US state health record rules for people who handle records
For doctors, nurses, medical records staff, practice managers and compliance teams in the United States: what the 50 states and DC add to HIPAA, the federal law, on copies, fees, the health information exchange, sensitive records, breach notice and AI in care, with every law quoted and linked. Working in another country? See If you work outside the United States, below.
What US state law adds, for people who handle records
The state rules on this page apply only in the United States. If you work in another country, read If you work outside the United States, below.
HIPAA, the US federal health privacy law, sets the same floor in every state. Many states add rules on top: a shorter deadline for copies, a free copy in some cases, a say over the health information exchange (HIE, the network that shares records between providers), and stricter rules for some sensitive records. Each state page records these rules question by question, with the law quoted, dated and linked.
Use it to see what a state's law says before you check with your own counsel. It does not tell you what your organization must do.
Not legal or compliance advice
This records what each law said on the date we read it. Laws and court orders change, and how a rule applies to your organization depends on facts we do not have. For a decision, check the official text and ask your counsel or compliance team.
What each state page records
Copies: whether patients get a copy faster than HIPAA's 30 days, or free in some cases, and whom a shorter deadline covers. Some deadlines apply only to one kind of provider, such as nursing homes.
Fees: the fee rules the law sets, quoted.
The health information exchange (HIE, the network that shares records between providers): whether patients opt in, can opt out, or have no general choice, what sets the rule, and the exchange the state designates where we found one.
Sensitive records: whether a law in force has its own confidentiality rule for reproductive, mental health, HIV and genetic records. These answers say whether a rule exists, not whether any care is legal or available.
Breach notice: whether the state's breach law covers medical information, health insurance information or both.
AI in care: whether patients must be told when AI is used, whether a licensed clinician must decide, and whether patients can reach a human.
Laws signed but not yet in force, with the date each takes effect.
If you work outside the United States
For any of the 198 countries and territories we score, start with that country's page. It gives a score out of 100 for each of eight rights, such as getting your full record and control over who sees it. It also names the laws that give those rights, lists real cases, and ends with every source we cite, with the date each link was checked.
Treating a patient who moves between countries? The traveling patient tool shows which parts of a record could follow a person across a border.
The same rule applies here: this is not legal or compliance advice. Check the official text and ask your own counsel.
Ask: What does Florida law add to HIPAA on how fast a patient gets a copy of their record, and what it can cost?
The assistant calls get_state with {"state":"FL"}.
What the tool sends back, the copy question, shortened:
Getting a copy: Faster for some patients, free in some cases.
Deadline: Nursing home residents only: within 14 working days (Fla. Stat. s. 400.145(1)). Other practitioners must provide copies "in a timely manner" (s. 456.057).
Fee rule: Licensed facility: "may not exceed $1 per page"; nonpaper records up to $2; up to $1 per year of records requested (s. 395.3025(1)).
Fee rule: Practitioners: "no more than the actual cost of copying, including reasonable staff time, or the amount specified in administrative rule" (s. 456.057).
Check it: A deadline can cover only some providers. Read whom it covers before you rely on the number of days.
Practice managers and compliance teams
The exchange: opt in or opt out
Ask: In Arizona, do patients have to agree before their records go through the health information exchange, and which exchange does the state designate?
The assistant calls get_state with {"state":"AZ"}.
What the tool sends back, the exchange question, shortened:
Health information exchange: Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
Designated exchange: Contexture (operates Health Current, Arizona's HIE).
Some sensitive records need consent even where routine records do not.
Health data outside HIPAA. HIPAA does not cover most apps, wearables, websites or data brokers.
Getting a copy. HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
Health information exchange. HIPAA lets providers share records for treatment without asking you.
AI assistants can make mistakes, even when they read from our data. Each answer from the index carries a link to the page on this site that shows the same thing. Country scores carry their sources, and US state answers carry the laws they cite. Check them before you quote a score, a law or a date.
Scores are out of 100. Treat two scores less than 5 points apart as the same. The countries in the lead group are always named together. Any of them could rank first, so we never call one of them first.
This is a research tool, not legal advice. It records what laws and official pages said on the dates we read them, and it does not rate any hospital, doctor or company.
We check our data, which makes errors less likely but does not rule them out. We cannot check what an assistant writes from it. If you find one, tell us. Please leave out anyone's medical details.
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index, by SuperTruth. Not legal or medical advice. Our data and our own words are CC BY 4.0, credit SuperTruth, Inc., Health Record Rights Index; quoted law and source titles stay with their owners. This page last changed on .
