Minnesota Health Privacy, Reporting, and Related Statutory Obligations
Privacy framework
Optometric records are protected by HIPAA and by the Minnesota Health Records Act, Minn. Stat. §§ 144.291–.298. Minnesota law can be stricter than HIPAA, so the practitioner must apply the more protective rule. Use and disclosure should be limited to the minimum necessary for treatment, payment, or health care operations, or be supported by a valid authorization or legal exception. Patients have rights to access and amend their records.
Reporting obligations
Optometrists are mandatory reporters of suspected child abuse or neglect under Minn. Stat. § 626.556 and vulnerable adult maltreatment under Minn. Stat. § 626.557. Public health reporting and other statutory duties may also apply. A HIPAA permission does not override a specific Minnesota reporting mandate, and a reporting obligation does not require patient consent.
Breach and safeguards
Safeguard paper and electronic records, limit staff access, and follow breach-notification requirements. Do not disclose information to family members without the patient’s authorization unless a legal exception applies. Minors’ records raise special consent and access issues; confirm who may consent and who may access the record.
Worked example
A parent asks for a copy of a 16-year-old patient’s eye record. The optometrist confirms whether the minor consented to her own care under Minnesota law and whether the parent has access. If the minor validly consented to confidential care, the optometrist may need to withhold the related record. The decision and legal basis should be documented, and the practice should follow its privacy officer’s guidance.
Traps
Do not assume HIPAA preempts Minnesota law; apply the stricter protection. Do not disclose to a spouse or parent merely because they accompany the patient. Do not delay a mandated report to obtain consent. Do not ignore a breach because the record was paper rather than electronic.