HIPAA compliance for telehealth practices in Minnesota

Minnesota keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Minnesota has 3 recorded rules that apply to telehealth practices differently from other businesses in the state — set out below with their conditions and sources.

Minnesota jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Minnesota's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Telehealth does not change the covered-entity test. A clinician or practice that electronically conducts an adopted transaction — or has one conducted on its behalf — is covered just as an in-person practice would be. Once covered, the duties below apply to the full remote-care environment.

State — how Minnesota law interacts with HIPAA

Minnesota's breach-notification statute contains no HIPAA-specific provision. Telehealth practices must satisfy the state regime on its own terms, independently of anything HIPAA requires.

No express HIPAA provision in Minn. Stat. § 325E.61. A full-scheme search of Minnesota's breach and health-privacy statutes (§ 325E.61 the general breach statute, § 13.055 the government-entity breach statute, § 144.291–.298 the Minnesota Health Records Act which governs authorized disclosure of health records but does NOT impose breach notification, and § 325M.10–.21 the Minnesota Consumer Data Privacy Act) shows no deemed-compliance clause substituting HIPAA for § 325E.61. HIPAA-regulated practices operating in Minnesota must therefore independently satisfy § 325E.61 for personal information within the section's scope. The § 325E.61 personal-information definition (subd. 1(e)) is primarily financial-identifier-oriented and does not carry a broad medical-information class, so in practice the overlap with PHI-only breaches is narrower than in states whose personal-information definition explicitly includes medical or health-insurance information (Connecticut's expanded definition, for example).

What Minnesota adds for telehealth practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Minnesota's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

Any minor may give effective consent for medical, mental and other health services to determine the presence of or to treat pregnancy and conditions associated with it, venereal disease, and alcohol and other drug abuse, and the consent of no other person is required.

Service: medical, mental and other health services to determine the presence of or to treat pregnancy and associated conditions, venereal disease, and alcohol and other drug abuse
Patient population: minors

Reaches this practice type when the service delivered is one of the three enumerated categories.

What this means operationally

Minnesota sets no age floor at all for these three subject areas, which is unusual, but this section reaches them and no further — a practice cannot treat it as a general mental-health consent simply because the words 'mental services' appear. Minnesota's general behavioral-health pathway is a separate provision, § 144.3431, which sets sixteen and covers nonresidential mental health services as defined by § 245.4871, subd. 29. The two are cumulative rather than competing: § 144.3431(b) states that it does not restrict consent rights available under other applicable law. Where a single episode independently satisfies both this section's subject matter AND § 144.3431's service, provider and setting conditions, either pathway may supply consent — but satisfying one does not establish the other.

Applies when

The service concerns pregnancy and associated conditions, venereal disease, or alcohol and other drug abuse

State statuteMinn. Stat. § 144.343, subd. 1All minors, with no age floor statedVerified 2026-08-29

Minor may consent

A minor who is age 16 or older may give effective consent for nonresidential mental health services, and the consent of no other person is required. Nonresidential mental health services are outpatient services as defined in § 245.4871, subdivision 29, provided to a minor who is not residing in a hospital, inpatient unit, or licensed residential treatment facility or program. This authority does not restrict consent rights available under § 144.344 or other applicable law.

Service: nonresidential mental health services — outpatient services as defined in § 245.4871, subd. 29
Patient population: minors aged 16 and older
Setting: the minor must not be residing in a hospital, inpatient unit, or licensed residential treatment facility or program

More than one provision may apply

§ 144.347 puts the cost of consented-to services on the minor. It was enacted in 1971 with §§ 144.341–144.343, and whether its "so consenting" reaches this later-added consent route is not settled on the face of the text. Treat guarantor selection here as a question to resolve, not a billing default. It arises only where a minor consents under this section alone and the visit generates a charge; where a parent consents alongside the minor, or the service carries no patient cost, nothing turns on it. Where it does arise, the answer decides whether a parent sees the charge.

Reaches this practice type when the service is nonresidential mental health treatment and the minor is not residing in an excluded setting.

What this means operationally

The setting condition is about where the minor LIVES, not where the appointment happens. A sixteen-year-old attending outpatient therapy while residing in a licensed residential treatment program is outside this section even though the service itself is outpatient, so intake has to establish residence and not merely appointment type. The service condition is also doing work: § 144.3431 does not reach any outpatient service a sixteen-year-old might receive, but the outpatient services § 245.4871, subd. 29 defines — qualifying mental health services delivered by or under the treatment supervision of a mental health professional. Because subdivision (b) expressly preserves other consent rights, this sits alongside § 144.343 rather than replacing it; where an episode independently satisfies both, either pathway may supply consent, and satisfying one does not establish the other.

Applies when

The minor is 16 or older
The services are outpatient mental health services as defined in § 245.4871, subd. 29
The minor is not residing in a hospital, inpatient unit, or licensed residential treatment facility or program

Exceptions

Does not reach a minor residing in a hospital, inpatient unit, or licensed residential treatment facility or program

State statuteMinn. Stat. § 144.3431Minors aged 16 and older not residing in an excluded settingVerified 2026-08-29

Provider disclosure to a parent

Provider may disclose, subject to a test

The professional may inform the parent or legal guardian of the minor patient of any treatment given or needed where, in the judgment of the professional, failure to inform the parent or guardian would seriously jeopardize the health of the minor patient.

Provider class: the professional treating the minor patient
Patient population: minor patients treated on their own consent

Reaches this practice type when the practice treated the minor on the minor's own consent.

What this means operationally

The trigger runs the opposite way from most of the corpus. Elsewhere the question is whether disclosing would harm the minor; in Minnesota it is whether NOT disclosing would seriously jeopardise their health. A clinician applying the more common harm-of-disclosure test here is asking a question the statute does not ask, and will reach the wrong answer in the cases that matter most.

Applies when

The minor was treated on their own consent
In the professional's judgment, failure to inform would seriously jeopardize the minor's health

State statuteMinn. Stat. § 144.346Minor patients treated on their own consentVerified 2026-08-29

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Minnesota breach obligations

These apply to businesses generally rather than to telehealth practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Minnesotabreach data →

Individual notice deadline

In the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. No numeric outer bound in the general breach statute.

The statute does not fix a numeric outer bound. Unreasonable delay is itself a violation and may result in state enforcement action, so treat the operative timeframe as the shortest window your incident circumstances reasonably support.

State regulator notice

Not required

None. § 325E.61 does not impose an Attorney General notification obligation on private (non-government) entities. Government entities notify the Legislative Auditor / State Auditor under the separate Minnesota Government Data Practices Act at § 13.055 — that section applies only to government entities and does NOT extend to private healthcare practices.

Source: Minn. Stat. § 325E.61, subd. 1(a)

Statewide rules that also reach telehealth practices

Minor may consent

Any minor who is living separate and apart from parents or legal guardian, and who is managing personal financial affairs, may give effective consent to personal medical, dental, mental and other health services.

What this means operationally

This is the broadest Minnesota pathway and the one least likely to be spotted, because it turns on the minor's living and financial situation rather than on the service. It reaches dental and general medical care that none of the subject-matter or behavioral-health provisions touch, so a practice outside behavioral health can still encounter a self-consenting minor in Minnesota. Intake has to be able to record independent living and financial self-management as a status.

Applies when

The minor is living separate and apart from parents or legal guardian
The minor is managing personal financial affairs

StatewideMinn. Stat. § 144.341Minors living apart and managing their own financial affairsVerified 2026-08-29

Minor may consent

Any minor who has been married or has borne a child may give effective consent to personal medical, mental, dental and other health services, or to services for the minor's child, and the consent of no other person is required.

What this means operationally

A status route rather than an age or service route, and it carries an unusual extension: the same minor may also consent for THEIR OWN CHILD. A practice seeing a minor parent is dealing with two patients under one consent authority, which intake has to be able to represent.

Applies when

The minor has been married, or has borne a child

StatewideMinn. Stat. § 144.342Minors who have been married or have borne a child, and their childrenVerified 2026-08-29

Minor may consent

Medical, dental, mental and other health services may be rendered to minors of any age without the consent of a parent or legal guardian when, in the professional's judgment, the risk to the minor's life or health is of such a nature that treatment should be given without delay and the requirement of consent would result in delay or denial of treatment.

What this means operationally

The judgment is about the consequence of DELAY, not about the severity of the condition — the test is whether requiring consent would delay or deny treatment. The record should therefore show why obtaining consent was not compatible with the timing, rather than merely that the presentation was urgent.

Applies when

In the professional's judgment the risk to life or health requires treatment without delay
Requiring consent would result in delay or denial of treatment

StatewideMinn. Stat. § 144.344Minors of any ageVerified 2026-08-29

Consent deemed effective

The consent of a minor who claims to be able to give effective consent for the purpose of receiving medical, dental, mental or other health services, but who may not in fact do so, shall be deemed effective without the consent of the minor's parent or legal guardian, if the person rendering the service relied in good faith upon the representations of the minor.

What this means operationally

This is the provision that makes the rest of the Minnesota scheme workable in practice. A minor asserting married status, independent living or having borne a child cannot usually be verified at the desk, and this section protects a good-faith reliance on that representation. What it protects is RELIANCE — so the record should capture what the minor represented and when, because that representation is the thing being relied on.

Applies when

The minor claimed to be able to give effective consent
The person rendering the service relied in good faith on the minor's representations

StatewideMinn. Stat. § 144.345Minors representing that they may consentVerified 2026-08-29

Payment liability

A minor so consenting for health services shall thereby assume financial responsibility for the cost of those services.

More than one provision may apply

Section 144.347 came in with the 1971 act alongside §§ 144.341, 144.342 and 144.343, and its "so consenting" plainly reaches those. It is not settled on the face of the text whether it also reaches the consent sections added later — § 144.3441 (1993, hepatitis B) and § 144.3431 (2023, nonresidential mental health). Those are recorded as related but unresolved rather than assumed in. § 144.344 is excluded because no minor consent is given under it, and § 144.345 operates by deeming a consent effective under the other sections rather than supplying an independent route.

What this means operationally

Consent and financial responsibility travel together in Minnesota, which makes billing a confidentiality surface rather than a back-office step. Where a minor consented under one of the consent sections, the statute puts the cost on the minor — so routing the charge to a parent's account or plan is not a neutral administrative default. Guarantor selection has to follow from which consent route was used.

Applies when

The minor gave effective consent under the Minnesota minor-consent sections

StatewideMinn. Stat. § 144.347Minors who consented on their own authorityVerified 2026-08-29

Deadline to respond to an access request

On request, a provider shall supply to a patient WITHIN 30 CALENDAR DAYS of receiving a written request complete and current information possessed by that provider concerning any diagnosis, treatment and prognosis of the patient, IN TERMS AND LANGUAGE THE PATIENT CAN REASONABLY BE EXPECTED TO UNDERSTAND. On a patient's written request the provider shall, within the same 30 calendar days and at a reasonable cost, furnish copies of the patient's health record — including laboratory reports, x-rays, prescriptions and other technical information used in assessing the patient's health conditions — or the pertinent portion relating to a condition the patient specifies. With the patient's consent the provider may instead furnish a summary. The provider may exclude written speculations about the patient's health condition, except that all information necessary for the patient's informed consent must be provided.

What this means operationally

Thirty CALENDAR days with no extension mechanism, which makes Minnesota stricter in shape than the federal baseline even though the number looks similar. Two obligations here are unusual and both are about comprehension rather than delivery: the information must be supplied in terms the patient can reasonably be expected to understand, and written speculations may be withheld ONLY so far as they are not necessary for informed consent. A summary may substitute for the record, but only with the patient's consent — it is not a unilateral option for a large file.

Applies when

A patient makes a written request for their records

Exceptions

Written speculations about the patient's health condition may be excluded, except where necessary for informed consent
A summary may be furnished instead of the record with the patient's consent
Except as provided in § 144.296

StatewideMinn. Stat. § 144.292, subds. 2, 5Patients requesting their own recordsVerified 2026-08-29

Provider must disclose

A provider shall give patients, IN A CLEAR AND CONSPICUOUS MANNER, a written notice concerning practices and rights with respect to access to health records. The notice must explain the disclosures of health records that may be made without the patient's written consent, including the type of records and to whom they may be disclosed, and the patient's right to have access to and obtain copies of their health records and other information the provider maintains. The requirement is satisfied if the notice accompanies the patient and resident bill of rights under § 144.652, or if it is displayed prominently in the provider's place of business. The commissioner of health develops the notice and publishes it in the State Register.

What this means operationally

A proactive disclosure duty rather than a response to a request, and one a practice can discharge two ways — bundled with the bill of rights, or displayed prominently on the premises. What makes it low-risk to comply with is that the commissioner publishes the notice itself in the State Register, so the content is supplied rather than drafted. What makes it easy to fail is that it is a standing obligation with no triggering event, so nothing in the workflow prompts it.

Applies when

A provider holds health records for patients

StatewideMinn. Stat. § 144.292, subd. 4All patients of the providerVerified 2026-08-29

Limit on copy fees, format or delivery

Where a patient requests a copy of their record FOR PURPOSES OF REVIEWING CURRENT MEDICAL CARE, the provider must not charge a fee. Otherwise the provider may charge no more than $1 per page for paper copies plus $10 for time spent retrieving and copying, $30 total for retrieving and reproducing x-rays, and $20 total for retrieving electronic copies — unless other law, rule or contract sets a lower maximum. Paper copy charges are further capped in total at $10 where no records are available, $30 for up to 25 pages, $50 for up to 100 pages, $50 plus 20 cents per page beyond 100, and $500 for any request. Where the request is for purposes of appealing a denial of Social Security disability benefits the provider may charge only a $10 retrieval fee and no per-page or x-ray fee, and must charge nothing at all — including no retrieval fee — where the patient is receiving public assistance, is represented by a civil legal services program, or is represented by a volunteer attorney program based on indigency, on production of the specified proof.

What this means operationally

The free-of-charge trigger is defined by the PURPOSE of the request rather than by who is asking, so a practice has to capture why the record is wanted at intake — reviewing current medical care costs nothing, and a disability appeal costs at most ten dollars or nothing at all. Minnesota also caps the total as well as the rate, and the $500 ceiling applies to any request however large, so a very large file cannot become an expensive one. The published rates are maxima that yield to any lower figure set by other law, rule or contract, which means a payer contract can reduce them.

Applies when

Copies of a health record are requested under § 144.292

Exceptions

No fee where the request is for purposes of reviewing current medical care
$10 retrieval fee only, or nothing, for Social Security disability appeals on the stated proof
Any lower maximum set by other law, rule or contract prevails

StatewideMinn. Stat. § 144.292, subd. 6Patients and their representativesVerified 2026-08-29

What applies to telehealth practices everywhere

Telehealth distributes the clinical environment across platforms, homes, devices, networks, recordings, messaging, and multiple states. Every one of those locations and systems becomes part of the practice's security and privacy responsibility.

The telehealth platform, its configuration, administrative access, integrations, waiting-room controls, chat, metadata, and recording features

Every clinician device, home-office environment, local network, headset, camera, screen, and physical privacy condition

EHR, intake, scheduling, patient portal, e-prescribing, laboratory, billing, and payment systems

Session recordings, transcripts, chat logs, uploaded documents, asynchronous messages, and cloud storage

Email, text, support, after-hours communication, and patient identity-verification workflows

Remote workforce onboarding, access changes, device loss, account compromise, and termination

Full telehealthcompliance guide →

Knowing the Minnesota rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Minnesota rules on this page.

Start the risk assessment