MN SF2897

Modifies authorization requirements for health records disclosure, changing the requirement that authorizations be obtained "one year or less before" disclosure to instead allowing authorization valid for one year, a period specified in the authorization, or as provided by law.

Expands health records disclosure without patient consent to include releases permitted or required by state or federal law or regulation, in addition to federal law.

Redefines "health record" in Minnesota statute to mean "protected health information as defined in HIPAA" rather than the previous broader definition.

Permits providers to release deceased patient health records to another provider for purposes of diagnosing or treating the deceased patient's surviving adult child without consent.

Requires health information exchanges maintaining record locator or patient information services to maintain audit logs tracking provider access, including the identity of the provider, patient, and date of access.