subd. 6(2), which presupposes explicit informed consent |
| Disclosure for another entity’s health care operations | Permitted on conditions, § 164.506(c)(4) | Not listed in subd. 5 |
| Is consent itself required? | “may obtain consent,” § 164.506(b)(1) | “may not release … without … a signed and dated consent,” § 144.293, subd. 2 |
| How long a consent lasts | Not the federal framework’s mechanism | “valid for one year or for a period specified in the consent or for a different period provided by Minnesota law,” § 144.293, subd. 4 |
| Effect of the stricter state rule | Not preempted where more stringent, § 160.203(b); “more stringent” defined at § 160.202 | — |
Access, the 30-day clock, and what a copy may cost
The patient-side rights are in § 144.292, and two numbers do most of the work.
Subd. 2 — patient access:
Upon request, a provider shall supply to a patient within 30 calendar days of receiving a written request for medical records complete and current information possessed by that provider concerning any diagnosis, treatment, and prognosis of the patient in terms and language the patient can reasonably be expected to understand.
Subd. 5 — copies: on a written request, and “[e]xcept as provided in section 144.296,” the provider must furnish “within 30 calendar days” either copies of the health record — “including but not limited to laboratory reports, x-rays, prescriptions, and other technical information used in assessing the patient’s health conditions” — or the pertinent portion relating to a specified condition. With the patient’s consent the provider may substitute a summary. The provider “may exclude from the health record written speculations about the patient’s health condition, except that all information necessary for the patient’s informed consent must be provided.”
Subd. 6 caps the price, and it starts with a free category:
(a) When a patient requests a copy of the patient’s record for purposes of reviewing current medical care, the provider must not charge a fee.
For other requests, the maximums in subd. 6(b) are “$1 per page, plus $10 for time spent retrieving and copying the records”; “a total of $30 for retrieving and reproducing x-rays”; and “a total of $20 for retrieving the records” for electronic copies — each qualified by “unless other law or a rule or contract provide for a lower maximum charge.”
Subd. 6(c) then imposes a second ceiling on paper copies: no more than $10 “if there are no records available,” $30 “for copies of records of up to 25 pages,” $50 “for copies of records of up to 100 pages,” $50 plus 20 cents per page for pages 101 and above, or “$500 for any request.”
Subd. 6(d) carves out Social Security disability appeals: a $10 retrieval fee but no per-page or x-ray fee; and no fee at all, retrieval included, where the requesting patient “is receiving public assistance, represented by an attorney on behalf of a civil legal services program, or represented by a volunteer attorney program based on indigency,” on production of one of three listed proofs.
One thing subd. 6 conspicuously lacks is an escalator. These are flat dollar figures with no indexing mechanism written into the subdivision. They move when the Legislature moves them — most recently in 2024 — and not otherwise. A provider quoting a per-page rate “adjusted for inflation” is quoting something the statute does not contain.
Access is not unconditional. Under subd. 7(a), a provider within § 144.291, subd. 2(i)(1) who “reasonably determines that the information is detrimental to the physical or mental health of the patient, or is likely to cause the patient to inflict self harm, or to harm another” may withhold it from the patient and supply it instead to an appropriate third party or another provider, who “may release the information to the patient.”
Consent expires, and that is a trap in slow-moving matters
Section 144.293, subd. 4 is one sentence and it ends more claims-side records efforts than anything else in the Act:
Except as provided in this section, a consent is valid for one year or for a period specified in the consent or for a different period provided by Minnesota law.
A one-year default. In a matter that takes three years — and most litigated injury matters do — an authorization signed at intake is a dead instrument long before the records are actually needed. The non-expiring categories in subd. 6 are limited to consulting providers, the listed payers, and welfare-system programs, and each requires that the patient “explicitly gives informed consent.”
The remedy, and who is exposed
Section 144.298 supplies the private action, and its scope is broader than most people assume.
Subd. 1 makes a violation “grounds for disciplinary action against a provider by the appropriate licensing board or agency.”
Subd. 2 is the damages provision:
A person who does any of the following is liable to the patient for compensatory damages caused by an unauthorized release or an intentional, unauthorized access, plus costs and reasonable attorney fees:
(1) negligently or intentionally requests or releases a health record in violation of sections 144.291 to 144.297;
(2) forges a signature on a consent form or materially alters the consent form of another person without the person’s consent;
(3) obtains a consent form or the health records of another person under false pretenses; or
(4) intentionally violates sections 144.291 to 144.297 by intentionally accessing a record locator or patient information service without authorization.
Three features of that subdivision deserve emphasis.
First, “requests or releases.” Clause (1) reaches the party that asked. An insurer, employer, adjuster, or law firm that requests a record in violation of §§ 144.291 to 144.297 is a person who “requests … a health record in violation of” the Act. The exposure is not confined to the clinic.
Second, “negligently or intentionally.” Clause (1) does not require intent. Clauses (3) and (4), by contrast, are written in terms of false pretenses and intentional access. The mental-state requirement is not uniform across the subdivision.
Third, the damages are compensatory. The statute provides “compensatory damages caused by an unauthorized release or an intentional, unauthorized access, plus costs and reasonable attorney fees.” It does not set a statutory or liquidated amount per violation. Proof of harm is the plaintiff’s problem in these cases, and it is the real one — the fee-shifting provision is what makes a meritorious but modest claim viable at all.
Subd. 3 adds a separate entitlement to “compensatory damages plus costs and reasonable attorney fees” where a health information exchange, or an entity maintaining the service for one, “negligently or intentionally violates the provisions of section 144.293, subdivision 8” — the record locator and patient information service rules.
The independent medical examination is expressly carved out
Anyone handling injury claims should know § 144.297 in full, because it is short and it reverses the usual result:
Sections 144.291 to 144.298 apply to the subject and provider of an independent medical examination requested by or paid for by a third party. Notwithstanding section 144.293, a provider may release health records created as part of an independent medical examination to the third party who requested or paid for the examination.
The Act applies to the IME — but the examining provider may send the resulting records to the party who ordered and paid for the examination without the examinee’s consent. The person examined is a “patient” for purposes of the Act’s other protections and is not the gatekeeper of the report. That is worth understanding before an examination, not after.
For anyone pursuing a first-party claim against their own insurer — including an underinsured motorist claim, discussed in the coverage you bought for the worst crash — this matters twice over: the volume of medical records an insurer will ask for is large, the authorization it asks you to sign is usually broad, and § 144.293, subd. 4 means a signature given today does not last forever.
What to do
If you are a patient:
- Put the request in writing. Both § 144.292, subds. 2 and 5 run their 30-day clocks from a written request. The Department of Health developed a request form under subd. 8, and the statute provides that a form developed by the commissioner “must be accepted by a provider as a legally enforceable request.”
- Say why you want them. If the purpose is “reviewing current medical care,” subd. 6(a) says the provider “must not charge a fee.”
- Check the invoice against subd. 6. The per-page rate, the retrieval fee, the x-ray charge, and the overall caps — including the $500 ceiling for any request — are statutory maximums.
- Read the authorization before signing it, including its duration. Under subd. 4 the default is one year, but a consent may specify a different period.
- If records went somewhere you did not authorize, note the date and keep the paper. Section 144.298 requires compensatory damages caused by the release, which means the sequence of what happened after matters.
If you are a provider or a party requesting records:
- Do not assume a HIPAA-compliant workflow is Minnesota-compliant. The federal TPO permission has no counterpart in § 144.293, subd. 5.
- Check whether the recipient is inside a “related health care entity.” Clause (2) of subd. 5 turns on the definition in § 144.291, subd. 2(k) and § 144.6521, subd. 3(b).
- Remember that requesting is a covered act. Section 144.298, subd. 2(1) reaches the requester, negligently as well as intentionally.
The observation
The usual story about federal privacy law is that it sets a national standard and the states fall in behind it. Minnesota’s Health Records Act is a counterexample, and the divergence sits at exactly the point of highest transaction volume.
Treatment, payment, and operations disclosures are not the edge case. They are the overwhelming majority of everything that happens to a medical record on any given day. HIPAA permits them by default. Minnesota’s list of things that may happen without consent — a medical emergency, a related-entity treatment need, certain facility returns — does not include most of them.
A compliance program that treats HIPAA as the ceiling rather than the floor is not conservative. It is simply looking at the wrong statute. And 45 C.F.R. § 160.203(b) means the federal rule does not rescue it: a more stringent state privacy provision is not preempted, and § 160.202(1) defines “more stringent” to include exactly this — a state law that “prohibits or restricts a use or disclosure in circumstances under which such use or disclosure otherwise would be permitted.”
The Legislature paired that stricter rule with something federal law does not give an individual: a private action, with attorney fees, against whoever released the record and whoever asked for it. Minnesota did not just write a stricter privacy rule. It gave the patient a way to enforce it.
Madgett Law, LLC handles Minnesota health-records disputes, including provider refusals, overcharges for copies, and unauthorized releases under Minn. Stat. § 144.298. If a record went somewhere it should not have, the useful facts are who requested it, what authorization they held, and when. Send us a message or call 612-470-6529.
Sources: Minn. Stat. § 144.291 (2025) (subd. 1, short title “Minnesota Health Records Act”; subd. 2, definitions, including (c) “health record,” (g) “patient,” (i) “provider,” (k) “related health care entity”); Minn. Stat. § 144.292 (2025) (subd. 2, patient access within 30 calendar days of a written request; subd. 5, copies of health records; subd. 6(a)–(d), cost, including the no-fee rule for reviewing current medical care, the per-page and retrieval maximums, the aggregate caps including $500 for any request, and the Social Security disability appeal provisions; subd. 7, withholding health records from patient; subd. 8, form); Minn. Stat. § 144.293 (2025) (subd. 2, patient consent to release; subd. 4, duration of consent; subd. 5(a)–(b), exceptions to consent requirement; subd. 6, consent does not expire; subd. 8, record locator or patient information service); Minn. Stat. § 144.297 (2025) (independent medical examination); Minn. Stat. § 144.298 (2025) (subd. 1, licensing action; subd. 2, liability of provider or other person; subd. 3, liability for record locator or patient information service) (Minnesota Office of the Revisor of Statutes). 45 C.F.R. § 164.506 (uses and disclosures to carry out treatment, payment, or health care operations — paragraph (a), permitted uses and disclosures; (b)(1), consent optional; (c)(1)–(4), implementation specifications); 45 C.F.R. § 160.203 (general rule and exceptions to preemption — paragraph (b), more stringent State law); 45 C.F.R. § 160.202 (definition of “more stringent,” criteria (1) and (2)) (eCFR, current text as of July 2026). The comparison drawn above is provision-by-provision, as 45 C.F.R. § 160.202 requires; nothing here asserts that Minnesota law is more stringent than HIPAA in every respect. This article is general legal information about Minnesota and federal law, not legal advice, and reading it does not create an attorney–client relationship. Every situation depends on its own facts. No outcome is promised or implied.