Subd. 1. Personal and privileged information.

The ability of a health maintenance organization to disclose personal information, as defined in section 72A.491, subdivision 17, and privileged information, as defined in section 72A.491, subdivision 19, is governed by sections 72A.497, 72A.499, and 72A.502.

Subd. 2. Health data or information.

1. (a) A health maintenance organization is prohibited from disclosing to any person any individually identifiable data or information held by the health maintenance organization pertaining to the diagnosis, treatment, or health of any enrollee, or any application obtained from any person, except:

   1. (1) to the extent necessary to carry out the purposes of this chapter, the commissioner and a designee shall have access to the above data or information but the data removed from the health maintenance organization or participating entity shall not identify any particular patient or client by name or contain any other unique personal identifier;
   2. (2) upon the express consent of the enrollee or applicant;
   3. (3) pursuant to statute or court order for the production of evidence or the discovery thereof;
   4. (4) in the event of claim or litigation between the person and the provider or health maintenance organization wherein such data or information is pertinent;
   5. (5) to meet the requirements of contracts for prepaid medical services with the commissioner of human services authorized under chapter 256B, 256D, or 256L;
   6. (6) to meet the requirements of contracts for benefit plans with the commissioner of management and budget under chapter 43A; or

   7. (7) as otherwise authorized pursuant to statute.

      No provision in a contract for a benefit plan under chapter 43A shall authorize dissemination of individually identifiable health records, unless the dissemination of the health records is required to carry out the requirements of the contract and employees whose health records will be disseminated are fully informed of the dissemination by the Department of Management and Budget at the time the employees are enrolling for or changing insurance coverage.

2. (b) In any case involving a suspected violation of a law applicable to health maintenance organizations in which access to health data maintained by the health maintenance organization or participating entity is necessary, the commissioner and agents, while maintaining the privacy rights of individuals and families, shall be permitted to obtain data that identifies any particular patient or client by name. A health maintenance organization shall be entitled to claim any statutory privileges against such disclosure which the provider who furnished the information to the health maintenance organization is entitled to claim.