Is an insurer, in Minnesota

Minn. Stat. § 72A.502, subd. 7 · Read the law's page

• If you are an insurer, insurance agent or insurance-support organization and you disclose personal or privileged information without a written authorization to conduct actuarial or research studies, make sure that no individual may be identified in the actuarial or research report (Minn. Stat. 72A.502, subd. 7(1)).
• Make sure that materials allowing an individual to be identified are returned or destroyed as soon as they are no longer needed (Minn. Stat. 72A.502, subd. 7(2)).
• Make sure that the actuarial or research organization agrees not to disclose the information unless Minn. Stat. 72A.502 would otherwise permit the disclosure if you made it (Minn. Stat. 72A.502, subd. 7(3)).

Minn. Stat. §§ 72A.49 to 72A.505 · Read the law's page

• If you are an insurer or insurance agent, give each applicant and policyholder a written notice of your information practices when the application is made, or at delivery of the policy or certificate where personal information is collected only from the applicant or from public records; a group policy that is not individually underwritten needs no notice, and you may give an abbreviated notice that says the full notice will be furnished on request.
• Do not obtain information in connection with an insurance transaction by pretending to be someone else, pretending to represent a person, misrepresenting the true purpose of the interview, or refusing to provide identification on request.
• Specify any questions you ask solely for marketing or research purposes and state that answers are not required to obtain coverage.
• Do not prepare or request an investigative consumer report for an application, renewal, reinstatement or change in benefits unless you tell the person that they may ask to be interviewed and may receive a copy of the report on request.
• On a written request after proper identification, tell the individual within 30 business days the nature and substance of the personal information you hold, let them see and copy it, and disclose the identity of those to whom you disclosed it within the previous two years; a privileged-information claim, or information collected in anticipation of a claim or proceeding, is outside this right.
• Within 30 business days of a written request to correct, amend or delete personal information, either do so or tell the individual in writing that you refuse, why, and that they may file a concise statement of disagreement and appeal to the commissioner of commerce.
• After an adverse underwriting decision, give the applicant, policyholder or individual proposed for coverage the specific reasons in writing together with a summary of their access and correction rights, and, on request, the specific items of personal and privileged information that support the reasons and their sources, unless you reasonably suspect criminal activity, fraud, material misrepresentation or material nondisclosure.
• Do not seek information about a previous adverse underwriting decision, or a previous residual market placement, unless the inquiry also asks for the reasons, and do not base an adverse underwriting decision on the fact of an earlier one.
• Use a disclosure authorization that is in plain language, dated, and specifies the types of persons authorized to disclose, the nature of the information, the insurer or agent, the purposes of collection and how long it remains valid.
• Do not disclose personal or privileged information about a person collected or received in connection with an insurance transaction without the person's authorization unless section 72A.502 allows it, and do not collect personal information about a policyholder or applicant that does not relate to a claim from sources other than public records without an authorization.
• Notify the person in writing within ten days when you disclose personal or privileged information that required their written authorization, naming the recipient and the nature and substance of the information.

Minn. Stat. § 72A.139 · Read the law's page

• If you are a health plan company, do not require or request that an individual or a blood relative take a genetic test, do not inquire whether one has taken or refused a test or what the results were, and do not take into consideration the fact or the results of a genetic test, in determining eligibility, establishing premiums, limiting or renewing coverage or any other underwriting decision in connection with a health plan.
• If you are a life insurance company or fraternal benefit society that requires a genetic test to determine insurability, obtain the individual's written informed consent for the test, using a disclosure form the commissioner has approved, and state in it whether you will pay for a genetic counselor.
• If you are a life insurance company or fraternal benefit society that requires a genetic test, notify the individual of the result by notifying the individual or the individual's designated physician, and urge the individual to contact a genetic counselor or other health care professional where no physician has been authorized to receive the result.
• If you are a life insurance company or fraternal benefit society, do not require an individual to submit to a genetic test unless you pay its cost.

Minn. Stat. § 62U.04, subd. 4(a)(1) · Read the law's page

• If you are a health plan company, dental organization or third-party administrator, submit encounter data on a monthly basis to the private entity the commissioner of health designates, in the form and manner the commissioner specifies, and submit it only as de-identified data as described under 45 CFR 164.514 (Minn. Stat. 62U.04, subd. 4(a)(1)).

Minn. Stat. section 60A.9853 (Minnesota Insurance Data Security Act) · Read the law's page

• This binds a licensee of the Minnesota Department of Commerce or Department of Health under the insurance chapters; declare is_insurer if your organization is one. A licensee subject to and in compliance with HIPAA is treated as compliant with subdivisions 3 to 5 if it files a written statement certifying that compliance.
• Notify the commissioner of commerce or commissioner of health, whichever regulates you, without unreasonable delay and no later than five business days after you determine that a cybersecurity event has occurred, when Minnesota is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming a Minnesota consumer or part of your normal operations, or when you reasonably believe the nonpublic information of 250 or more Minnesota consumers is involved and notice is owed to a government or supervisory body or the event has a reasonable likelihood of that harm (60A.9853, subd. 1).
• Give the commissioner, in electronic form and as completely as you can, the information subdivision 2 lists, and keep updating the notice as material facts change (60A.9853, subd. 2).
• If you are an assuming insurer, notify your affected ceding insurers and the commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred (60A.9853, subd. 5).
• Treat a cybersecurity event in a system a third-party service provider maintains as your own event unless the provider gives the notice, counting your deadlines from the day after the provider notifies you or you otherwise know of it (60A.9853, subd. 4).

Minn. Stat. sections 60A.985, 60A.9851, 60A.9852 (Minnesota Insurance Data Security Act) · Read the law's page

• This binds a licensee of the Minnesota Department of Commerce or Department of Health under the insurance chapters; declare is_insurer if your organization is one. A licensee with fewer than 25 employees is exempt, and a licensee subject to and in compliance with HIPAA is treated as compliant if it files a written statement certifying that compliance.
• Develop, implement, and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical, and physical safeguards for nonpublic information and your information system, sized to your operations, your use of third-party service providers and the sensitivity of the information (60A.9851, subd. 1 to 4).
• Designate who is responsible for the program, assess reasonably foreseeable threats and the sufficiency of your safeguards, and test the effectiveness of key controls at least annually (60A.9851, subd. 3).
• Have your board or an appropriate committee require management to develop, implement and maintain the program and to report to it in writing at least annually on the program's status and material matters (60A.9851, subd. 5).
• Require each third-party service provider to implement appropriate administrative, technical, and physical measures to protect the systems and nonpublic information it can access or holds (60A.9851, subd. 6).
• Establish a written incident response plan that covers the areas the subdivision lists (60A.9851, subd. 8).
• If you are an insurer domiciled in Minnesota, certify your compliance in writing to the commissioner by April 15 of each year and keep the supporting records for five years (60A.9851, subd. 9).
• When you learn that a cybersecurity event has or may have occurred, investigate it promptly, and keep records of every cybersecurity event for at least five years, producing them on the commissioner's demand (60A.9852).

Minn. Stat. § 60A.9852, subd. 4 · Read the law's page

• If you are a licensee of the Department of Commerce or the Department of Health, maintain records concerning all cybersecurity events for at least five years from the date of the cybersecurity event, and produce those records upon demand of the commissioner (section 60A.9852, subdivision 4).

Minn. Stat. § 60A.9853 · Read the law's page

• If you are a licensee of the Department of Commerce or the Department of Health, notify the commissioner who regulates you without unreasonable delay and no later than five business days from a determination that a cybersecurity event has occurred, when this state is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming a Minnesota consumer or part of your normal operations, or when you reasonably believe the nonpublic information involved is of 250 or more Minnesota consumers and the event must be reported to another government or supervisory body or has a reasonable likelihood of that harm.
• Give the commissioner, in electronic form and as completely as possible, the information section 60A.9853, subdivision 2 lists (date of the event, how it happened and was discovered, the types of information acquired, the number of Minnesota consumers affected, the remediation under way and a contact person), and update and supplement the notice as material changes occur.
• If you are required to report to the commissioner, notify each Minnesota consumer whose nonpublic information was or is reasonably believed to have been acquired by an unauthorized person where there is a reasonable likelihood of material harm, in the most expedient time possible and without unreasonable delay, and send the commissioner a copy of the notice.
• Treat a cybersecurity event in a system maintained by a third-party service provider, of which you have become aware, as you would under subdivision 1 unless the provider gives the notice, counting your deadlines from the day after the provider notifies you or you otherwise have actual knowledge.
• If you are an assuming insurer with no direct contractual relationship with the affected consumers, notify your affected ceding insurers and the commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred.

Minn. Stat. § 60A.9855, subd. 4 · Read the law's page

• If you are a licensee of the Department of Commerce or the Department of Health, retain and preserve for five years each document, material or information disclosed to the commissioner about a cybersecurity event (section 60A.9855, subdivision 4).

Minn. Stat. § 62M.09, subd. 3(f) (2026 Minn. Laws ch. 124, art. 3, § 6) · Read the law's page

• If you are a utilization review organization, do not use automated processing alone, without a clinician review by an appropriate health professional, to make an adverse determination on a health care service, admission, or extension of stay.when it serves a financial business