Health record rights in Arizona: what state law adds
In Arizona, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a copy of your record faster than HIPAA requires, and free in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices must cover medical and health insurance information; and one of the three rules we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Are there rules for AI used in your care?One of the three rules is in force. A licensed clinician decides, not AI alone. Same answer in 12 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No comprehensive consumer privacy law found. Level 2 rests on the 2021 Genetic Information Privacy Act, which requires express consent from one class of non-HIPAA holder: direct-to-consumer genetic testing companies.
"Level" is the step on our rulebook's scale for this question. 0 means nothing beyond HIPAA. Higher means the law gives you more here.
Genetic Information Privacy Act: direct-to-consumer genetic testing company requirements. A.R.S. 44-8002(A)(2) (Laws 2021, ch. 254, HB 2069)
In force · effective · read October 3, 2026 · source(azleg.gov)
Obtain a consumer's consent for collecting, using or disclosing the consumer's genetic data, including: (a) Initial express consent that clearly describes the uses of the genetic data collected through the genetic testing product or service
Who it binds, in our words: "Direct-to-consumer genetic testing company" or "company" means an entity that offers genetic testing products or services directly to consumers (44-8001). Chapter does not apply to "Protected health information that is collected by a covered entity or business associate" (44-8003).
Genetic Information Privacy Act: separate consent to transfer or disclose. A.R.S. 44-8002(A)(2)(b)(i)
In force · effective · read October 3, 2026 · source(azleg.gov)
(b) Separate express consent for any of the following: (i) Transferring or disclosing the consumer's genetic data to any person other than the company's vendors and service providers.
Who it binds, in our words: Direct-to-consumer genetic testing companies only (44-8001, paragraph 4).
Genetic Information Privacy Act: definitions. A.R.S. 44-8001
In force · effective · read October 3, 2026 · source(azleg.gov)
"Express consent" means a consumer's affirmative response to a clear and prominent notice regarding collecting, using or disclosing genetic data for a specific purpose.
Who it binds, in our words: "Consumer" means an individual who is a resident of this state.
Session law adding the Genetic Information Privacy Act. Laws 2021, ch. 254 (HB 2069), approved April 20, 2021
In force · effective · read October 3, 2026 · source(azleg.gov)
AMENDING TITLE 44, ARIZONA REVISED STATUTES, BY ADDING CHAPTER 38; RELATING TO GENETIC TESTING COMPANIES.
Who it binds, in our words: No effective date clause; 2021 general effective date 09-29-2021 per https://www.azleg.gov/general-effective-dates/
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
Yes, both. A deadline shorter than 30 days, and a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Deadline: 10 business days (records under 12 months) or 15 business days, only for requests for upcoming treatment; personal copies get 30 calendar days. Free copies for continuing care, obtaining care and Social Security appeals go beyond HIPAA and 45 CFR 171.
Deadline in the law: 10 days.
Free copy: Records sent to another health care provider for continuing care (12-2295(B)(1))
Free copy: Patient request for the demonstrated purpose of obtaining health care (12-2295(B)(2))
Free copy: Health care decision maker request to obtain health care for the patient (12-2295(B)(3))
Free copy: Patient or legal representative appealing a denial of Social Security benefits, first request in a calendar year (12-2295(B)(5))
Fee rule: "a health care provider or contractor may charge a person who requests reproductions of medical records or payment records a reasonable fee for the reproduction of the records pursuant to this section" (12-2295(A)); no dollar amount or per-page cap stated in 12-2295
Goes beyond the federal floor: yes.
Release of medical records to patients; time frames. A.R.S. 12-2293(E)(1)(a) (Laws 2026, ch. 98, HB 2557)
In force · effective · read October 3, 2026 · source(azleg.gov)
1. If the request is made by a patient or the patient's health care decision maker and is for the purpose of upcoming medical treatment: (a) Within ten business days after receiving the request if the medical records are less than twelve months old
Who it binds, in our words: Health care providers. Ten business days for records under 12 months old in the current EHR system; fifteen business days if 12 months or older; thirty calendar days for other purposes, including personal copies.
Release of medical records to patients; general promptness rule. A.R.S. 12-2293(A) (Laws 2026, ch. 98, HB 2557)
In force · effective · read October 3, 2026 · source(azleg.gov)
the health care provider in possession of the medical record or payment record shall provide access to or copies of the medical records or payment records to the patient or the patient's health care decision maker promptly and within not more than seven business days.
Who it binds, in our words: Health care provider in possession of the record; subsection E applies "Notwithstanding any other provision of this section".
Session law: releasing medical records; promptness. Laws 2026, ch. 98 (HB 2557), approved June 4, 2026
In force · effective · read October 3, 2026 · source(azleg.gov)
WITHIN TEN BUSINESS DAYS AFTER RECEIVING THE REQUEST IF THE
Who it binds, in our words: No effective date clause; 2026 general effective date 09-12-2026 per https://www.azleg.gov/general-effective-dates/
Charges for medical records; free copies for continuing care. A.R.S. 12-2295(B)(1)
In force · effective · read October 3, 2026 · source(azleg.gov)
B. A health care provider or contractor shall not charge for the pertinent information contained in medical records provided to: 1. Another health care provider for the purpose of providing continuing care to the patient to whom the medical record pertains.
Who it binds, in our words: Health care providers and contractors.
Charges for medical records; free copy for Social Security appeal. A.R.S. 12-2295(B)(5) (Laws 2019, ch. 171, SB 1169)
In force · effective · read October 3, 2026 · source(azleg.gov)
5. The patient or the patient's legal representative for the purpose of appealing a denial of benefits under the social security act.
Who it binds, in our words: Health care providers and contractors; later requests in the same calendar year may carry a reasonable fee; a legal representative must provide form SSA-1696.
Session law adding the Social Security appeal free copy. Laws 2019, ch. 171 (SB 1169), approved May 6, 2019
In force · effective · read October 3, 2026 · source(azleg.gov)
PURPOSE OF APPEALING A DENIAL OF BENEFITS UNDER THE SOCIAL SECURITY ACT.
Who it binds, in our words: No effective date clause; 2019 general effective date 08-27-2019 per https://www.azleg.gov/general-effective-dates/
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute sets opt-out. The AHCCCS page says 42 CFR Part 2 substance use records are blocked in the HIE without written consent, so stricterForSensitive is true. That rule is federal; the state HIO chapter defers to it.
Set by state law.
Designated exchange: Contexture (operates Health Current, Arizona's HIE).
Some sensitive records need your consent even where routine records do not.
Individual right to opt out of health information organizations. A.R.S. 36-3803 (Laws 2019, ch. 311, SB 1321)
In force · effective · read October 3, 2026 · source(azleg.gov)
Except as otherwise provided in state or federal law, an individual has the right to opt out of having the individual's individually identifiable health information accessible through a health information organization by providing notice as explained in the health information organization's notice of health information practices.
Who it binds, in our words: Health information organizations and participating health care providers.
Disclosure through a health information organization; conditions. A.R.S. 36-3805(A)(1)
In force · effective · read October 3, 2026 · source(azleg.gov)
1. The individual has not opted out of having the individual's individually identifiable health information accessible through the health information organization.
Who it binds, in our words: Disclosure through a health information organization.
Session law: health information organizations. Laws 2019, ch. 311 (SB 1321)
In force · effective · read October 3, 2026 · source(azleg.gov)
Who it binds, in our words: No effective date clause; 2019 general effective date 08-27-2019 per https://www.azleg.gov/general-effective-dates/
AHCCCS member guide: What is the HIE? (names Contexture; Part 2 records blocked without consent). AHCCCS Office of Individual and Family Affairs, What is the HIE?, 2024-12-20
In force · effective · read October 3, 2026 · source(azahcccs.gov)
No, providers can decide to enroll in the HIE through Contexture, the organization in Arizona that manages the HIE.
Who it binds, in our words: Providers enrolled in the HIE through Contexture.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
36-2163 keeps abortion reports out of public records and limits disclosure to law enforcement to court orders. Executive Order 2023-11 was noted but not counted. No statute limiting disclosure to other states was found.
In force · effective · read October 3, 2026 · source(azleg.gov)
a report filed pursuant to this article is not a public record and is not available for public inspection, except that disclosure may be made to law enforcement officials on an order of a court after application showing good cause.
Who it binds, in our words: Abortion, complication and informed consent reports filed under title 36, chapter 20, article 2.
Session law amending 36-2163. Laws 2018, ch. 219 (SB 1394), Sec. 5
In force · effective · read October 3, 2026 · source(azleg.gov)
This act is effective from and after December 31, 2018.
Who it binds, in our words: Amends 36-2161, 36-2162 and 36-2163 and adds 36-2162.01.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Subsection A text dates from Laws 2019, ch. 311. A later act added paragraph 23 (medical examiner); that act was not identified. 36-509 lists 23 permitted recipients.
Mental health records; confidential records. A.R.S. 36-509(A)
In force · effective · read October 3, 2026 · source(azleg.gov)
A health care entity must keep records and information contained in records confidential and not as public records, except as provided in this section.
Who it binds, in our words: Health care entities holding records under title 36, chapter 5 (mental health services).
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
36-664(J) bars disclosure of HIV-related information and bars compelled disclosure by subpoena except by a 36-665 order. Subsection K changed after 2022 by an act not identified; J text matches the 2022 act.
In force · effective · read October 3, 2026 · source(azleg.gov)
a person who receives HIV-related information in the course of providing a health service or pursuant to a release of HIV-related information shall not disclose that information to another person or legal entity
Who it binds, in our words: Persons receiving HIV-related information; does not apply to "persons or entities that are subject to regulation under title 20" (36-664(K)).
Session law amending 36-664. Laws 2022, ch. 246 (HB 2433), approved May 20, 2022
In force · effective · read October 3, 2026 · source(azleg.gov)
Who it binds, in our words: No effective date clause; 2022 general effective date 09-24-2022 per https://www.azleg.gov/general-effective-dates/
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
12-2802 makes genetic test information confidential and privileged. 44-8002 bars DTC genetic testing companies from disclosing genetic data to insurers or employers. 12-2804(B) bars state agencies and local health authorities from releasing genetic testing information; it is recorded undated.
In force · effective · read October 3, 2026 · source(azleg.gov)
genetic testing and information derived from genetic testing are confidential and considered privileged to the person tested and shall be released only as authorized by state or federal law
Who it binds, in our words: Any holder of genetic testing information, subject to the listed exceptions.
Session law amending 12-2802. Laws 2019, ch. 250 (SB 1297), approved May 22, 2019
In force · effective · read October 3, 2026 · source(azleg.gov)
genetic testing and information derived from genetic testing are confidential and considered privileged to the person tested and shall be released only as authorized by state or federal law
Who it binds, in our words: No effective date clause; 2019 general effective date 08-27-2019 per https://www.azleg.gov/general-effective-dates/
Direct-to-consumer genetic testing company; disclosure to insurers and employers. A.R.S. 44-8002(B)
In force · effective · read October 3, 2026 · source(azleg.gov)
a direct-to-consumer genetic testing company may not disclose a consumer's genetic data to any entity offering health insurance, life insurance or long-term care insurance or to any employer of the consumer.
Who it binds, in our words: Direct-to-consumer genetic testing companies.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Level 1: right to sue limited to communicable disease and HIV information (36-668). The azleg page shows no history note; 36-668 was in force by 2019-08-27, since Laws 2019 ch. 311 cites it. The 12-2296 date was not found.
"Level" is the step on our rulebook's scale for this question. 0 means nothing beyond HIPAA. Higher means the law gives you more here.
Damages a court may award: None stated. 36-668 allows "legal and equitable relief". 44-8004 allows actual damages, but only in an attorney general action.
Communicable disease information; private right of action. A.R.S. 36-668
In force · current version date not confirmed · read October 3, 2026 · source(azleg.gov)
A protected person may bring an action in superior court for legal and equitable relief on his own behalf against a person who violates this article.
Who it binds, in our words: Violations of title 36, chapter 6, article 4 (communicable disease related information, including HIV). Not applicable to entities regulated under title 20 (36-664(K)).
Breach notification enforcement. A.R.S. 18-552(L)
In force · effective · read October 3, 2026 · source(azleg.gov)
A knowing and wilful violation of this section is an unlawful practice pursuant to section 44-1522, and only the attorney general may enforce such a violation
Who it binds, in our words: Breach notification law; attorney general enforcement only.
Genetic Information Privacy Act enforcement. A.R.S. 44-8004
In force · effective · read October 3, 2026 · source(azleg.gov)
The attorney general may bring an action to enforce this chapter.
Who it binds, in our words: Direct-to-consumer genetic testing companies; civil penalty up to $2,500 per violation.
Medical records; good-faith immunity. A.R.S. 12-2296
In force · effective · read October 3, 2026 · source(azleg.gov)
A health care provider, contractor or clinical laboratory that acts in good faith under this article is not liable for damages in any civil action for the disclosure of medical records
Who it binds, in our words: Medical records article (12-2291 et seq.); no private right of action stated in 12-2292 or 12-2296.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both medical information and health insurance ID numbers are data elements. HIPAA covered entities and business associates are outside the article, recorded as hipaaDeemedCompliant true. No later amendment of 18-551 was found.
Deadline to tell people: 45 days after determination of a breach.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Data security breaches; definitions (specified data element). A.R.S. 18-551 (Laws 2018, ch. 177, HB 2154)
In force · effective · read October 3, 2026 · source(azleg.gov)
(e) An individual's health insurance identification number. (f) Information about an individual's medical or mental health treatment or diagnosis by a health care professional.
Who it binds, in our words: A person that conducts business in this state and owns, maintains or licenses unencrypted and unredacted computerized personal information (18-552(A)).
Session law adding health data elements. Laws 2018, ch. 177 (HB 2154), approved April 11, 2018
In force · effective · read October 3, 2026 · source(azleg.gov)
(e) AN INDIVIDUAL'S HEALTH INSURANCE IDENTIFICATION NUMBER.
Who it binds, in our words: No effective date clause found; 2018 general effective date 08-03-2018 per https://www.azleg.gov/general-effective-dates/
Notification of security system breaches; deadline and regulator notice. A.R.S. 18-552(B) (Laws 2022, ch. 81, HB 2146)
In force · effective · read October 3, 2026 · source(azleg.gov)
If the investigation results in a determination that there has been a security system breach, the person that owns or licenses the computerized data, within forty-five days after the determination, shall:
Who it binds, in our words: If more than 1,000 individuals: notice to the three largest consumer reporting agencies, the attorney general and the director of the Arizona department of homeland security.
Breach law exception for HIPAA covered entities. A.R.S. 18-552(N)(2)
In force · effective · read October 3, 2026 · source(azleg.gov)
A covered entity or business associates as defined under regulations implementing the health insurance portability and accountability act of 1996
Who it binds, in our words: The article "does not apply to" HIPAA covered entities and business associates; 18-552(I) also deems compliance with a federal regulator's rules as compliance.
Session law amending 18-552. Laws 2022, ch. 81 (HB 2146), approved March 29, 2022
In force · effective · read October 3, 2026 · source(azleg.gov)
AMENDING SECTION 18-552, ARIZONA REVISED STATUTES; RELATING TO DATA SECURITY BREACHES.
Who it binds, in our words: No effective date clause; 2022 general effective date 09-24-2022 per https://www.azleg.gov/general-effective-dates/
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
One of the three rules is in force. A licensed clinician decides, not AI alone.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
20-3103 and 20-3407 do not name AI. They bar sole reliance on any other source, which covers AI output. A reported AI consent rule for behavioral health (R4-6-1101, from 2027-01-01) was not verified; the bbhe.az.gov and azsos.gov pages blocked access.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: not found.
Denial of claims; review of claims. A.R.S. 20-3103 (Laws 2025, ch. 165, HB 2175)
In force · effective · read October 3, 2026 · source(azleg.gov)
health care insurer may deny a claim that was submitted by a provider on the basis of medical necessity, the medical director shall individually review the denial. During each individual review, the medical director shall exercise independent medical judgment and may not rely solely on recommendations from any other source.
Who it binds, in our words: Health care insurers; claim denials on the basis of medical necessity.
Denial of prior authorization; review of prior authorization. A.R.S. 20-3407 (Laws 2025, ch. 165, HB 2175)
In force · effective · read October 3, 2026 · source(azleg.gov)
During each individual review, the medical director shall exercise independent medical judgment and may not rely solely on recommendations from any other source.
Who it binds, in our words: Health care insurers; direct denials of prior authorization that involve medical necessity.
Session law: prior authorization; claims. Laws 2025, ch. 165 (HB 2175), Sec. 3, approved May 12, 2025
In force · effective · read October 3, 2026 · source(azleg.gov)
This act is effective from and after June 30, 2026.
Who it binds, in our words: Adds 20-3103 and 20-3407.
Health care insurers; medical directors (licensure of reviewing medical director). A.R.S. 20-2510(B) (Laws 2025, ch. 222, HB 2054)
In force · effective · read October 3, 2026 · source(azleg.gov)
any direct denial of prior authorization of a service requested by a health care provider on the basis of medical necessity by a health care insurer shall be made in writing by a medical director who holds an active unrestricted license to practice medicine in this state
Who it binds, in our words: Health care insurers; dental and optometric service corporations may use other licensees (20-2510(C), (D)).
Session law amending 20-2510. Laws 2025, ch. 222 (HB 2054), approved June 25, 2025
In force · effective · read October 3, 2026 · source(azleg.gov)
made in writing by a medical director who holds an active unrestricted license
Who it binds, in our words: 2025 general effective date 09-26-2025 per https://www.azleg.gov/general-effective-dates/
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
12.9%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
95.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
89.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
8.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$72,581 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.4%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
5.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
26.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
11.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
