Minnesota AI Laws for Healthcare: The 2026 Prior Authorization Ban, the MCDPA and the Health Records Act

Not a general one. As of September 2026 Minnesota has no statute like Colorado's AI Act or Texas TRAIGA, no disclosure duty when a patient talks to an AI, and no medical board rule naming AI. Bills that would have regulated chatbots (HF 4452) and AI in psychotherapy (HF 3893) were introduced in 2026 and did not pass.

What Minnesota does have is one narrow AI enactment and three older laws that reach AI deployments harder than most states' new AI statutes do.

• Laws 2026 chapter 124, article 3, section 6 amends section 62M.09 subdivision 3 so that a payer's adverse prior authorization determination cannot be made by artificial intelligence. It applies to plans from January 1, 2027.
• The Minnesota Health Records Act, sections 144.291 to 144.298, requires a signed and dated patient consent for most releases of health records. Minnesota has no general treatment, payment and operations exception of the kind HIPAA has, so a vendor relationship that is routine under a business associate agreement can still need consent here.
• The Consumer Data Privacy Act, chapter 325O, in force since July 31, 2025, exempts PHI and health records but not the covered entity itself, and gives consumers a right to opt out of profiling and to question a profiling result.
• Section 626A.02 is a one party consent rule for recording, which makes ambient scribes and AI phone agents lawful to record on the clinic's own consent, subject to the Health Records Act and professional standards for what happens to the recording afterwards.

The practical consequence is that a Minnesota clinic's AI compliance question is rarely "is AI allowed" and almost always "did we have consent for this data flow, and can we show it". That is a records and contracting problem, which is why it belongs in the same review as the HIPAA analysis rather than in a separate AI policy.

It closes a gap in a rule Minnesota already had. Section 62M.09 subdivision 3 has long required that a physician holding a current unrestricted Minnesota licence, in the same or similar specialty as a provider who typically treats the condition, review and make any adverse determination for clinical reasons. Mental health and substance use determinations must be made by a psychiatrist or doctoral level psychologist. Health plans told the House Commerce committee in February 2026 that their members already met this rule.

The amendment enacted in Laws 2026 chapter 124 adds that the determination may not be made using artificial intelligence, defined by reference to 15 U.S.C. 9401, and that the physician must be the one who makes the call. As described by the author, Representative Falconer, and in the House DFL floor summary of May 16, 2026, insurers may still use AI to approve requests and to process claims. Only the denial has to be human. The provision applies to health plans offered, sold, issued or renewed on or after January 1, 2027, so a calendar year plan renewing in January 2027 is the first covered.

The exact enrolled text of article 3 section 6, including the attestation language reported in legislative summaries, should be read from the session law on revisor.mn.gov before it is relied on in a contract or appeal. We confirmed the amendment and its citation from the revisor's history note on section 62M.09; we did not obtain the full enrolled article text at the time of writing.

Three things follow for providers.

• Your appeals letters change. From 2027 a denial letter that shows no evidence of physician review is challengeable on its face. Build a standard request for the reviewing physician's name, specialty and licence number into every appeal.
• Your own AI is unaffected. The rule binds utilization review organisations. A provider using prior authorization automation to assemble and submit requests is outside it, though the federal CMS interoperability and prior authorization rule governs the API you will use to do so.
• Minnesota is narrower than California. California's SB 1120 regulates any AI used in medical necessity review. Minnesota touches only the adverse determination itself.

Through consent. Section 144.293 subdivision 2 says a provider or person who receives health records from a provider may not release them without a signed and dated consent from the patient or the patient's legally authorised representative, unless a specific Minnesota law authorises the release or another provider represents that it holds such a consent. A consent is valid for one year unless it says otherwise (subdivision 4). The statutory exceptions are narrow: emergencies, transfers within a related health care entity for current treatment, and a short list in subdivision 6 where consent does not expire, covering consultations on current treatment, insurance payment and fraud review, and welfare programme coordination.

HIPAA permits a covered entity to disclose PHI to a business associate for treatment, payment or health care operations without patient authorisation. Minnesota does not have an equivalent general exception. That difference has been the subject of debate and litigation for years, and the safe reading is that a disclosure to an AI scribe, an AI phone agent or an analytics vendor is a release requiring consent unless it fits an exception, such as the vendor acting as the provider's own agent within the provider's own record system.

What this means in practice:

• Most Minnesota systems use a general consent signed at registration that covers release to contracted vendors for treatment and operations. Check that yours names those categories, is dated within the year, and is refreshed annually.
• A vendor that uses recordings or notes to train models is doing something outside "on behalf of the provider". That needs a specific consent, and a patient can refuse it. Ask the vendor to confirm in writing that Minnesota patient data is excluded from training by default.
• Section 144.298 gives the patient a private right of action for negligent or intentional release, with fees. Minnesota is one of the few states where a scribe vendor's data handling can produce a patient lawsuit directly against the clinic.

The record locator service provisions in subdivision 8 allow limited identifying information to be shared without consent unless the patient has opted out, which is relevant to exchange, not to AI processing.

Less than it first appears for clinical data, and more than most clinics expect for everything else.

Chapter 325O applies to a controller that conducts business in Minnesota or targets Minnesota residents and either processes personal data of 100,000 or more consumers in a calendar year, or processes data of 25,000 or more consumers and derives more than 25 percent of gross revenue from selling personal data. Small businesses under the SBA definition are out. Unlike Virginia and Texas, Minnesota does not exempt HIPAA covered entities or business associates as entities. It excludes the data instead: protected health information under HIPAA, health records under sections 144.291 to 144.298, Part 2 substance use records and de identified data are all outside the act.

A health system with 100,000 or more Minnesota consumers therefore has a two column inventory. PHI sits under HIPAA and the Health Records Act. Everything else, including website and app analytics, marketing lists, event sign ups, job applicants who are not employees, and any consumer facing AI tool that collects data before a treatment relationship exists, sits under chapter 325O.

Three obligations bite on AI programmes specifically.

• Profiling. Consumers may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, and Minnesota alone gives them a right to question the result of such profiling, to be told the reason, and where feasible to learn what they could change. A patient acquisition or financial assistance model that scores individuals could be caught.
• Sensitive data. Health condition and diagnosis data collected outside HIPAA, for instance by a symptom checker or a marketing quiz on a public website, requires opt in consent.
• Data inventory and documentation. Controllers must maintain a data inventory and document their compliance policies. This is unusual among state privacy laws and it overlaps almost completely with the system inventory that an AI governance programme needs anyway.

Enforcement sits with the Attorney General, with civil penalties of up to 7,500 dollars per violation. The 30 day cure right ended on January 31, 2026. For the MCDPA in context with the other state consumer privacy laws, see our state AI laws map.

Not for the recording itself, if the clinic is a party to the conversation. Section 626A.02 subdivision 2(d) makes it lawful for a person to intercept a wire, electronic or oral communication where that person is a party to it or one party has given prior consent, unless the purpose is a criminal or tortious act. Minnesota is a one party consent state, and a clinic recording its own calls or visits satisfies the rule on its own consent. Calls with patients in all party consent states are a different matter; an AI phone agent serving patients across the border in a two party state should announce recording regardless.

Recording lawfully is not the end of the analysis. Three other rules decide what you must say and keep.

• The Health Records Act governs what happens to the transcript and audio once they exist. If they go to a vendor, the consent question in the previous section applies.
• Section 147.033 holds a physician delivering care through telehealth to the same standards of practice and conduct as in person care, and allows a physician patient relationship to be established by telehealth. The statute imposes no separate telehealth consent form, but it means an AI tool used in a video visit is judged by ordinary standard of care and documentation rules.
• The Board of Medical Practice had published no AI specific policy or statement as of September 2026, as checked on its website. The board's disciplinary grounds in section 147.091, including unprofessional conduct and inadequate records, are what an AI documentation error would be charged under. The Federation of State Medical Boards' April 2024 guidance, which most state boards including Minnesota's participate in, expects the physician to remain responsible for AI generated content and to be transparent with patients about its use.

The defensible pattern is the same one we recommend in every state: tell the patient at the start of the encounter that an AI tool is documenting or handling the call, give them a way to decline, and have the clinician review and sign before anything enters the record. A one line script and an attestation gate cost nothing and remove most of the exposure. Our AI policy template includes both.

The AI amendment lands on top of eight reforms to section 62M.07 that took effect on January 1, 2026 for plans issued or renewed from that date. Together they change what a Minnesota clinic's authorization team should be automating.

Section 62M.05 still sets the general timelines: a standard determination within five business days of the request, expedited within 48 hours including at least one business day. A provider side automation platform should be configured to those clocks and to the exclusion list, otherwise it will keep generating requests the payer is no longer allowed to require.

Three, none of which is law as of September 2026. Status is taken from the legislature's bill records on revisor.mn.gov.

• HF 3893 / SF 4280, AI in psychotherapy services. Sponsored by Representative Peggy Scott. Approved by House Health Finance and Policy on March 23, 2026 and by Judiciary Finance and Civil Law on April 7, 2026, then stalled in Commerce Finance and Policy. It would bar a licensed psychotherapist from using AI to make therapeutic decisions or conduct therapeutic communication, permit AI for transcription and documentation with human review, and require any chatbot used with a client to direct them to a person if they raise mental health symptoms or self harm. Expect it back in 2027; Colorado and Utah already have equivalents.
• HF 4452 / SF 4997, chatbot disclosure and liability. Would create section 604.115 requiring clear notice that a user is interacting with an AI chatbot, bar chatbots from giving advice that requires a chapter 147 or 148E licence, and create a civil cause of action. Referred to House Commerce on March 18, 2026 with no further action.
• SF 1856 / HF 1838, broad prohibition on AI in utilization review. Reported without recommendation by Senate Judiciary on March 18, 2026 and returned to Commerce. Superseded in effect by the narrower provision enacted in chapter 124.

A Minnesota behavioural health practice using AI for anything beyond note taking should build to HF 3893 now. Its rules are cheap to meet and they are the direction of travel in every state that has legislated on the subject. Our healthcare AI law checker tracks the status of each of these bills.

Seven items, ordered by how quickly each removes exposure.

1. Audit your Health Records Act consent. Confirm the registration consent covers release to contracted vendors for treatment and operations, is dated within the past year, and is re signed annually. Add a specific line for any AI vendor that retains audio or text.
2. Get the training exclusion in writing. Every scribe, phone agent and inbox tool contract should state that Minnesota patient data is not used to train or improve models without a separate patient consent. Section 144.298 makes the alternative a lawsuit.
3. Put a one line disclosure at the start of every recorded encounter. Not legally required under section 626A.02, but it satisfies the professional standard, handles out of state callers, and costs nothing.
4. Gate AI generated notes behind clinician signature. The Board of Medical Practice will treat an unreviewed AI note as the physician's own inadequate record.
5. Split your data inventory into PHI and non PHI. If you pass 100,000 Minnesota consumers, chapter 325O applies to the second column now, the cure period has ended, and the act requires the inventory anyway.
6. Rebuild the prior authorization work queue against section 62M.07. Remove the exempt services, stop reauthorizing chronic conditions, and add a standard demand for reviewer identity to every denial appeal ahead of the January 1, 2027 AI rule.
7. Track HF 3893 and HF 4452. If you run a chatbot or use AI in behavioural health, design to them now.

Minnesota is a state where the AI rules are old rules applied to new tools, which is harder to see coming than a new statute with AI in its title. Getting the consent chain, the vendor contracts and the inventory right once, and mapping them against HIPAA, Colorado and Texas so you are not running four programmes, is what our AI governance and compliance engagement does. It starts from a written inventory, which for most clinics is the piece that does not yet exist. Book a call if you want that inventory built before a vendor contract or a patient complaint forces the question.