Minnesota Focused Ultrasound Center Privacy Laws: A Compliance Checklist

Minnesota focused ultrasound centers should treat privacy as a combination of state health-record rules, federal HIPAA requirements where applicable, and special protections for certain sensitive records. The core state framework is the Minnesota Health Records Act in Minnesota Statutes chapter 144; the Government Data Practices Act may also apply when a government entity maintains the information.

Use this checklist to assess your center’s records and workflows. A center’s specific obligations depend on its provider status, ownership, services, and the kinds of records it creates or receives.

What Minnesota health-record consent and disclosure rules apply to focused ultrasound centers?

The Minnesota Health Records Act defines a health record broadly to include information, in any form, about a patient’s health, care, or payment for care. Its definition of “provider” includes specified licensed professionals and health care facilities, so a focused ultrasound center should confirm whether its clinicians or facility fall within that definition. The Act does not create a separate privacy regime specifically for focused ultrasound services. See Minnesota Statutes section 144.291.

As a starting rule, a provider or a person receiving records from a provider generally may not release a patient’s health records without a signed and dated patient consent, specific authorization in Minnesota law, or a provider’s representation that it holds the patient’s signed and dated consent. A written patient authorization should identify the information and recipient clearly and stay within the patient’s stated limits. Under Minnesota law, consent generally lasts one year unless it specifies a different period or another law provides otherwise. Minnesota Statutes section 144.293 describes these consent and disclosure rules.

• Use a documented authorization process and verify the patient or legally authorized representative’s authority.
• Limit each disclosure to the records, recipient, purpose, and time period permitted by the consent or applicable law.
• Check for a specific statutory exception before releasing information without consent; do not assume that a routine clinical or administrative purpose alone authorizes disclosure under Minnesota law.
• Document releases made without patient consent when Minnesota law authorizes them, and retain the details required for the applicable disclosure.
• Apply the more protective rule when Minnesota law and HIPAA differ. The Act directs that its health-record provisions be construed to protect privacy more stringently than HIPAA where the state-law standard applies. See Minnesota Statutes section 144.2925.

Minnesota law permits certain disclosures without consent, including a release during a medical emergency when the provider cannot obtain consent because of the patient’s condition or the emergency, and a release to another provider within a related health care entity when needed for the patient’s current treatment. Other state laws may authorize specific disclosures. The applicable exception depends on the circumstances, so staff should confirm the legal basis rather than treating the examples as a general permission to share. Minnesota Statutes section 144.293.

How should centers handle patient requests to inspect or copy records?

Set up a process for written requests, identity verification, locating records across the center’s systems, and tracking the response deadline. Minnesota law generally requires a provider to supply the patient with complete and current information it possesses about diagnosis, treatment, and prognosis within 30 calendar days after receiving a written request. Upon a written request, the provider must also furnish copies of the health record or the pertinent portion the patient identifies within 30 calendar days. Minnesota Statutes section 144.292.

Patients may request copies of records such as imaging, laboratory reports, prescriptions, and other technical information used to assess their health. A provider may supply a summary instead of copies only with the patient’s consent. Minnesota law permits a provider to exclude written speculation about a patient’s condition, but the information necessary for informed consent must still be provided. Minnesota Statutes section 144.292.

A provider may withhold information in limited circumstances if it reasonably determines that disclosure would be detrimental to the patient’s physical or mental health, or could lead the patient to harm themselves or someone else. The statute allows the provider to supply the information to an appropriate third party or another provider instead. Apply this exception to the specific record and circumstances, and document the decision. Minnesota Statutes section 144.292.

If the center is a HIPAA covered entity, HIPAA’s access rules may also apply. HIPAA generally gives individuals access to information in designated record sets, with exceptions that include psychotherapy notes. Minnesota’s requirements and any other applicable law should be checked alongside HIPAA before responding. See the HHS guidance on the HIPAA right of access.

What notice about health-record access and disclosures must providers post?

Minnesota providers must give patients a clear and conspicuous written notice explaining their health-record access and disclosure rights. The notice must describe disclosures that may be made without the patient’s written consent, including the types of records and recipients, and explain the patient’s right to access and obtain copies of records and other information maintained by the provider. Minnesota Statutes section 144.292, subdivision 4.

The statute says the requirement is satisfied if the notice is included with the patient and resident bill-of-rights notice or displayed prominently at the provider’s place of business. Use the applicable Minnesota Department of Health notice where appropriate, and make sure the information presented to patients accurately reflects the center’s actual disclosure practices. Minnesota Statutes section 144.292.

Which charges may centers impose for copies of health records?

A provider must not charge a patient for a copy requested to review current medical care. For other patient copy requests, Minnesota law sets maximum charges, subject to any lower limit imposed by another law, rule, or contract. Minnesota Statutes section 144.292, subdivision 6.

• Paper copies: Up to $1 per page plus $10 for retrieval and copying time, subject to the paper-record total caps below.
• Paper-record total caps: Up to $10 if no records are available; $30 for up to 25 pages; $50 for up to 100 pages; $50 plus 20 cents per page over 100 pages; and no more than $500 for a request.
• X-rays: Up to $30 total for retrieval and reproduction.
• Electronic copies: Up to $20 total for retrieval.

Special limits apply to records requested for an appeal of a denial of Social Security disability benefits. A provider may charge a $10 retrieval fee in some such cases, but not a per-page or X-ray fee. A provider must waive all fees, including retrieval, when the qualifying patient is receiving public assistance or is represented by a civil legal services or volunteer attorney program based on indigency and provides the specified supporting documentation. Check the statutory conditions before billing for these requests. Minnesota Statutes section 144.292, subdivision 6.

What consent rules apply to chemical dependency records and psychotherapy notes?

Do not treat every mention of substance use as a Part 2 record. Federal 42 CFR part 2 applies to records of patients in federally assisted programs that provide substance use disorder diagnosis, treatment, or referral for treatment; some requirements also apply to people and organizations that receive those records. A focused ultrasound center should determine whether it operates such a program or holds records protected by Part 2 before sharing them. See the HHS overview of Part 2.

As of February 16, 2026, covered Part 2 programs must comply with the updated federal rule. A patient may give a single consent for future uses and disclosures for treatment, payment, and health care operations. Part 2 also requires consent details about the records, authorized recipients, purpose, revocation, and expiration; when applicable, disclosures to HIPAA covered entities or business associates must include notice that redisclosure is governed by HIPAA, subject to limits on proceedings against the patient. 42 CFR section 2.31 and the HHS Part 2 final-rule fact sheet explain the current consent framework.

Part 2 counseling notes that are separately maintained and analyze conversations in substance use counseling sessions have a distinct protection: they require specific consent and cannot be disclosed under a broad treatment, payment, and health care operations consent alone. Part 2 also restricts using protected records in proceedings against a patient without the required specific consent or court order. HHS’s Part 2 final-rule fact sheet.

HIPAA separately requires an authorization for most uses or disclosures of psychotherapy notes, with limited exceptions. The category is narrow: it generally refers to a mental health professional’s separately maintained notes documenting or analyzing the content of a counseling conversation, not ordinary clinical progress notes or a treatment plan. HIPAA does not give patients a right to access psychotherapy notes, although other records in their designated record set remain subject to applicable access rules. See 45 CFR section 164.508 and HHS access guidance.

For covered records, apply both federal and Minnesota requirements rather than assuming one consent standard replaces the other. Minnesota’s Health Records Act generally requires signed and dated consent or a specific legal authorization for a release, while Part 2 and HIPAA impose additional protections for their respective record types.

How do Minnesota data-practices law and HIPAA apply to government-held health data?

The Minnesota Government Data Practices Act, in Minnesota Statutes chapter 13, governs how government entities collect, maintain, use, and disclose government data. Under section 13.384, medical data collected because someone is or was a patient or client of a government-operated hospital, clinic, or other covered health service are generally private, subject to statutory exceptions. The provision also directs that access to medical data be handled under Minnesota’s health-record statutes. See Minnesota Statutes section 13.384.

A person who is the subject of government data may generally inspect private or public data about themselves without charge and request copies; the government entity may charge actual costs for making and certifying copies. Medical data have their own classification and disclosure rules, so a government entity should not treat them as public simply because it received a public-records request. See Minnesota Statutes section 13.04 and section 13.384.

Government ownership alone does not make an organization a HIPAA covered entity. HIPAA applies to covered entities—health plans, health care clearinghouses, and certain providers that conduct specified electronic transactions—and to business associates performing covered functions on their behalf. A government-operated provider may therefore be covered if it meets the definition, while a government agency that is not a covered entity may still have duties under chapter 13. A business associate relationship likewise depends on the function performed and access to protected health information, not simply on the vendor’s label. See HHS guidance on who must comply with HIPAA and HHS guidance on covered entities and business associates.

FAQs

When can a focused ultrasound center disclose health records without written patient consent?

A center may disclose records without written consent when a specific Minnesota law authorizes or requires the disclosure. Examples under the Minnesota Health Records Act include certain medical emergencies when the patient cannot provide consent and sharing with another provider within a related health care entity when necessary for current treatment. Other statutory exceptions may apply to specific facts. Document the legal basis for an authorized disclosure and confirm whether HIPAA or a stricter rule for sensitive records also applies. Minnesota Statutes section 144.293.

Can patients receive copies of records for free when reviewing current care?

Yes. Minnesota providers may not charge a fee when the patient requests a copy of their record to review current medical care. Other requests may be subject to the state’s copy-fee limits and exceptions. Minnesota Statutes section 144.292, subdivision 6.

Does a government entity have to follow HIPAA if it maintains identifiable health data?

Not solely because it holds identifiable health data. A government entity must follow HIPAA if it is a covered entity or business associate under the federal definitions. It may still have independent privacy and access obligations under the Minnesota Government Data Practices Act and the Minnesota Health Records Act. HHS HIPAA guidance and Minnesota Statutes section 13.384.

What consent is required to release psychotherapy notes or chemical dependency records?

HIPAA generally requires a separate authorization for uses or disclosures of psychotherapy notes, subject to limited exceptions. Part 2 records require a valid Part 2 consent or an applicable regulatory exception; a single consent can cover future treatment, payment, and health care operations disclosures, but separately maintained substance use counseling notes require specific consent. Minnesota’s signed-and-dated-consent rules may also apply, so centers should check all applicable standards before releasing either record type. 45 CFR section 164.508, 42 CFR section 2.31, and Minnesota Statutes section 144.293.

In practice, a focused ultrasound center’s privacy checklist should identify which laws cover its organization and records, control disclosures through valid consent or a verified legal exception, meet patient access and fee rules, and keep its notices consistent with actual practices.