Data Practices

Updated August 2026

This policy describes your rights as a member of the public to request and access public data maintained by the Minnesota State Retirement System (MSRS).

As a state agency, MSRS is governed by the Minnesota Government Data Practices Act (Minnesota Statutes, Chapter 13.). It compels MSRS to maintain this policy and make it easily available to the public.

Data is any information that MSRS collects, creates, receives, maintains, or disseminates in any form. Most of the data on individual MSRS plan participants (active members, benefit recipients, beneficiaries, or deferred, inactive members) is not public. Non-public data is not accessible to members of the public, even upon request. However, certain MSRS data is deemed public and must be provided upon request, according to this policy. This includes:

Public Participant Data

MSRS does not disclose data on individual pension plan participants other than as follows:

1. For requests related to actively contributing pension plan participants, MSRS will provide:
   • The name of the participant; and
   • The pension plan to which the participant is currently contributing.
2. For requests related to benefit recipients (retirees, disabilitants, survivors, refund recipients), MSRS will provide
   • The name of the participant;
   • Gross annuity amount (if the first check has been issued)
   • The plan(s) from which benefits are paid; and
   • The type of benefit awarded (retirement, disability, or survivor).
3. For requests related to inactive participants, MSRS will provide:
   • The name of the participant; and
   • The pension plan(s) to which the participant previously contributed

Other Public Data

MSRS maintains other Public Data, including:

1. Contract information;
2. Financial Data; and
3. Summary demographic data

MSRS may comply with a written request for summary demographic data if the Executive Director determines that disclosing the data will not compromise any Private or Confidential data on an individual.

Public Data Requests

MSRS will provide Public Data upon receipt of a data request as prescribed by this policy. MSRS is not required to create new data or put data into new forms.

All Public Data Requests should be made in writing. To streamline requests, individuals and organizations are encouraged to submit a Public Data Request Form found on the MSRS website. Requests can be faxed, hand-delivered, or emailed to the MSRS office:

MSRS

Attn: Data Compliance Official

60 Empire Drive, Suite 300

Saint Paul, MN 55103

In your Public Data Request, you should specify:

1. That you are requesting Public Data under the “Government Data Practices Act” or “Minnesota Statutes, Chapter 13”;
2. Whether you would like to inspect the data, have copies made of the data, or both; and
3. Which data you would like to inspect and/or have copied.

You are not required to identify yourself or explain the reason for your data request. However, failure to provide contact information may inhibit MSRS’s ability to fulfill your request.

MSRS reserves the right to require that unusual or complicated requests be made in writing, and MSRS is not required to provide the information more frequently than once every six months.

Costs

MSRS does not charge to copy or prepare Public Data unless the expense exceeds $25. Costs are calculated according to the following policy:

• For more than 100 pages of paper copies – 25¢ per page for black and white, letter or legal size paper, one-sided, or 50¢ per page for a two-sided copy
• The charge for all other types of copies is the actual cost of searching for and retrieving the data and making the copies or electronically transmitting the data.
• MSRS may request payment of copy costs before taking steps to retrieve the data if the estimated cost exceeds $100

Agency Response

MSRS will respond to any data request promptly, but no later than within 10 business days. The response does not have to be in writing unless MSRS is unable to comply with the request.

The response will include:

1. A request for clarification if the data request is unclear or overly broad;
2. Whether MSRS has the requested data;
3. Whether the requested data is public and, if not public, the specific law that makes the data not public;
4. If the requested data is public and MSRS has the data, MSRS will respond with one or more of the following:
   • Arrange a time and place to inspect the data for free;
   • Arrange the best method for the requesting party to receive a copy of the requested data; or
   • Provide an estimate of the copy cost if it would exceed $25.

How to Request Public Data

To request public data, complete the Public Data Request Form.

Contact Us

You can contact the MSRS Data Practices Compliance Official by emailing datarequests@mnretire.gov.

Updated August 2026

This policy describes your rights as a current or former Minnesota State Retirement System (MSRS) plan participant to access and review information about yourself and your accounts.

As a state agency, MSRS is governed by the Minnesota Government Data Practices Act (Minnesota Statutes, Chapter 13.) Minn. Stat. 13.025, subds. 3 and 4 require MSRS to maintain this policy and make it easily available.

Data about You

Data is any information that MSRS collects, creates, receives, maintains, or disseminates in any form. When you as an individual can be identified from a piece of data, you are the subject of that data. Participant data is separated into several categories:

Public

By law, Public Data must be provided to a requestor upon submission of a public information request. The only public data about specific plan participants is name, gross pension amount, and benefit type. We provide this information when it is requested, and only for individuals who have begun receiving a benefit from one of our pension plans.

Private

Private Data cannot be disclosed to any person or entity who is not the subject of that data. This data could identify you and so MSRS takes all reasonable steps to protect it from improper disclosure. Private data includes but is not limited to: social security number, date of birth, and address.

Confidential

State and federal law provide additional protections for certain data. Confidential Data cannot be disclosed to members of the public or to the individual who is the subject of the data. MSRS maintains three types of Confidential Data:

• Beneficiary data can only be disclosed to the account holder; not to the beneficiary;
• Legal communications are protected from disclosure by attorney-client privilege; and
• Medical records may not be disclosed to the patient if they are marked accordingly by a physician. An example of this is psychotherapy notes.

Your Rights

As a current or former MSRS plan participant, you have the following rights with respect to your MSRS participant data:

• To be informed that you have an account with MSRS and the type of data that MSRS maintains relating to you. This includes personally identifiable information, employment information, and retirement benefit information;
• To view any non-Confidential Data that MSRS possesses about you;
• To receive a copy of your data in person or by mail;
• To receive a prompt response to your request for data, no later than 10 business days following its submission;
• To correct inaccurate data; and
• To any other rights provided by law.

MSRS reserves the right to require that unusual or complicated requests be made in writing, and MSRS is not required to provide the information more frequently than once every six months. Additionally, MSRS may charge you the actual cost of producing copies of the requested data if we determine that your request is excessive. Costs are calculated according to the following policy:

• For more than 100 pages of paper copies – 25¢ per page for black and white, letter or legal size paper, one-sided, or 50¢ per page for a two-sided copy.
• The charge for all other types of copies is the actual cost of searching for and retrieving the data and making the copies or electronically transmitting the data.
• MSRS may request payment of copy costs before taking steps to retrieve the data if the estimated cost exceeds $100.

MSRS requires proof of identity before providing requested participant data. MSRS interacts with participants in person, via telephone, and via email. Therefore the method of verifying a participant’s identity is specific to the type of communication.

Data requests on behalf of a participant

A third party may request participant data on your behalf in the following situations:

• You have granted the third party a power of attorney and MSRS has it on-file;
• A court has appointed the third party as your conservator and MSRS has verified the conservator documents;
• A court has appointed the third party as your personal representative after you pass away, or, if there is no personal representative of your estate, your surviving spouse or your child, or, if you do not have a surviving spouse of child, your parents;
• The third party is requesting data related to the Health Care Savings Plan and is named on a signed "Authorization to Disclose Protected Participant Account Information" form;
• The third party is requesting data about you because you have applied for a disability benefit and you have named the third party on a signed “Authorization to Disclose Protected Participant Disability Application Information” or “Authorization to Disclose Application Information to Employer” form; or
• When speaking with an MSRS representative and after verifying your identity, you request that the MSRS representative speak with another person whom you identify as a personal representative for the duration of that phone call.

In any and all cases, the third party who is requesting participant data on your behalf must verify your identity according to MSRS’s standards and procedures.

How to Request Participant Data

To request participant data, complete the Participant Data Request Form.

Contact Us

You can contact the MSRS Data Practices Compliance Official by emailing datarequests@mnretire.gov.

Your Information. Your Rights. Our Responsibilities.

Effective October 1, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This notice applies to participants in the Health Care Savings Plan (your “Plan”) administered by the Minnesota State Retirement System (“MSRS”). Your Plan is sponsored by the State of Minnesota through the MSRS Board of Directors (“Board of Directors”). The Plan is required by the Health Insurance Portability and Accountability Act (HIPAA) to provide you with this notice. This notice applies to your “health information” which includes most of the information about you when that information is being used or disclosed by your Plan. Your health information includes your medical treatment records, demographic information, information about claims for reimbursement, and information about payment to you for healthcare-related expenses.

Your Rights

You have the right to:

• Get a copy of your records
• Correct your records
• Request confidential communication
• Ask us to limit the information we share
• Get a list of those with whom we’ve shared your information
• Get a copy of this privacy notice
• Choose someone to act for you
• Authorize us to share information on your behalf
• File a complaint if you believe your privacy rights have been violated

Our Uses and Disclosures

We will use and share your information as we:

• Process and pay claims for health expense reimbursement
• Run our organization
• Administer your health plan

We are permitted or required to use and share your information to:

• Help manage the health care treatment you receive
• Help with public health and safety issues
• Do research
• Comply with the law
• Work with organ donation organizations and medical examiners
• Address workers’ compensation, law enforcement, and other government requests
• Respond to lawsuits and legal actions

To the extent that we have your substance use disorder patient records, subject to 42 CFR part 2, we will not share that information for investigations or legal proceedings against you without (1) your written consent or (2) a court order and a subpoena.

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

• Get a copy of health and claims records
  • You can ask to see or get a copy of your health and reimbursement claim records and other information we have about you. Ask us how to do this.
  • We will provide a copy or a summary of your health and reimbursement claim records, usually within 30 days of your request. We may charge a reasonable, cost-based fee.
• Ask us to correct health, claim and demographic records.
  • You can ask us to correct your records if you think they are incorrect or incomplete. Ask us how to do this.
  • Within 30 days of a request to correct a record we either correct the record or provide you with a reason why we are not.
  • If we say “no” to your request, we will provide you with the process to appeal our decision.
• Request confidential communications
  • You can ask us to contact you in a specific way or to send mail to a different address.
  • We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not.
• Ask us to limit what we use or share
  • You can ask us not to use or share certain health information for treatment, payment, or our operations.
  • We are not required to agree to your request, and we may say “no,” for example, if it would violate the terms of the Plan or the law. If we agree to your request, we may still share this information in an emergency.
• Get a list of those with whom we’ve shared information
  • You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we shared it with, and why.
  • We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make).We cannot be required to provide more than one accounting every six months.
• Get a copy of this privacy notice. You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.
• Choose someone to act for you
  • If someone has authority to act as your personal representative, such as if someone has your power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.
  • We will make sure the person has this authority and can act for you before we take any action.
• Authorize us to share your information with someone you trust. You have the right to ask us to share your information with friends, family members, or someone else who you want us to share with and for any reason and for any period of time. We will share the information you want us to share for as long as you want us to share it.
• File a complaint if you feel your rights are violated
  • You can complain if you feel we have violated your rights by contacting the MSRS Data Compliance Official, using the information at the end of this notice.
  • You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1.877.696.6775, or visiting https://www.hhs.gov/hipaa/filing-a-complaint/index.html.
  • We will not retaliate against you for filing a complaint.

Our Uses and Disclosures

How do we typically use or share your health information?

We typically use or share your health information in the following ways.

• Reimburse for your health services. We can use and disclose your information as we process and pay your claim for health expense reimbursement.
  • Example: We use information about you when we review your claim for reimbursement of a medical expense.
• Run our organization.
  • We can use and disclose your information to run our organization and contact you when necessary.
    • We do not collect or store your genetic information unless submitted to us as substantiation for a claim. We are not allowed to use genetic information to decide whether we will give you coverage and the price of that coverage.
    • Example: We use health information about you to develop better services for you.
• Administer your plan. We may disclose your health information to the Board of Directors for plan administration.
  • Example: We may provide statistics based on your health information to the Board of Directors to help decide Plan features.

How else can we use or share your health information?

We are allowed or required to share your information in other ways–usually in ways that contribute to the public good, such as public health and research. We rarely if ever actually use or disclose information in this way. We have to meet many conditions in the law, including in the Minnesota Government Data Practices Act, before we can share your information for these purposes. And in all cases, if we have substance use disorder patient records about you, subject to 42 CFR part 2, we cannot use or share information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without (1) your consent or (2) a court order and a subpoena

• Help manage the health care treatment you receive. We can use your health information and share it with professionals who are treating you.
  • Example: We might coordinate with a doctor about sending us a letter of medical necessity before approving a claim for reimbursement.
• Help with public health and safety issues. We can share health information about you for certain situations such as:
  • Reporting suspected abuse, neglect, or domestic violence
  • Preventing or reducing a serious threat to anyone’s health or safety
• Do research. We can use or share your information for health research, if sharing is authorized under the Minnesota Government Data Practices Act.
• Comply with the law. We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.
• Work with organ donation organizations and medical examiners. In limited situations permitted by the Minnesota Government Data Practices Act:
  • We can share health information about you with organ procurement organizations.
  • We can share health information with a coroner, medical examiner, or funeral director when an individual dies.
• Address workers’ compensation, law enforcement, and other government requests. We can use or share health information about you:
  • For workers’ compensation claims, if authorized by the Minnesota Government Data Practices Act
  • For law enforcement purposes or with a law enforcement official
  • With health oversight agencies for activities authorized by law
  • For special government functions such as military, national security, and presidential protective services
• Respond to lawsuits and legal actions. We can share health information about you in response to a court or administrative order, or in response to a subpoena.

Our Responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We will not share your information for marketing purposes or sell your information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must comply with the requirements of the Minnesota Government Data Practices Act wherever those requirements are more protective of your data than what is required by federal law.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described in this notice unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.

Changes to the Terms of this Notice

We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request and on our web site and we will inform you by mail, electronic notice, or email that the notice has changed.

Effective Date

The Effective Date of this notice is October 1, 2026.

Contact Us

If you have questions about this notice or would like to do something described in this notice, contact the MSRS Service Center at 651.284.7730 or 800.657.5757.

You can contact the MSRS Data Practices Compliance Official by emailing datarequests@mnretire.gov.