HIPAA compliance for dermatology practices in Minnesota

Minnesota keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Patient Protect has not recorded any Minnesota rule that applies to dermatology practices differently from other providers in the state — the statewide rules below are the ones that reach you.

Minnesota jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Minnesota's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Dermatology practices that electronically bill, check eligibility, request authorization, or conduct other adopted transactions are HIPAA covered entities. Once covered, the duties below apply to records, photographs, pathology, teledermatology, devices, people, and vendors — not just the EHR.

State — how Minnesota law interacts with HIPAA

Minnesota's breach-notification statute contains no HIPAA-specific provision. Dermatology practices must satisfy the state regime on its own terms, independently of anything HIPAA requires.

No express HIPAA provision in Minn. Stat. § 325E.61. A full-scheme search of Minnesota's breach and health-privacy statutes (§ 325E.61 the general breach statute, § 13.055 the government-entity breach statute, § 144.291–.298 the Minnesota Health Records Act which governs authorized disclosure of health records but does NOT impose breach notification, and § 325M.10–.21 the Minnesota Consumer Data Privacy Act) shows no deemed-compliance clause substituting HIPAA for § 325E.61. HIPAA-regulated practices operating in Minnesota must therefore independently satisfy § 325E.61 for personal information within the section's scope. The § 325E.61 personal-information definition (subd. 1(e)) is primarily financial-identifier-oriented and does not carry a broad medical-information class, so in practice the overlap with PHI-only breaches is narrower than in states whose personal-information definition explicitly includes medical or health-insurance information (Connecticut's expanded definition, for example).

What Minnesota adds for dermatology practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Minnesota's general breach law, which applies the same way to every business in the state.

No verified intersection rules recorded

Patient Protect has not recorded any Minnesota rule that applies to dermatology practices differently from any other practice in the state. Where that is the case, the federal obligations and the Minnesota rules below are the whole picture, and the dermatology guidance that applies nationally is the better starting point.

HIPAA compliance for dermatology practices→

Minnesota breach obligations

These apply to businesses generally rather than to dermatology practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Minnesotabreach data →

Individual notice deadline

In the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. No numeric outer bound in the general breach statute.

The statute does not fix a numeric outer bound. Unreasonable delay is itself a violation and may result in state enforcement action, so treat the operative timeframe as the shortest window your incident circumstances reasonably support.

State regulator notice

Not required

None. § 325E.61 does not impose an Attorney General notification obligation on private (non-government) entities. Government entities notify the Legislative Auditor / State Auditor under the separate Minnesota Government Data Practices Act at § 13.055 — that section applies only to government entities and does NOT extend to private healthcare practices.

Source: Minn. Stat. § 325E.61, subd. 1(a)

Statewide rules that also reach dermatology practices

Minor may consent

Any minor who is living separate and apart from parents or legal guardian, and who is managing personal financial affairs, may give effective consent to personal medical, dental, mental and other health services.

What this means operationally

This is the broadest Minnesota pathway and the one least likely to be spotted, because it turns on the minor's living and financial situation rather than on the service. It reaches dental and general medical care that none of the subject-matter or behavioral-health provisions touch, so a practice outside behavioral health can still encounter a self-consenting minor in Minnesota. Intake has to be able to record independent living and financial self-management as a status.

Applies when

The minor is living separate and apart from parents or legal guardian
The minor is managing personal financial affairs

StatewideMinn. Stat. § 144.341Minors living apart and managing their own financial affairsVerified 2026-08-29

Minor may consent

Any minor who has been married or has borne a child may give effective consent to personal medical, mental, dental and other health services, or to services for the minor's child, and the consent of no other person is required.

What this means operationally

A status route rather than an age or service route, and it carries an unusual extension: the same minor may also consent for THEIR OWN CHILD. A practice seeing a minor parent is dealing with two patients under one consent authority, which intake has to be able to represent.

Applies when

The minor has been married, or has borne a child

StatewideMinn. Stat. § 144.342Minors who have been married or have borne a child, and their childrenVerified 2026-08-29

Minor may consent

Medical, dental, mental and other health services may be rendered to minors of any age without the consent of a parent or legal guardian when, in the professional's judgment, the risk to the minor's life or health is of such a nature that treatment should be given without delay and the requirement of consent would result in delay or denial of treatment.

What this means operationally

The judgment is about the consequence of DELAY, not about the severity of the condition — the test is whether requiring consent would delay or deny treatment. The record should therefore show why obtaining consent was not compatible with the timing, rather than merely that the presentation was urgent.

Applies when

In the professional's judgment the risk to life or health requires treatment without delay
Requiring consent would result in delay or denial of treatment

StatewideMinn. Stat. § 144.344Minors of any ageVerified 2026-08-29

Consent deemed effective

The consent of a minor who claims to be able to give effective consent for the purpose of receiving medical, dental, mental or other health services, but who may not in fact do so, shall be deemed effective without the consent of the minor's parent or legal guardian, if the person rendering the service relied in good faith upon the representations of the minor.

What this means operationally

This is the provision that makes the rest of the Minnesota scheme workable in practice. A minor asserting married status, independent living or having borne a child cannot usually be verified at the desk, and this section protects a good-faith reliance on that representation. What it protects is RELIANCE — so the record should capture what the minor represented and when, because that representation is the thing being relied on.

Applies when

The minor claimed to be able to give effective consent
The person rendering the service relied in good faith on the minor's representations

StatewideMinn. Stat. § 144.345Minors representing that they may consentVerified 2026-08-29

Payment liability

A minor so consenting for health services shall thereby assume financial responsibility for the cost of those services.

More than one provision may apply

Section 144.347 came in with the 1971 act alongside §§ 144.341, 144.342 and 144.343, and its "so consenting" plainly reaches those. It is not settled on the face of the text whether it also reaches the consent sections added later — § 144.3441 (1993, hepatitis B) and § 144.3431 (2023, nonresidential mental health). Those are recorded as related but unresolved rather than assumed in. § 144.344 is excluded because no minor consent is given under it, and § 144.345 operates by deeming a consent effective under the other sections rather than supplying an independent route.

What this means operationally

Consent and financial responsibility travel together in Minnesota, which makes billing a confidentiality surface rather than a back-office step. Where a minor consented under one of the consent sections, the statute puts the cost on the minor — so routing the charge to a parent's account or plan is not a neutral administrative default. Guarantor selection has to follow from which consent route was used.

Applies when

The minor gave effective consent under the Minnesota minor-consent sections

StatewideMinn. Stat. § 144.347Minors who consented on their own authorityVerified 2026-08-29

Deadline to respond to an access request

On request, a provider shall supply to a patient WITHIN 30 CALENDAR DAYS of receiving a written request complete and current information possessed by that provider concerning any diagnosis, treatment and prognosis of the patient, IN TERMS AND LANGUAGE THE PATIENT CAN REASONABLY BE EXPECTED TO UNDERSTAND. On a patient's written request the provider shall, within the same 30 calendar days and at a reasonable cost, furnish copies of the patient's health record — including laboratory reports, x-rays, prescriptions and other technical information used in assessing the patient's health conditions — or the pertinent portion relating to a condition the patient specifies. With the patient's consent the provider may instead furnish a summary. The provider may exclude written speculations about the patient's health condition, except that all information necessary for the patient's informed consent must be provided.

What this means operationally

Thirty CALENDAR days with no extension mechanism, which makes Minnesota stricter in shape than the federal baseline even though the number looks similar. Two obligations here are unusual and both are about comprehension rather than delivery: the information must be supplied in terms the patient can reasonably be expected to understand, and written speculations may be withheld ONLY so far as they are not necessary for informed consent. A summary may substitute for the record, but only with the patient's consent — it is not a unilateral option for a large file.

Applies when

A patient makes a written request for their records

Exceptions

Written speculations about the patient's health condition may be excluded, except where necessary for informed consent
A summary may be furnished instead of the record with the patient's consent
Except as provided in § 144.296

StatewideMinn. Stat. § 144.292, subds. 2, 5Patients requesting their own recordsVerified 2026-08-29

Provider must disclose

A provider shall give patients, IN A CLEAR AND CONSPICUOUS MANNER, a written notice concerning practices and rights with respect to access to health records. The notice must explain the disclosures of health records that may be made without the patient's written consent, including the type of records and to whom they may be disclosed, and the patient's right to have access to and obtain copies of their health records and other information the provider maintains. The requirement is satisfied if the notice accompanies the patient and resident bill of rights under § 144.652, or if it is displayed prominently in the provider's place of business. The commissioner of health develops the notice and publishes it in the State Register.

What this means operationally

A proactive disclosure duty rather than a response to a request, and one a practice can discharge two ways — bundled with the bill of rights, or displayed prominently on the premises. What makes it low-risk to comply with is that the commissioner publishes the notice itself in the State Register, so the content is supplied rather than drafted. What makes it easy to fail is that it is a standing obligation with no triggering event, so nothing in the workflow prompts it.

Applies when

A provider holds health records for patients

StatewideMinn. Stat. § 144.292, subd. 4All patients of the providerVerified 2026-08-29

Limit on copy fees, format or delivery

Where a patient requests a copy of their record FOR PURPOSES OF REVIEWING CURRENT MEDICAL CARE, the provider must not charge a fee. Otherwise the provider may charge no more than $1 per page for paper copies plus $10 for time spent retrieving and copying, $30 total for retrieving and reproducing x-rays, and $20 total for retrieving electronic copies — unless other law, rule or contract sets a lower maximum. Paper copy charges are further capped in total at $10 where no records are available, $30 for up to 25 pages, $50 for up to 100 pages, $50 plus 20 cents per page beyond 100, and $500 for any request. Where the request is for purposes of appealing a denial of Social Security disability benefits the provider may charge only a $10 retrieval fee and no per-page or x-ray fee, and must charge nothing at all — including no retrieval fee — where the patient is receiving public assistance, is represented by a civil legal services program, or is represented by a volunteer attorney program based on indigency, on production of the specified proof.

What this means operationally

The free-of-charge trigger is defined by the PURPOSE of the request rather than by who is asking, so a practice has to capture why the record is wanted at intake — reviewing current medical care costs nothing, and a disability appeal costs at most ten dollars or nothing at all. Minnesota also caps the total as well as the rate, and the $500 ceiling applies to any request however large, so a very large file cannot become an expensive one. The published rates are maxima that yield to any lower figure set by other law, rule or contract, which means a payer contract can reduce them.

Applies when

Copies of a health record are requested under § 144.292

Exceptions

No fee where the request is for purposes of reviewing current medical care
$10 retrieval fee only, or nothing, for Social Security disability appeals on the stated proof
Any lower maximum set by other law, rule or contract prevails

StatewideMinn. Stat. § 144.292, subd. 6Patients and their representativesVerified 2026-08-29

What applies to dermatology practices everywhere

Clinical photography makes dermatology unusually exposed. Images can contain a face, tattoo, body location, embedded metadata, patient identifier, or clinical context. The SRA must follow those images from capture through storage, treatment use, disclosure, marketing, retention, and deletion.

Every device used to capture clinical photographs, dermoscopy images, wound documentation, and treatment-progress images

Camera rolls, automatic cloud synchronization, local storage, image upload, EHR attachment, backup, and deletion

The EHR, practice-management system, portal, teledermatology platform, imaging tools, and photo-management systems

Dermatopathology, laboratory, biopsy, Mohs, referral, and specialist data flows

Email, text, e-fax, patient forms, scheduling, and delivery of images or results

Before-and-after photography used for treatment documentation, education, websites, advertising, or social media

Full dermatologycompliance guide →

Federal obligations still have to be evidenced for dermatology practices in Minnesota.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Minnesota rules on this page.

Start the risk assessment