What a provider can and can't say in Minnesota
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | MHRA 144.293 (signed consent; no review exception) + 147.091 subd.1(m); Olson/Schulz 2016 (secondary) |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | MHRA 144.293 (signed consent; no review exception) + 147.091 subd.1(m); Olson/Schulz 2016 (secondary) |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | MHRA 144.293 (signed consent; no review exception) + 147.091 subd.1(m); Olson/Schulz 2016 (secondary) |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | MHRA 144.293 (signed consent; no review exception) + 147.091 subd.1(m); Olson/Schulz 2016 (secondary) |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No (estheticians, ch. 155A, are not MHRA providers) | MHRA 144.293 (signed consent; no review exception) + 147.091 subd.1(m); Olson/Schulz 2016 (secondary) |
- Consumer privacy and health data law: Minnesota has a consumer privacy law in force (MCDPA eff. 2025-07-31). It exempts only HIPAA-protected health information (a data-level exemption), so a covered practice's other data, such as website or marketing data, can still fall under it. [MN-003, MN-004]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). [MN-006]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (MHRA). [MN-001]
- Patient confidentiality duties: The state confidentiality law applies to licensed providers (Board: revealing privileged communication). [MN-005]
- Lawsuits by individuals: Patients may be able to sue in some situations (144.298). [MN-002]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located.† [MN-007, U-98]
- Med spa rules: Med spas: no med-spa-specific statute was located. [MN-005]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2) (Board of Medical Practice orders, 2016, read only as copies on an unofficial website). Not finding enforcement does not mean none exists.† [MN-008]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [MN-001] Minn. Stat. 144.291 subd. 2(c), (i); 144.293 subd. 2 (https://www.revisor.mn.gov/statutes/cite/144.293)
- [MN-002] Minn. Stat. 144.298 subds. 1-2 (https://www.revisor.mn.gov/statutes/cite/144.298)
- [MN-003] Minn. Stat. 325M.10; 325M.12 subds. 1-2; 325M.17 subd. 2(a)(3)-(6), (19) (https://www.revisor.mn.gov/statutes/cite/325M/full)
- [MN-004] Minn. Stat. 325M.11(v); 325M.20(a)-(d) (https://www.revisor.mn.gov/statutes/cite/325M/full)
- [MN-005] Minn. Stat. 147.091 subd. 1(e), (h), (i), (m), (o); 150A.08 subd. 1(13) (https://www.revisor.mn.gov/statutes/cite/147.091)
- [MN-006] Minn. Stat. 325E.61 subd. 1(e), subd. 6 (https://www.revisor.mn.gov/statutes/cite/325E.61)
- [MN-007] Yath v. Fairview Clinics, N.P., 767 N.W.2d 34 (Minn. Ct. App. 2009) (https://law.justia.com/cases/minnesota/court-of-appeals/2009/opa081556-0623.html)
- [MN-008] In re Stephen C. Olson, M.D.; In re S. Charles Schulz, M.D. (http://www.circare.org/pd/olson-reprimand-20160514.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Minnesota (MN) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Minnesota Health Records Act 144.291-.298 (all listed licensees; oral info included) | Yes - applies to licensed providers regardless of HIPAA status | MCDPA (325M.10-.21), eff. 2025-07-31: DATA-level exemptions; 100k / 25k+25%; SBA small businesses excluded except sale of sensitive data | 325E.61: medical info NOT covered; most expedient time; AG enforces | MHRA 144.293 (signed consent; no review exception) + 147.091 subd.1(m); Olson/Schulz 2016 (secondary) | MHRA consent for release (oral or recorded health info); HIPAA if covered; MCDPA consent for sensitive data if in scope | None statutory located (common-law appropriation; Lake v. Wal-Mart (1998) not read) | Yes: MHRA 144.298 subd. 2 (compensatory damages + fees, negligent or intentional); none under MCDPA | Board of Medical Practice, Board of Dentistry, Board of Nursing, Board of Cosmetologist Examiners, AG | MCDPA up to $7,500/violation; license discipline | E2 (MN BMP Olson/Schulz 2016: privileged documents posted on public website; reprimands; order copies on an unofficial host) | High | 2026-10-22 |
| Minnesota (MN) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Minnesota Health Records Act 144.291-.298 (all listed licensees; oral info included) | Yes - applies to licensed providers regardless of HIPAA status | MCDPA (325M.10-.21), eff. 2025-07-31: DATA-level exemptions; 100k / 25k+25%; SBA small businesses excluded except sale of sensitive data | 325E.61: medical info NOT covered; most expedient time; AG enforces | MHRA 144.293 (signed consent; no review exception) + 147.091 subd.1(m); Olson/Schulz 2016 (secondary) | MHRA consent for release (oral or recorded health info); HIPAA if covered; MCDPA consent for sensitive data if in scope | None statutory located (common-law appropriation; Lake v. Wal-Mart (1998) not read) | Yes: MHRA 144.298 subd. 2 (compensatory damages + fees, negligent or intentional); none under MCDPA | Board of Medical Practice, Board of Dentistry, Board of Nursing, Board of Cosmetologist Examiners, AG | MCDPA up to $7,500/violation; license discipline | E2 (MN BMP Olson/Schulz 2016: privileged documents posted on public website; reprimands; order copies on an unofficial host) | High | 2026-10-22 |
| Minnesota (MN) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Minnesota Health Records Act 144.291-.298 (all listed licensees; oral info included) | Yes - applies to licensed providers regardless of HIPAA status | MCDPA (325M.10-.21), eff. 2025-07-31: DATA-level exemptions; 100k / 25k+25%; SBA small businesses excluded except sale of sensitive data | 325E.61: medical info NOT covered; most expedient time; AG enforces | MHRA 144.293 (signed consent; no review exception) + 147.091 subd.1(m); Olson/Schulz 2016 (secondary) | MHRA consent for release (oral or recorded health info); HIPAA if covered; MCDPA consent for sensitive data if in scope | None statutory located (common-law appropriation; Lake v. Wal-Mart (1998) not read) | Yes: MHRA 144.298 subd. 2 (compensatory damages + fees, negligent or intentional); none under MCDPA | Board of Medical Practice, Board of Dentistry, Board of Nursing, Board of Cosmetologist Examiners, AG | MCDPA up to $7,500/violation; license discipline | E2 (MN BMP Olson/Schulz 2016: privileged documents posted on public website; reprimands; order copies on an unofficial host) | High | 2026-10-22 |
| Minnesota (MN) | Medical med spa | Depends; cash-only med spas often not covered | Minnesota Health Records Act 144.291-.298 (all listed licensees; oral info included) | Yes - applies to licensed providers regardless of HIPAA status | MCDPA (325M.10-.21), eff. 2025-07-31: DATA-level exemptions; 100k / 25k+25%; SBA small businesses excluded except sale of sensitive data | 325E.61: medical info NOT covered; most expedient time; AG enforces | MHRA 144.293 (signed consent; no review exception) + 147.091 subd.1(m); Olson/Schulz 2016 (secondary) | MHRA consent for release (oral or recorded health info); HIPAA if covered; MCDPA consent for sensitive data if in scope | None statutory located (common-law appropriation; Lake v. Wal-Mart (1998) not read) | Yes: MHRA 144.298 subd. 2 (compensatory damages + fees, negligent or intentional); none under MCDPA | Board of Medical Practice, Board of Dentistry, Board of Nursing, Board of Cosmetologist Examiners, AG | MCDPA up to $7,500/violation; license discipline | E2 (MN BMP Olson/Schulz 2016: privileged documents posted on public website; reprimands; order copies on an unofficial host) | High | 2026-10-22 |
| Minnesota (MN) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Minnesota Health Records Act 144.291-.298 (all listed licensees; oral info included) | No (estheticians, ch. 155A, are not MHRA providers) | MCDPA (325M.10-.21), eff. 2025-07-31: DATA-level exemptions; 100k / 25k+25%; SBA small businesses excluded except sale of sensitive data | 325E.61: medical info NOT covered; most expedient time; AG enforces | MHRA 144.293 (signed consent; no review exception) + 147.091 subd.1(m); Olson/Schulz 2016 (secondary) | MHRA consent for release (oral or recorded health info); HIPAA if covered; MCDPA consent for sensitive data if in scope | None statutory located (common-law appropriation; Lake v. Wal-Mart (1998) not read) | Yes: MHRA 144.298 subd. 2 (compensatory damages + fees, negligent or intentional); none under MCDPA | Board of Medical Practice, Board of Dentistry, Board of Nursing, Board of Cosmetologist Examiners, AG | MCDPA up to $7,500/violation; license discipline | E2 (MN BMP Olson/Schulz 2016: privileged documents posted on public website; reprimands; order copies on an unofficial host) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Yath v. Fairview Clinics, N.P.
Minnesota Court of Appeals · MN · 2009
- Provider type
- Clinic and employees
- Relevant facts
- Clinic employee accessed a patient's record; information about the patient appeared on a public MySpace page
- Legal issues
- Publication of private facts (publicity element); MHRA claims
- Holding, findings, allegations or settlement terms
- Judicial holding: posting on a publicly accessible web page is publicity; claim failed for lack of proof against remaining defendants
- Consequences recorded
- None against remaining defendants
- Procedural status
- Final (per summaries)
- Precedential?
- Yes (intermediate appellate)
- Why it is in this research
- Online posting of patient information satisfies publicity for privacy tort
Minnesota Board of Medical Practice: Stephen C. Olson, M.D.; S. Charles Schulz, M.D.
Minnesota Board of Medical Practice · MN (state licensing) · 2016-05-14
- Provider type
- Physicians (psychiatry; academic)
- Relevant facts
- Authorized posting a patient's privileged documents on a public university website without appropriate authorization (per search extract)
- Legal issues
- Minn. Stat. 147.091 subd. 1(m)
- Holding, findings, allegations or settlement terms
- Stipulated findings (per search extract)
- Consequences recorded
- Reprimands
- Procedural status
- Final (per search extract)
- Precedential?
- No
- Why it is in this research
- Board discipline for publishing patient information online in defense of an institution (characterization per media; inference)
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
MN-003. Minn. Stat. 325M.10; 325M.12 subds. 1-2; 325M.17
Minnesota Consumer Data Privacy Act is effective July 31, 2025 (postsecondary institutions July 31, 2029). It applies at 100,000 consumers, or 25,000 with over 25% of revenue from selling personal data. Exemptions are DATA-level: HIPAA PHI, MHRA health records, information intermingled with them held by a HIPAA covered entity/business associate or an MHRA 'provider', and information a HIPAA-defined health care provider maintains in the HIPAA manner. SBA-defined small businesses are excluded except that they may not sell sensitive data without prior consent.
Statute · Explicit · High · Effective date VERIFIED in the official revisor note. No entity-level HIPAA exemption, but most practice health data is exempt at the data level; marketing and website data of a non-HIPAA med spa can be in scope above the thresholds (inference).
MN-004. Minn. Stat. 325M.11(v); 325M.20(a)-(d)
MCDPA: sensitive data includes personal data revealing a mental or physical health condition or diagnosis and biometric data processed to uniquely identify a person; a controller may not process sensitive data without consent. The AG enforces; the 30-day cure warning-letter requirement expired January 31, 2026; civil penalty up to $7,500 per violation plus injunction; no private right of action.
Statute · Explicit · High · Maximum, not typical. Cure period has lapsed.
MN-006. Minn. Stat. 325E.61 subd. 1(e), subd. 6
General breach law: 'personal information' = name plus SSN, driver's license/state ID, or financial account number with code; medical information is NOT covered. Notice in the most expedient time possible and without unreasonable delay; AG enforces under 8.31.
Statute · Explicit · High · HIPAA breach rules still apply to covered practices.
MN-001. Minn. Stat. 144.291 subd. 2(c), (i); 144.293 subd. 2
Minnesota Health Records Act: a provider, or a person who receives health records from a provider, may not release a patient's health records without a signed and dated patient consent, specific authorization in Minnesota law, or a provider's representation that it holds such consent. 'Health record' means any information, oral or recorded in any form, relating to the patient's health, care or payment; 'provider' covers persons regulated under chapters 147 (physicians), 147A (PAs), 148 (nurses and others), 150A (dentistry) and others, plus licensed facilities.
Statute · Explicit · High · Applies regardless of HIPAA status to listed licensees. Estheticians (ch. 155A) are not listed (inference: not covered). No reputation or review-response exception located in subd. 5.
MN-005. Minn. Stat. 147.091 subd. 1(e), (h), (i), (m), (o); 150A.08 subd. 1(13)
Board of Medical Practice grounds include 'revealing a privileged communication from or relating to a patient except when otherwise required or permitted by law', improper management of medical records including MHRA compliance, false or misleading advertising, and failure to supervise; delegation to a qualified person within delegated authority is not aiding unlicensed practice. Dentistry grounds include violating 144.291-144.298.
Statute · Explicit · High · Board stipulations applying (m) to a public website posting located only via a mirror (MN-008).
MN-002. Minn. Stat. 144.298 subds. 1-2
MHRA remedies: a violation may be grounds for licensing discipline; a person who negligently or intentionally requests or releases a health record in violation of 144.291-144.297 is liable to the patient for compensatory damages caused by the unauthorized release, plus costs and reasonable attorney fees.
Statute · Explicit · High · Verified private right of action, including for negligent release. Damages must be caused by the release; no statutory minimum.
MN-007. Yath v. Fairview Clinics, N.P., 767 N.W.2d 34 (Minn. Ct. App. 2009)
Court of Appeals: posting private medical information on a publicly accessible MySpace page satisfies the publicity element of publication of private facts, regardless of how many people viewed it.
Judicial decision · Holding per opinion summaries (full text not read) · Medium · The claim failed against the remaining defendants for lack of proof they posted it. Supports tort exposure for online disclosures (application inferred).
https://law.justia.com/cases/minnesota/court-of-appeals/2009/opa081556-0623.html
MN-008. In re Stephen C. Olson, M.D.; In re S. Charles Schulz, M.D.
Minnesota Board of Medical Practice stipulations and orders (2016-05-14) reprimanded two psychiatrists who authorized posting a patient's privileged documents on a public university website, under 147.091 subd. 1(m).
Enforcement (licensing; stipulation and order) · Per search extract of third-party mirror (order not read; fetch timed out) · Medium-Low · Secondary. Not cosmetic. Official Board copy not retrieved (U-66). [Audit D 2026-10-22: order copies hosted on an unofficial website (circare.org); official copy not retrieved]
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All