1.1 	A bill for an act
1.2 	relating to human services; requiring a license holder to destroy personal 
1.3 	information upon closure; providing remedies;proposing coding for new law in 
1.4 	Minnesota Statutes, chapter 245A.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. [245A.0415] TREATMENT OF PERSONAL INFORMATION UPON 
1.7 	CLOSURE.
1.8 		Subdivision 1.Application. This section applies to a license holder operating a residential 
1.9 	program.
1.10 		Subd. 2.Definition; personal information. (a) For purposes of this section, "personal 
1.11 	information" means the following information about a person receiving services in a 
1.12 	residential program: a person's first name or first initial and last name combined with:
1.13 	(1) a nontruncated Social Security number or tax identification number;
1.14 	(2) a nontruncated driver's license number, state-issued identification card number, 
1.15 	passport number, military identification number, or other unique identification number 
1.16 	issued on a government document used to verify the identity of a specific individual;
1.17 	(3) a financial account number, including a bank account number, credit card number, 
1.18 	or debit card number, in combination with any security code, access code, password, 
1.19 	expiration date, or personal identification number, that is necessary to access the financial 
1.20 	account or to conduct a transaction that will credit or debit the financial account;
1.21 	(4) any information regarding an individual's medical history, mental or physical 
1.22 	condition, or medical treatment or diagnosis by a health care professional;
2.1 	(5) an individual's health insurance policy number, subscriber identification number, or 
2.2 	any unique identifier used by a health insurer to identify the individual; or
2.3 	(6) a username or e-mail address, in combination with a password or security question 
2.4 	and answer that would permit access to an online account.
2.5 	(b) Personal information does not include information that is encrypted or modified by 
2.6 	any other method or technology that removes elements that identify an individual or that 
2.7 	otherwise renders the information unusable, including encryption of the data, document, or 
2.8 	device containing the personal information, unless the license holder knows or has reason 
2.9 	to know that the encryption key or security credential that could render the personal 
2.10 	information readable or useable has been breached with the personal information.
2.11 		Subd. 3.Duty to destroy. A license holder who ceases to provide services under this 
2.12 	chapter, or the responsible third party under section 245A.041, subdivision 3, paragraph 
2.13 	(b), must destroy all personal information within the license holder's or third party's custody 
2.14 	or control when retention of the information is no longer required by section 245A.041. A 
2.15 	license holder or the responsible third party must destroy personal information in a manner 
2.16 	that renders the information unreadable or undecipherable by any reasonable means consistent 
2.17 	with industry standards. A license holder or the responsible third party must submit a 
2.18 	certificate of destruction to the commissioner, providing a detailed description of compliance 
2.19 	with this section.
2.20 		Subd. 4.Enforcement. (a) A person aggrieved by a violation of this section may bring 
2.21 	an action against a license holder or a responsible third party under section 13.08.
2.22 	(b) The commissioner retains enforcement and oversight jurisdiction over a license 
2.23 	holder who ceases to provide services for purposes of enforcing this section. The 
2.24 	commissioner may seek penalties against a license holder or a responsible third party for a 
2.25 	violation of this section pursuant to any enforcement powers conferred upon the 
2.26 	commissioner.
2.27 		Subd. 5.Exemption. This section does not apply if the license holder transfers ownership 
2.28 	of all or part of a residential program.

2.29 	EFFECTIVE DATE. This section is effective August 1, 2020, and applies to license 
2.30 	holders who cease to provide services on or after that date.