MN HF824

Modifies authorization requirements for health records disclosure, allowing authorizations to be valid for one year, a period specified in the authorization, or as provided by law, rather than requiring they be obtained within one year of disclosure request.

Expands disclosure exceptions to include state and federal law or regulations in addition to judicial orders like search warrants and subpoenas.

Redefines "health record" to mean protected health information as defined under HIPAA rather than the previous broader definition of any information related to patient health or payment.

Clarifies that providers may release patient identifying information and health record location data to record locator services without consent unless patients elect exclusion, and requires audit logs tracking provider access to such services.

Adds provisions allowing health records release to external researchers for medical or scientific research if patients are notified and given opportunity to object, with authorizations that do not expire but may be revoked in writing.