HIPAA compliance for dental practices in Minnesota

Minnesota keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Minnesota has 2 recorded rules that apply to dental practices differently from other businesses in the state — set out below with their conditions and sources.

Minnesota jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Minnesota's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Dental practices that electronically submit claims, check eligibility, request authorization, or have a billing service conduct those standard transactions on their behalf are HIPAA covered entities. Most modern dental practices meet that definition. Once covered, the duties below are required.

State — how Minnesota law interacts with HIPAA

Minnesota's breach-notification statute contains no HIPAA-specific provision. Dental practices must satisfy the state regime on its own terms, independently of anything HIPAA requires.

No express HIPAA provision in Minn. Stat. § 325E.61. A full-scheme search of Minnesota's breach and health-privacy statutes (§ 325E.61 the general breach statute, § 13.055 the government-entity breach statute, § 144.291–.298 the Minnesota Health Records Act which governs authorized disclosure of health records but does NOT impose breach notification, and § 325M.10–.21 the Minnesota Consumer Data Privacy Act) shows no deemed-compliance clause substituting HIPAA for § 325E.61. HIPAA-regulated practices operating in Minnesota must therefore independently satisfy § 325E.61 for personal information within the section's scope. The § 325E.61 personal-information definition (subd. 1(e)) is primarily financial-identifier-oriented and does not carry a broad medical-information class, so in practice the overlap with PHI-only breaches is narrower than in states whose personal-information definition explicitly includes medical or health-insurance information (Connecticut's expanded definition, for example).

What Minnesota adds for dental practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Minnesota's general breach law, which applies the same way to every business in the state.

How long records must be kept

How long the record must be kept

For an ADULT patient with an ACTIVE file, the dentist must maintain the patient's ENTIRE dental record. For an adult patient with an INACTIVE file, the dentist must maintain the records for at least seven years beyond the patient's last date of treatment by the dentist. For a MINOR patient with an active file, the dentist must maintain the entire dental record. For a minor patient with an inactive file, the dentist must maintain the records UNTIL THE PATIENT IS 25 YEARS OLD.

Provider class: dentists
Record class: dental records

What this means operationally

The rule turns on FILE STATUS before it turns on time, which is unlike any other retention provision in this corpus. While a file is active there is no period at all — the entire record must be kept, indefinitely. The clock only starts when the file goes inactive, which makes 'inactive' an operational determination a practice has to be able to make and evidence, not merely a state its software drifts into. The minor rule is an absolute age rather than a duration: a child treated at three and never seen again produces a twenty-two year duty, far longer than the seven years an adult would generate.

Applies when

A dentist holds a dental record for a patient

Exceptions

While a file is active the entire record must be maintained, with no period stated

State regulationMinn. R. 3100.9600, subp. 12Dental patients, adult and minorVerified 2026-08-29

Patient access to records

Right to amend or correct the record

If incorrect information is placed in a written dental record, it must be amended by crossing out WITH ONE SINGLE LINE and initialled by the provider, and the provider initialling must identify who the provider is on the written record. In an electronic health record, an amendment must be electronically TIME AND DATE STAMPED by the provider. Where electronic records are kept, a dentist must use an UNALTERABLE electronic record.

Provider class: dentists and other dental providers
Record class: dental records, written and electronic

What this means operationally

A prescribed correction method, and the single-line rule is the point: the original entry has to remain legible, so obliterating or overwriting an error is itself a breach even where the corrected information is accurate. For electronic records the equivalent is an unalterable system with time and date stamping, which is a procurement constraint rather than a workflow one — a practice cannot satisfy this rule with software that permits silent edits, however careful its staff are.

Applies when

Incorrect information has been placed in a dental record

State regulationMinn. R. 3100.9600, subps. 11, 14Dental patientsVerified 2026-08-29

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Minnesota breach obligations

These apply to businesses generally rather than to dental practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Minnesotabreach data →

Individual notice deadline

In the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. No numeric outer bound in the general breach statute.

The statute does not fix a numeric outer bound. Unreasonable delay is itself a violation and may result in state enforcement action, so treat the operative timeframe as the shortest window your incident circumstances reasonably support.

State regulator notice

Not required

None. § 325E.61 does not impose an Attorney General notification obligation on private (non-government) entities. Government entities notify the Legislative Auditor / State Auditor under the separate Minnesota Government Data Practices Act at § 13.055 — that section applies only to government entities and does NOT extend to private healthcare practices.

Source: Minn. Stat. § 325E.61, subd. 1(a)

Statewide rules that also reach dental practices

Minor may consent

Any minor who is living separate and apart from parents or legal guardian, and who is managing personal financial affairs, may give effective consent to personal medical, dental, mental and other health services.

What this means operationally

This is the broadest Minnesota pathway and the one least likely to be spotted, because it turns on the minor's living and financial situation rather than on the service. It reaches dental and general medical care that none of the subject-matter or behavioral-health provisions touch, so a practice outside behavioral health can still encounter a self-consenting minor in Minnesota. Intake has to be able to record independent living and financial self-management as a status.

Applies when

The minor is living separate and apart from parents or legal guardian
The minor is managing personal financial affairs

StatewideMinn. Stat. § 144.341Minors living apart and managing their own financial affairsVerified 2026-08-29

Minor may consent

Any minor who has been married or has borne a child may give effective consent to personal medical, mental, dental and other health services, or to services for the minor's child, and the consent of no other person is required.

What this means operationally

A status route rather than an age or service route, and it carries an unusual extension: the same minor may also consent for THEIR OWN CHILD. A practice seeing a minor parent is dealing with two patients under one consent authority, which intake has to be able to represent.

Applies when

The minor has been married, or has borne a child

StatewideMinn. Stat. § 144.342Minors who have been married or have borne a child, and their childrenVerified 2026-08-29

Minor may consent

Medical, dental, mental and other health services may be rendered to minors of any age without the consent of a parent or legal guardian when, in the professional's judgment, the risk to the minor's life or health is of such a nature that treatment should be given without delay and the requirement of consent would result in delay or denial of treatment.

What this means operationally

The judgment is about the consequence of DELAY, not about the severity of the condition — the test is whether requiring consent would delay or deny treatment. The record should therefore show why obtaining consent was not compatible with the timing, rather than merely that the presentation was urgent.

Applies when

In the professional's judgment the risk to life or health requires treatment without delay
Requiring consent would result in delay or denial of treatment

StatewideMinn. Stat. § 144.344Minors of any ageVerified 2026-08-29

Consent deemed effective

The consent of a minor who claims to be able to give effective consent for the purpose of receiving medical, dental, mental or other health services, but who may not in fact do so, shall be deemed effective without the consent of the minor's parent or legal guardian, if the person rendering the service relied in good faith upon the representations of the minor.

What this means operationally

This is the provision that makes the rest of the Minnesota scheme workable in practice. A minor asserting married status, independent living or having borne a child cannot usually be verified at the desk, and this section protects a good-faith reliance on that representation. What it protects is RELIANCE — so the record should capture what the minor represented and when, because that representation is the thing being relied on.

Applies when

The minor claimed to be able to give effective consent
The person rendering the service relied in good faith on the minor's representations

StatewideMinn. Stat. § 144.345Minors representing that they may consentVerified 2026-08-29

Payment liability

A minor so consenting for health services shall thereby assume financial responsibility for the cost of those services.

More than one provision may apply

Section 144.347 came in with the 1971 act alongside §§ 144.341, 144.342 and 144.343, and its "so consenting" plainly reaches those. It is not settled on the face of the text whether it also reaches the consent sections added later — § 144.3441 (1993, hepatitis B) and § 144.3431 (2023, nonresidential mental health). Those are recorded as related but unresolved rather than assumed in. § 144.344 is excluded because no minor consent is given under it, and § 144.345 operates by deeming a consent effective under the other sections rather than supplying an independent route.

What this means operationally

Consent and financial responsibility travel together in Minnesota, which makes billing a confidentiality surface rather than a back-office step. Where a minor consented under one of the consent sections, the statute puts the cost on the minor — so routing the charge to a parent's account or plan is not a neutral administrative default. Guarantor selection has to follow from which consent route was used.

Applies when

The minor gave effective consent under the Minnesota minor-consent sections

StatewideMinn. Stat. § 144.347Minors who consented on their own authorityVerified 2026-08-29

Deadline to respond to an access request

On request, a provider shall supply to a patient WITHIN 30 CALENDAR DAYS of receiving a written request complete and current information possessed by that provider concerning any diagnosis, treatment and prognosis of the patient, IN TERMS AND LANGUAGE THE PATIENT CAN REASONABLY BE EXPECTED TO UNDERSTAND. On a patient's written request the provider shall, within the same 30 calendar days and at a reasonable cost, furnish copies of the patient's health record — including laboratory reports, x-rays, prescriptions and other technical information used in assessing the patient's health conditions — or the pertinent portion relating to a condition the patient specifies. With the patient's consent the provider may instead furnish a summary. The provider may exclude written speculations about the patient's health condition, except that all information necessary for the patient's informed consent must be provided.

What this means operationally

Thirty CALENDAR days with no extension mechanism, which makes Minnesota stricter in shape than the federal baseline even though the number looks similar. Two obligations here are unusual and both are about comprehension rather than delivery: the information must be supplied in terms the patient can reasonably be expected to understand, and written speculations may be withheld ONLY so far as they are not necessary for informed consent. A summary may substitute for the record, but only with the patient's consent — it is not a unilateral option for a large file.

Applies when

A patient makes a written request for their records

Exceptions

Written speculations about the patient's health condition may be excluded, except where necessary for informed consent
A summary may be furnished instead of the record with the patient's consent
Except as provided in § 144.296

StatewideMinn. Stat. § 144.292, subds. 2, 5Patients requesting their own recordsVerified 2026-08-29

Provider must disclose

A provider shall give patients, IN A CLEAR AND CONSPICUOUS MANNER, a written notice concerning practices and rights with respect to access to health records. The notice must explain the disclosures of health records that may be made without the patient's written consent, including the type of records and to whom they may be disclosed, and the patient's right to have access to and obtain copies of their health records and other information the provider maintains. The requirement is satisfied if the notice accompanies the patient and resident bill of rights under § 144.652, or if it is displayed prominently in the provider's place of business. The commissioner of health develops the notice and publishes it in the State Register.

What this means operationally

A proactive disclosure duty rather than a response to a request, and one a practice can discharge two ways — bundled with the bill of rights, or displayed prominently on the premises. What makes it low-risk to comply with is that the commissioner publishes the notice itself in the State Register, so the content is supplied rather than drafted. What makes it easy to fail is that it is a standing obligation with no triggering event, so nothing in the workflow prompts it.

Applies when

A provider holds health records for patients

StatewideMinn. Stat. § 144.292, subd. 4All patients of the providerVerified 2026-08-29

Limit on copy fees, format or delivery

Where a patient requests a copy of their record FOR PURPOSES OF REVIEWING CURRENT MEDICAL CARE, the provider must not charge a fee. Otherwise the provider may charge no more than $1 per page for paper copies plus $10 for time spent retrieving and copying, $30 total for retrieving and reproducing x-rays, and $20 total for retrieving electronic copies — unless other law, rule or contract sets a lower maximum. Paper copy charges are further capped in total at $10 where no records are available, $30 for up to 25 pages, $50 for up to 100 pages, $50 plus 20 cents per page beyond 100, and $500 for any request. Where the request is for purposes of appealing a denial of Social Security disability benefits the provider may charge only a $10 retrieval fee and no per-page or x-ray fee, and must charge nothing at all — including no retrieval fee — where the patient is receiving public assistance, is represented by a civil legal services program, or is represented by a volunteer attorney program based on indigency, on production of the specified proof.

What this means operationally

The free-of-charge trigger is defined by the PURPOSE of the request rather than by who is asking, so a practice has to capture why the record is wanted at intake — reviewing current medical care costs nothing, and a disability appeal costs at most ten dollars or nothing at all. Minnesota also caps the total as well as the rate, and the $500 ceiling applies to any request however large, so a very large file cannot become an expensive one. The published rates are maxima that yield to any lower figure set by other law, rule or contract, which means a payer contract can reduce them.

Applies when

Copies of a health record are requested under § 144.292

Exceptions

No fee where the request is for purposes of reviewing current medical care
$10 retrieval fee only, or nothing, for Social Security disability appeals on the stated proof
Any lower maximum set by other law, rule or contract prevails

StatewideMinn. Stat. § 144.292, subd. 6Patients and their representativesVerified 2026-08-29

What applies to dental practices everywhere

Dental ePHI does not live in one system. It moves through the practice management system, digital imaging equipment, operatories, front-desk workstations, insurance transactions, laboratories, referral workflows, mobile devices, cloud backups, patient communication, and third-party support systems.

The practice management system and every user with administrative, clinical, scheduling, or billing access

Panoramic, CBCT, intraoral, and other imaging systems — including how images move between devices, workstations, laboratories, specialists, and storage

Electronic claims, eligibility verification, payment, and clearinghouse workflows

Patient portals, digital forms, e-fax, email, text messaging, appointment reminders, and referral tools

Office servers, workstations, laptops, tablets, phones, removable media, network equipment, and cloud backups

Every vendor that stores, maintains, transmits, or can remotely access the practice's ePHI

Full dentistscompliance guide →

Knowing the Minnesota rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Minnesota rules on this page.

Start the risk assessment