Minn. Stat. § 72A.502
An insurer, insurance agent, or insurance-support organization must not disclose any personal or privileged information about a person collected or received in connection with an insurance transaction without the authorization of that person except as authorized by this section. An insurer, insurance agent, or insurance-support organization must not collect personal information about a policyholder or an applicant not relating to a claim from sources other than public records without an authorization from the person. The authorization to collect personal information must be in writing or in the same medium as the application for insurance.
Personal or privileged information may be disclosed without a written authorization to another person if the information is limited to that which is reasonably necessary to detect or prevent criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with an insurance transaction, and that person agrees not to disclose the information further without the individual written authorization unless the further disclosure is otherwise permitted by this section if made by an insurer, insurance agent, or insurance-support organization. Any insurer, insurance agent, or insurance-support organization making such a disclosure is immune from liability under section 60A.952, subdivision 3.
Personal or privileged information may be disclosed without a written authorization to a health care institution or health professional for the purpose of verifying insurance coverage benefits, informing a person of a health problem of which the person must not be aware, or conducting an operations or services audit, if the information is only disclosed that is reasonably necessary to accomplish the purposes under this subdivision.
Personal or privileged information may be disclosed without a written authorization to an insurance regulatory authority.
Personal or privileged information may be disclosed without a written authorization to a law enforcement or other governmental authority if:
Personal or privileged information may be disclosed without a written authorization if permitted or required by another law or in response to a facially valid administrative or judicial order, including a search warrant or subpoena.
Personal or privileged information may be disclosed without a written authorization to conduct actuarial or research studies if:
Personal or privileged information may be disclosed without a written authorization to an affiliate whose only use of the information will be in connection with an audit of the insurer or agent or the marketing of an insurance product or service, provided the affiliate agrees to not disclose the information for any other purpose or to unaffiliated persons.
Personal or privileged information may be disclosed without written authorization to a group policyholder only to report claims experience or conduct an audit of the insurer's or agent's operations or services, if the information disclosed is reasonably necessary for the group policyholder to conduct the review or audit.
Personal or privileged information may be disclosed without a written authorization to a governmental professional licensing or regulatory board to review the service or conduct of a health care institution or health professional that the insurer has reason to believe has violated its licensing act or engaged in the unlawful practice of a licensed professional.
Subject to the terms of a contract between an insurer and a health professional or health care institution, personal or privileged information may be disclosed without a written authorization to a professional peer review organization to review the service or conduct of a health care institution or health professional.
Personal or privileged information may be disclosed to a party or representative of a party to a proposed or consummated sale, transfer, merger, or consolidation of all or part of the business of the insurer, agent, or insurance-support organization, without a written authorization provided:
Whenever an insurer, insurance agent, or insurance-support organization discloses personal or privileged information about a person that requires the written authorization of that person under this section, the insurer, insurance agent, or insurance-support organization shall notify that person in writing within ten days of the date the information was disclosed. The notification must specify the identity of the person to whom information was disclosed and the nature and substance of the information that was disclosed. A notice is not required to be given under this subdivision if an insurer is disclosing personal information for underwriting purposes to another insurer, or to an insurance-support organization if the person had signed an authorization authorizing the disclosure.
Minn. Stat. § 72A.502
1989 c 316 s 14; 1990 c 467 s 3, 4; 2011 c 52 s 6; 2014 c 310 s 9