Patient Privacy




"Big Government" in Your Medicine Cabinet?!

Health department's legal authority to collect private medical data remains intact

Although the Minnesota Department of Health has today withdrawn the proposed rule to collect patient medical record data without patient consent, the public should not be relieved. So says Citizens' Council on Health Care, the Minnesota health care policy organization who has long opposed this plan.

Minnesota Plans to Create State Health Database

Although the proposed department RULE was withdrawn in 2003 due to public outcry, the state LAW (M.S. 62J.301 and 62J.321) was not repealed. By law, the health department can still gather private medical records data, including genetic data, without patient consent. No rule is required.

EMPLOYER GROUPS AND RESEARCHERS support data collection: read their testimony

Partial Transcript
Minnesota House Health and Human Services Policy Committee
February 10, 2003
Chair: Representative Lynda Boudreau (R-Faribault)
House File 297 (Author: Rep. Bill Haas (R-Champlin))

Times Testimony on Minnesota Department of Health Rule 4653 House Health and Human Services Policy Committee Chair: Rep. Lynda Boudreau

Health officials kept the average citizen in the dark about their plan. Although the department sent out notices to various individuals and organizations, the department buried the rulemaking process and the proposed rule in its website where even I, who was looking specifically for it, couldn't find it until I searched under the word "encounter," a word most of the public wouldn't know. Second, the department gave the rule a less than descriptive title: Proposed Permanent Rules for Administrative Billing Data. This title does not indicate that a patient-tracking system was being set up. And finally, the department did not distribute a press release on their intentions, inviting the public to comment.


CONTACT YOUR LEGISLATORS. The rule is based on a 10-year old state law. The Minnesota Legislature can choose to repeal or change the law that enabled the rule. Send or email a separate letter (or a copy of your previous letter to the judge or MDH) to your state Representative and Senator.

Public Opposes State Collection of Private Medical Information

We gathered and in this report published the many public comments received by the Minnesota Department of Health's August 19, 2002 proposed rule to require most hospitals and health insurers to collect and electronically transmit individually-identifiable medical record data to the Department without patient consent: Proposed Permanent Rule Regarding Administrative Billing Data, Minnesota Rules, chapter 4653. The public was not pleased. The comments forced a public hearing.

SELECT QUOTES: Judge Allan Klein's Ruling on State Plan to Collect Patient Data Without Patient Consent

Striking an appropriate balance between personal privacy and healthcare research is ultimately the task of the legislature. To date, the legislature has chosen to allow the collection and use of data for research purposes, but only if the Department takes steps to protect individual privacy. The Administrative Law Judge has taken a "hard look" at the privacy protections in these proposed rules. He believes that the Department's proposals do meet the standard set by the legislature; in fact, they go well beyond the minimal efforts required to comply with the statutes.

The Judge's Ruling

This Report is part of a rulemaking proceeding held pursuant to Minn. Stat. §§ 14.131 to 14.20 to hear public comment, determine whether the Department of Health (hereinafter referred to as “the Department”) has fulfilled all relevant substantive and procedural requirements of law applicable to the adoption of the rules, evaluate whether the proposed rules are needed and reasonable, and assess whether or not any modifications to the rules proposed by the Department after initial publication are substantially different from the rules as originally proposed.


By federal law and rule, you are not required to sign the clinic or hospital HIPAA "Privacy" form...even if the clinic or hospital tries to insist that you must. The form has nothing to do with consent or health privacy. The form is actually just an acknowledgment that you have received and understood the clinic or hospital's "Notice of Privacy Practices," which given the permissive access allowed, could better be described as a Notice of Data Disclosure Practices.