Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · minneapolis–st. paul

Twin Cities device makers, health plans and retailers all hold data Minnesota now lets people question.

Minnesota's privacy act gives residents a right most states skipped. If a profiling decision about them has legal or similar effects, they can ask why and contest it. Add a health records law that wants patient consent before most releases, and the identity and data questions in the Twin Cities get specific fast.

Talk to an engineer
work in minneapolis–st. paul7 services
4 local rules covered below
in short·15-second read

For Twin Cities organizations we build customer identity, identity governance, payer and provider platform integrations and AI governance.

Device makers need control over connected product data and the engineers who reach it. Health plans need consent-aware data flows. Retailers need a data inventory that can answer MCDPA requests. Cohash works from Frisco, Texas, serves Minnesota clients remotely and flies up for workshops and launches.

We have no office in Minnesota. Cohash serves Twin Cities teams remotely from Frisco, Texas, and flies to Minneapolis or St. Paul for discovery sessions, design workshops and go-live support.

Ask an engineer facts checked 2026-10-21 · 9 sources
rules
Minnesota breach notification, Minn. Stat. §325E.61Minnesota Consumer Data Privacy Act, Minn. Stat. §§325M.10–325M.21Minnesota Health Records Act, Minn. Stat. §144.293CMS Interoperability and Prior Authorization Final Rule
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
minneapolis–st. paul by the numbers

What's specific about Minneapolis–St. Paul

Each figure comes from a public source, linked on the card.

01 334,500

Minnesota counted 334,500 life sciences jobs across 7,750 establishments in 2024, according to DEED figures sourced from Lightcast. The same DEED page ranks the state second for medical device manufacturing, citing the US Patent and Trademark Office for 2024.

source ↗ 02

Greater MSP's 2024 ranking table shows 17 companies from the region on Fortune's list of the 500 biggest US companies, running from UnitedHealth Group in 4th place to Fastenal in 488th.

source ↗ 03 160,000

Cargill tops the Forbes 2024 ranking of private US companies, with 160,000 employees, as reproduced on Greater MSP's major employers page.

source ↗ 04 395,700

Education and health services held about 395,700 of the Minneapolis-St. Paul-Bloomington metro's roughly 2,025,500 nonfarm jobs in September 2026, preliminary BLS data shows. Manufacturing accounted for 203,600.

source ↗ 05 $10 million

In a 2015 memorandum and order, Judge Paul Magnuson of the US District Court for Minnesota gave final approval to a $10 million consumer settlement over the 2013 Target data breach. The deal also required Target to improve its data security practices.

source ↗
who and what

Who we work with in Minneapolis–St. Paul, and the rules they work under

industries

  1. Medical devices and connected therapies

    Implantables, monitors and surgical systems now phone home, and the telemetry they send lands in cloud platforms that field engineers, clinical specialists and contract manufacturers can all query. We map which people and service accounts can reach patient-linked device data, cut standing access, and set up review cycles that a quality or regulatory team can sign off on.

  2. Health plans and care delivery

    Payers and integrated systems in the metro exchange claims, clinical and pharmacy data with partners every hour. Minnesota's Health Records Act wants signed patient consent for most provider releases, so we design data flows that carry the consent record with the data and block a release when it is missing or expired.

  3. Retail and consumer brands

    Loyalty programs, retail media networks and e-commerce accounts give big retailers profiles on millions of shoppers. The MCDPA asks controllers to keep a data inventory and to name the specific third parties that received a person's data. We build that inventory from the warehouse and tag pipelines, then wire consumer requests into it.

  4. Agribusiness and food

    Grain traders, cooperatives and food makers run plant floors, trading desks and supplier portals on one corporate directory. Supplier and grower accounts pile up for years. We clean up external identities, put contractor access on expiry dates and separate trading systems from plant networks.

regulations

  1. Minnesota breach notification, Minn. Stat. §325E.61 ↗

    Businesses notify affected residents in the most expedient time possible and without unreasonable delay. A vendor holding the data tells the owner immediately after discovery. When more than 500 people get notice at once, the nationwide consumer reporting agencies must hear within 48 hours.

  2. Minnesota Consumer Data Privacy Act, Minn. Stat. §§325M.10–325M.21 ↗

    Effective 31 July 2025 for controllers handling data on 100,000 or more Minnesotans, or 25,000 or more with over 25% of revenue from data sales. It requires a data inventory and lets people contest significant profiling decisions. The 30-day AG warning-letter cure period expired 31 January 2026.

  3. Minnesota Health Records Act, Minn. Stat. §144.293 ↗

    Providers may not release health records without a signed and dated patient consent, specific authorization in Minnesota law, or a representation that another provider holds such consent. A consent is valid for one year unless it or the law says otherwise.

  4. CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) ↗

    Reaches Medicare Advantage organizations and Medicaid managed care plans, both large lines of business for Twin Cities payers. Prior authorization process rules began 1 January 2026 and the new API requirements apply mostly from 1 January 2027.

services

Most requested in Minneapolis–St. Paul

The services clients in Minneapolis–St. Paul ask us for most.

you are hereMinneapolis–St. Paul
01What does the MCDPA right to question a profiling decision mean for our models?

If a model drives a decision with legal or similarly significant effects, such as credit, insurance or housing, a Minnesotan can ask why it came out that way, see the data behind it and get it fixed and reevaluated. You need decision logs, feature lineage and a review queue for those requests. We build that alongside your AI governance program.

02We already answer CCPA requests. Is Minnesota just more of the same?

Mostly, with two extra pieces. Minnesota expects a written inventory of the personal data you manage, and it lets people ask for the specific third parties that got their data. A category list won't do. Many CCPA programs track categories only, so the gap is usually in vendor-level sharing records.

03How does the Health Records Act change a data sharing project with a partner?

Under Minnesota law, many releases a HIPAA-only design would allow still need signed patient consent, and that consent usually lapses after a year. We store consent status where the integration can check it at send time and stop the transfer when consent is absent.

04Can you work with our medical device quality system?

Yes, on the access side. We document who and what can reach device and telemetry systems, and produce review evidence your quality team can file. Design controls and regulatory submissions stay with your engineering and regulatory staff.

elsewhere

Other cities we cover

All 82 cities
AtlantaPayments & payers ChicagoTrading & healthcare New YorkNYDFS-regulated finance AustinTech & state government Dallas–FriscoBanking, fintech, telecom (HQ) HoustonEnergy & pipelines
sources 9 sources linked last checked 2026-10-21 content fingerprint 31eec954
  1. 01Minnesota DEED, Life Sciencesmn.gov ↗
  2. 02Greater MSP, Major Employersgreatermsp.org ↗
  3. 03BLS, Minneapolis-St. Paul-Bloomington economy at a glancebls.gov ↗
  4. 04US District Court for Minnesota, In re Target, MDL 14-2522 final approval order (2015)mnd.uscourts.gov ↗
  5. 05Minn. Stat. §325E.61 (Revisor of Statutes)revisor.mn.gov ↗
  6. 06Minn. Stat. ch. 325M, full text (Revisor of Statutes)revisor.mn.gov ↗
  7. 07Minnesota Attorney General, consumer data privacyag.state.mn.us ↗
  8. 08Minn. Stat. §144.293 (Revisor of Statutes)revisor.mn.gov ↗
  9. 09CMS, Interoperability and Prior Authorization Final Rulecms.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it