Subdivision 1.Methods of release.

(a) Notwithstanding section 144.293, subdivisions 2 and 4, health records may be released to an external researcher solely for purposes of medical or scientific research only as follows:

(1) health records generated before January 1, 1997, may be released if the patient has not objected or does not elect to object after that date;

(2) for health records generated on or after January 1, 1997, the provider must:

(i) disclose in writing to patients currently being treated by the provider that health records, regardless of when generated, may be released and that the patient may object, in which case the records will not be released; and

(ii) use reasonable efforts to obtain the patient’s written general authorization that describes the release of records in item (i), which does not expire but may be revoked or limited in writing at any time by the patient or the patient’s authorized representative;

(3) the provider must advise the patient of the rights specified in clause (4); and

(4) the provider must, at the request of the patient, provide information on how the patient may contact an external researcher to whom the health record was released and the date it was released.

(b) Authorization may be established if an authorization is mailed at least two times to the patient’s last known address with a postage prepaid return envelope and a conspicuous notice that the patient’s medical records may be released if the patient does not object, and at least 60 days have expired since the second notice was sent.

Subd. 2.Duties of researcher.

In making a release for research purposes, the provider shall make a reasonable effort to determine that:

(1) the use or disclosure does not violate any limitations under which the record was collected;

(2) the use or disclosure in individually identifiable form is necessary to accomplish the research or statistical purpose for which the use or disclosure is to be made;

(3) the recipient has established and maintains adequate safeguards to protect the records from unauthorized disclosure, including a procedure for removal or destruction of information that identifies the patient; and

(4) further use or release of the records in individually identifiable form to a person other than the patient without the patient’s consent is prohibited.