Access to reporting system data.

(b) Except as specified in subdivision 5, the following persons shall be considered permissible users and may access the data submitted under subdivision 4 in the same or similar manner, and for the same or similar purposes, as those persons who are authorized to access similar private data on individuals under federal and state law:

(1) a prescriber or an agent or employee of the prescriber to whom the prescriber has delegated the task of accessing the data, to the extent the information relates specifically to a current patient, to whom the prescriber is:

(i) prescribing or considering prescribing any controlled substance;

(ii) providing emergency medical treatment for which access to the data may be necessary;

(iii) providing care, and the prescriber has reason to believe, based on clinically valid indications, that the patient is potentially abusing a controlled substance; or

(iv) providing other medical treatment for which access to the data may be necessary for a clinically valid purpose and the patient has consented to access to the submitted data, and with the provision that the prescriber remains responsible for the use or misuse of data accessed by a delegated agent or employee;

(2) a dispenser or an agent or employee of the dispenser to whom the dispenser has delegated the task of accessing the data, to the extent the information relates specifically to a current patient to whom that dispenser is dispensing or considering dispensing any controlled substance and with the provision that the dispenser remains responsible for the use or misuse of data accessed by a delegated agent or employee;

(3) a licensed pharmacist who is providing pharmaceutical care for which access to the data may be necessary to the extent that the information relates specifically to a current patient for whom the pharmacist is providing pharmaceutical care: (i) if the patient has consented to access to the submitted data; or (ii) if the pharmacist is consulted by a prescriber who is requesting data in accordance with clause (1);

(4) an individual who is the recipient of a controlled substance prescription for which data was submitted under subdivision 4, or a guardian of the individual, parent or guardian of a minor, or health care agent of the individual acting under a health care directive under chapter 145C;

(5) personnel or designees of a health-related licensing board listed in section 214.01, subdivision 2 , or of the Emergency Medical Services Regulatory Board, assigned to conduct a bona fide investigation of a complaint received by that board that alleges that a specific licensee is impaired by use of a drug for which data is collected under subdivision 4, has engaged in activity that would constitute a crime as defined in section 152.025 , or has engaged in the behavior specified in subdivision 5, paragraph (a);

(6) personnel of the board engaged in the collection, review, and analysis of controlled substance prescription information as part of the assigned duties and responsibilities under this section;

(7) authorized personnel of a vendor under contract with the state of Minnesota who are engaged in the design, implementation, operation, and maintenance of the prescription monitoring program as part of the assigned duties and responsibilities of their employment, provided that access to data is limited to the minimum amount necessary to carry out such duties and responsibilities, and subject to the requirement of de-identification and time limit on retention of data specified in subdivision 5, paragraphs (d) and (e);

(8) federal, state, and local law enforcement authorities acting pursuant to a valid search warrant;

(9) personnel of the Minnesota health care programs assigned to use the data collected under this section to identify and manage recipients whose usage of controlled substances may warrant restriction to a single primary care provider, a single outpatient pharmacy, and a single hospital;

(10) personnel of the Department of Human Services assigned to access the data pursuant to paragraph (i);

(11) personnel of the health professionals services program established under section 214.31 , to the extent that the information relates specifically to an individual who is currently enrolled in and being monitored by the program, and the individual consents to access to that information. The health professionals services program personnel shall not provide this data to a health-related licensing board or the Emergency Medical Services Regulatory Board, except as permitted under section 214.33, subdivision 3 .

For purposes of clause (4), access by an individual includes persons in the definition of an individual under section 13.02 ; and

(12) personnel or designees of a health-related licensing board listed in section 214.01, subdivision 2 , assigned to conduct a bona fide investigation of a complaint received by that board that alleges that a specific licensee is inappropriately prescribing controlled substances as defined in this section.

(c) By July 1, 2017, every prescriber licensed by a health-related licensing board listed in section 214.01, subdivision 2 , practicing within this state who is authorized to prescribe controlled substances for humans and who holds a current registration issued by the federal Drug Enforcement Administration, and every pharmacist licensed by the board and practicing within the state, shall register and maintain a user account with the prescription monitoring program. Data submitted by a prescriber, pharmacist, or their delegate during the registration application process, other than their name, license number, and license type, is classified as private pursuant to section 13.02, subdivision 12 .

(d) Only permissible users identified in paragraph (b), clauses (1), (2), (3), (6), (7), (9), and (10), may directly access the data electronically. No other permissible users may directly access the data electronically. If the data is directly accessed electronically, the permissible user shall implement and maintain a comprehensive information security program that contains administrative, technical, and physical safeguards that are appropriate to the user's size and complexity, and the sensitivity of the personal information obtained. The permissible user shall identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of personal information that could result in the unauthorized disclosure, misuse, or other compromise of the information and assess the sufficiency of any safeguards in place to control the risks.

(e) The board shall not release data submitted under subdivision 4 unless it is provided with evidence, satisfactory to the board, that the person requesting the information is entitled to receive the data.

(f) The board shall maintain a log of all persons who access the data for a period of at least three years and shall ensure that any permissible user complies with paragraph deleted text begin (c) deleted text end new text begin (d) new text end prior to attaining direct access to the data.

(g) Section 13.05, subdivision 6 , shall apply to any contract the board enters into pursuant to subdivision 2. A vendor shall not use data collected under this section for any purpose not specified in this section.

(h) The board may participate in an interstate prescription monitoring program data exchange system provided that permissible users in other states have access to the data only as allowed under this section, and that section 13.05, subdivision 6 , applies to any contract or memorandum of understanding that the board enters into under this paragraph.

(i) With available appropriations, the commissioner of human services shall establish and implement a system through which the Department of Human Services shall routinely access the data for the purpose of determining whether any client enrolled in an opioid treatment program licensed according to chapter 245A has been prescribed or dispensed a controlled substance in addition to that administered or dispensed by the opioid treatment program. When the commissioner determines there have been multiple prescribers or multiple prescriptions of controlled substances, the commissioner shall:

(1) inform the medical director of the opioid treatment program only that the commissioner determined the existence of multiple prescribers or multiple prescriptions of controlled substances; and

(2) direct the medical director of the opioid treatment program to access the data directly, review the effect of the multiple prescribers or multiple prescriptions, and document the review.

If determined necessary, the commissioner of human services shall seek a federal waiver of, or exception to, any applicable provision of Code of Federal Regulations, title 42, section 2.34, paragraph (c), prior to implementing this paragraph.

(j) The board shall review the data submitted under subdivision 4 on at least a quarterly basis and shall establish criteria, in consultation with the advisory task force, for referring information about a patient to prescribers and dispensers who prescribed or dispensed the prescriptions in question if the criteria are met.

new text begin (k) The board shall conduct random audits, on at least a quarterly basis, of electronic access by permissible users, as identified in paragraph (b), clauses (1), (2), (3), (6), (7), (9), and (10), to the data in subdivision 4, to ensure compliance with permissible use as defined in this section. A permissible user whose account has been selected for a random audit shall respond to an inquiry by the board, no later than 30 days after receipt of notice that an audit is being conducted. Failure to respond may result in deactivation of access to the electronic system and referral to the appropriate health licensing board, or the commissioner of human services, for further action. The board shall report the results of random audits to the chairs and ranking minority members of the legislative committees with jurisdiction over health and human services policy and finance and government data practices. new text end

new text begin (l) A permissible user who has delegated the task of accessing the data in subdivision 4 to an agent or employee shall audit the use of the electronic system by delegated agents or employees on at least a quarterly basis to ensure compliance with permissible use as defined in this section. When a delegated agent or employee has been identified as inappropriately accessing data, the permissible user must immediately remove access for that individual and notify the board within seven days. The board shall notify all permissible users associated with the delegated agent or employee of the alleged violation. new text end

new text begin (m) A permissible user who delegates access to the data submitted under subdivision 4 to an agent or employee shall terminate that individual's access to the data within three business days of the agent or employee leaving employment with the permissible user. The board may conduct random audits to determine compliance with this requirement. new text end