• All patient records generated before January 1, 1997 can be accessed by internal and external researchers without consent unless the patient objects.
• INTERNAL researchers can access patient medical records generated after January 1, 1997 without consent
• For records generated after January 1, 1997, EXTERNAL researchers may not access patient medical records without patient consent unless:
  • two requests for authorization are sent by mail with a conspicuous notice and the institution receives no response from the patient.
• If the patient does not respond either way -- in the affirmative or the negative--the institution holding the medical records is then permitted to allow external researchers to access patient medical records generated after January 1, 1997 without consent. (This could be considered implied or inferred consent.)

Privacy Weaknesses within the law:

• No patient consent is required for access by INTERNAL researchers.
• There is no clear or limited definition of a "researcher."
• There exists the possibility that research organizations could make EXTERNAL researchers "temporary" INTERNAL researchers
• For records before January 1, 1997, all records are open for access unless patient specifically take the time to request otherwise.
• EXTERNAL researchers are given access to records if the patient does not respond, even if the patient erroneously thinks a "no response" to written request for consent is a refusal of consent.
• A 1996 Advisory Opinion 96-054 rendered by the Minnesota Department of Administration declared the patient consent and audit trail requirements unnecessary unless the ENTIRE medical record was requested and only to an external entity:
  • "The essence of Mr. Flaig's question is whether a release of data from a person's health record constitutes a release of "health records" as contemplated by the Legislature in Section 144.335, subdivision 3a (g) [requirement to document when and to whom information was released]. Section 144.335 does not clearly define health records. However, it seems reasonable to conclude that if the Legislature intended for documentation to occur when partial information out of a person's health record was released, the Legislature would have so states...Therefore, it is the Commissioner's opinion that the Legislature intended documentation to occur in situations in which a patient's health record, i.e., "complete and current information possessed by that provider concerning any diagnosis, treatment and prognosis of the patient"...is released by the provider."
  • "The provisions in Section 144.335, subdivision 3a (d)(1)-(3) [request for patient consent], and subdivision 3a(g) [documentation of access], apply only when the data subject's provider is asked to release the subject's health record to an entity external to the provider.