Minnesota Health Records Act (MHRA): Consent Rules for Sharing Mental Health Notes

Overview of MHRA Consent Requirements

The Minnesota Health Records Act (MHRA) sets strict standards to protect patient confidentiality and govern mental health information disclosure. In general, you must obtain the patient’s informed consent before sharing mental health notes, unless a narrow statutory exception applies.

The MHRA spans several provisions within Minnesota law; Section 144.294 addresses health record disclosures and reinforces purpose limitation and need-to-know principles. Your releases should be tailored to the stated purpose and limited to the minimum necessary details to accomplish that purpose.

Mental health notes versus psychotherapy notes

Not all mental health documentation is the same. Routine clinical notes, care plans, and progress entries are usually part of the health record. Psychotherapy notes—personal reflections kept separately by a mental health professional—receive heightened protection and typically require a separate, specific written authorization for disclosure, with very limited exceptions.

Purpose limitation and minimum necessary

Authorizations and disclosures should clearly define who may receive information, what categories of mental health information may be shared, and why. Under Section 144.294, you should disclose only what is reasonably necessary for the recipient’s role and the authorized purpose, and no more.

Written Consent Procedures

Use a clear, plain-language written authorization that the patient (or an authorized personal representative) signs and dates. Include identifying details, a description of the mental health notes or categories to be released, the purpose of disclosure, the name or role of each recipient, an expiration date or event, and a statement explaining the right to revoke consent in writing and potential re-disclosure risks.

Step-by-step workflow

• Verify identity and authority of the requester and, if applicable, the personal representative.
• Review scope: confirm the specific mental health information authorized for release and exclude psychotherapy notes unless expressly authorized.
• Assess purpose and necessity: align the disclosure with the stated purpose and apply the minimum-necessary standard.
• Prepare and transmit securely: redact unrelated content; use secure channels suited to the recipient’s needs.
• Document the release: record date, recipient, purpose, and items disclosed in your release-of-information log.
• Retain the authorization: store the signed written authorization according to your retention schedule.

Revocation and changes

Patients may revoke written authorization at any time in writing. After revocation, stop further disclosures under that authorization. Revocation does not undo disclosures already made in reliance on valid consent. If the patient narrows scope or changes recipients, obtain a new or amended authorization before releasing additional records.

Exceptions for Medical Emergencies

Emergency disclosure protocols allow limited sharing without prior consent when, in good faith, immediate disclosure is necessary to diagnose, treat, or prevent serious and imminent harm. Share only the information required for the emergency, document your rationale, and notify the patient or authorized representative as soon as practicable.

Other no-consent scenarios permitted by law

• Court orders, subpoenas, or warrants that specifically authorize disclosure.
• Mandatory reports (for example, abuse or threats) required by law.
• Health oversight, audits, or quality reviews authorized by statute.
• Public health or safety activities expressly permitted by law.
• Certain continuity-of-care exchanges when permitted under the MHRA and federal law; psychotherapy notes remain specially protected.
• Other limited disclosures consistent with Section 144.294 and applicable legal requirements.

Patient Access to Mental Health Records

Patients have robust record access rights, including the ability to inspect and obtain copies of their mental health records and to direct copies to a designated third party. Provide access in the format requested when feasible and within legally required timeframes, while safeguarding privacy and security.

Limits and denials

Some categories—such as psychotherapy notes kept separately, information compiled for legal proceedings, or content whose release would reasonably endanger life or physical safety—may be excluded or limited. When you deny or limit access, document the reason, explain available review options, and, when appropriate, offer a summary instead of the full record.

Duration and Validity of Consent

A valid MHRA authorization clearly states an expiration date or event and remains effective until that date/event or until the patient revokes it in writing. Each distinct purpose generally requires its own authorization; re-use for a different purpose is not permitted without new consent.

Choosing an expiration

For ongoing care coordination, many organizations use a time-bound window (for example, several months) to balance continuity with privacy. For one-time releases, tie the expiration to a discrete event (such as “upon completion of this evaluation”) to prevent overbroad or open-ended sharing.

Effect of revocation

Revocation stops future disclosures under that authorization but does not require retrieval of information already released in good faith. Where feasible, you may notify frequent recipients that consent has been withdrawn to prevent unintended re-disclosures.

Fees for Copying Records

For patient-requested copies, you may charge only reasonable, cost-based fees that reflect actual labor for copying, supplies, and postage, and—when requested—preparation of a summary. Do not add search, retrieval, or per-request administrative fees to patient access requests.

For third-party requests that are not patient access requests, Minnesota law may allow additional charges or per-page rates. Fee caps and schedules can change, so align your pricing policy with current Minnesota requirements and clearly disclose estimated costs before fulfilling requests.

Compliance and Legal Implications

Failure to follow MHRA consent rules can trigger provider liability, including civil remedies, regulatory penalties, licensing discipline, contract breaches, and reputational harm. Strong privacy governance reduces risk while supporting safe, effective care.

Operational safeguards

• Standardize written authorization templates that call out mental health content and psychotherapy notes.
• Train staff on Section 144.294 requirements, emergency disclosure protocols, and minimum-necessary practices.
• Maintain an auditable release-of-information log and monitor for inappropriate access.
• Use secure transmission methods; verify recipient identity before release.
• Review business associate arrangements and vendor workflows for compliance.

Incident response

If an improper disclosure occurs, activate your breach response plan: contain, investigate root causes, mitigate harm, notify required parties, and implement corrective actions. Update policies and retrain to prevent recurrence.

Conclusion

The Minnesota Health Records Act (MHRA) requires clear, purpose-limited written authorization for mental health information disclosure, with narrow exceptions for emergencies and other situations authorized by law. By honoring record access rights, controlling fees, and operationalizing Section 144.294 standards, you protect patient confidentiality and reduce organizational risk.

FAQs

What constitutes valid consent under the MHRA?

Valid consent is a signed, dated written authorization that identifies the patient; specifies the mental health information to be released (distinguishing psychotherapy notes when relevant); names intended recipients; states the purpose; sets an expiration date or event; explains the right to revoke; and warns of potential re-disclosure. It must be voluntary and executed by the patient or an authorized personal representative.

When can mental health notes be shared without patient consent?

Limited no-consent disclosures include medical emergencies, court orders, mandatory reports, health oversight, certain public health or safety activities, and other situations expressly permitted by Section 144.294 and applicable law. Even then, disclose only what is necessary, and remember that psychotherapy notes usually require specific authorization.

How long does MHRA consent remain valid?

Consent remains valid until the stated expiration date or event, unless the patient revokes it earlier in writing. For ongoing care, use time-limited authorizations; for single purposes, use event-based expirations. New purposes generally require a new authorization.

Are providers allowed to charge for copying mental health records?

Yes. For patient access requests, fees must be reasonable and cost-based (labor for copying, supplies, postage, and, if requested, a summary). Search or retrieval fees should not be added to patient requests. Different fee rules may apply to third-party requests under Minnesota law; align your charges with current state limits.