Background
Justin Holtzbauer was injured while working as a tree trimmer on November 26, 2022, and later sought treatment for worsening chest pain at Mercy Hospital, part of Allina Health System. Upon admission, he opted out of the hospital’s facility directory. Allina therefore omitted him from the directory and marked his file as a “confidential encounter.”
Holtzbauer told his former spouse, H.H., by text message that he was injured and hospitalized, but did not immediately answer her request for his location. H.H. called several hospitals, supplying his name and birth date. Mercy denied that he was a patient, as did other hospitals. When she called United Hospital, another Allina facility, an Allina employee told her that Holtzbauer was at Mercy and disclosed his room number. Allina later confirmed in a January 4, 2023 letter that an employee had disclosed his patient status, facility location, and room number, and that the information should not have been disclosed because he had opted out of the directory.
Holtzbauer sued Allina in April 2023 for compensatory damages under the Minnesota Health Records Act. The parties stipulated that he had opted out, that his admission and room number were confidential, that an employee disclosed them, that the disclosure violated Allina’s privacy policy, and that Allina would be vicariously liable if Holtzbauer proved breach and causation. The district court nevertheless granted Allina summary judgment, concluding that the information was not a health record. A divided court of appeals reversed, and the supreme court granted Allina’s petition for further review.
The Court’s Holding
Reviewing the statutory question de novo, the supreme court affirmed. It held that information identifying a person as a hospital patient in a particular room is a “health record” under Minnesota Statutes section 144.291, subdivision 2(c), because it is “any information … that relates to … the provision of health care to a patient.” The court emphasized the breadth of “any information” and “relates to,” explaining that admission and room assignments have a connection, association, or logical relationship to providing health care. Such information may reveal treatment, diagnosis, severity, or urgency; a patient is not admitted and assigned a room unless receiving health care.
The court rejected Allina’s proposed limitation of health records to “clinical information.” It reasoned that the separately defined “identifying information” is a subset of health-record information, not a mutually exclusive category. Section 144.293, subdivision 8, permits identifying information to be released to record locator and patient information services unless a patient opts out—an exception that would be unnecessary if that information were not otherwise protected. The court also found support in section 144.294, subdivision 3, which includes “admission to or discharge from treatment” among health-record information, and in HIPAA’s facility-directory rules, which similarly treat location information as private while allowing an opt-out.
Because Holtzbauer’s reading was the only reasonable interpretation, the court held that Allina violated the Act by disclosing his admission and room number. It affirmed and remanded for further proceedings. The ruling did not resolve causation or damages: Holtzbauer still must prove injury caused by the disclosure and the amount of any damages.
Key Takeaways
- Hospital admission status and room number fall within Minnesota’s statutory definition of a health record.
- “Identifying information” is a protected subset of health-record information, not a separate unprotected category.
- The Act is not limited to clinical information; its use of “any information” and “relates to” supports broad coverage.
- The decision establishes a disclosure violation but leaves causation and damages for determination on remand.
Why It Matters
The decision gives Minnesota patients a statutory damages remedy for unauthorized disclosure of admission and location information, even though HIPAA itself supplies no private cause of action. It also rejects the argument that a general hospital’s broad range of services removes patient-status information from statutory protection.
The court acknowledged potential effects on hospitals, families, chaplains, and law enforcement, but said the Legislature—not the court—must weigh any additional exceptions. Providers therefore must apply the Act’s consent requirements and existing exceptions rather than assume that directory-style information is freely disclosable.