Health record rights in Connecticut: what state law adds
In Connecticut, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a free copy of your record in some cases; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices must cover medical and health insurance information; and no rule we look for on AI in care is in force. One answer is not checked yet (health information exchange). Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Are there rules for AI used in your care?No. A law is in force, but it has none of the three rules. Also signed, not yet in force: AI companions and minors: limit on offering mental health services (January 1, 2027). Same answer in 6 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Since July 1, 2026 the CTDPA covers any person that processes sensitive data, and requires consent to process it. Consumer health data is sensitive data. 42-526 requires consent to sell, not a separate signed authorization.
Connecticut Data Privacy Act, controllers' duties: consent to process sensitive data. Conn. Gen. Stat. 42-520(a)(1)(D), as amended by P.A. 26-64, s. 14
In force · effective · read October 3, 2026 · source(cga.ct.gov)
(D) not process sensitive data concerning a consumer unless such processing is reasonably necessary in relation to the purposes for which such sensitive data are processed and without obtaining the consumer's consent
Who it binds, in our words: (2) control or process consumers' sensitive data, excluding personal data controlled or processed solely for the purposes of completing a payment transaction
Connecticut Data Privacy Act, applicability threshold. Conn. Gen. Stat. 42-516, as amended by P.A. 25-113, s. 6
In force · effective · read October 3, 2026 · source(cga.ct.gov)
(2) control or process consumers' sensitive data, excluding personal data controlled or processed solely for the purposes of completing a payment transaction
Who it binds, in our words: (1) Conduct business in this state, or produce products or services that are targeted to residents of this state, and during the preceding calendar year controlled or processed the personal data of not fewer than thirty-five thousand consumers
Definition of sensitive data, which includes consumer health data. Conn. Gen. Stat. 42-515, as amended by P.A. 26-64, s. 12
In force · effective · read October 3, 2026 · source(cga.ct.gov)
means personal data that includes (A) data revealing (i) racial or ethnic origin, (ii) religious beliefs, (iii) a mental or physical health condition, diagnosis, disability or treatment, (iv) sex life, sexual orientation or status as nonbinary or transgender, or (v) citizenship or immigration status, (B) consumer health data
Who it binds, in our words: Controllers within Conn. Gen. Stat. 42-516.
Consumer health data privacy: consent before sale, geofencing limit. Conn. Gen. Stat. 42-526(a)(1)(D)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
(D) sell, or offer to sell, consumer health data without first obtaining the consumer's consent.
Who it binds, in our words: no person shall
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy for Social Security and veterans' benefits claims goes beyond HIPAA and the information blocking fees exception. Deadline is 30 days, not shorter. Undated history entries use the October 1 default in Conn. Gen. Stat. 2-32.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Free copy: Record needed to support a claim or appeal under the Social Security Act, with documentation (providers, 20-7c(d); licensed institutions, 19a-490b(b))
Free copy: Record needed to support a claim or appeal for veterans' benefits under Title 38 USC or chapter 506, with documentation (same sections)
Free copy: Licensed institutions may not deny records for inability to pay; an affidavit is presumptive evidence (19a-490b(d))
Fee rule: 20-7c(d): No provider shall charge more than sixty-five cents per page, including any research fees, handling fees or related costs, and the cost of first class postage; x-ray copies at cost of materials.
Fee rule: 19a-490b(a): No such institution shall charge more than sixty-five cents per page, including any research fees, clerical fees, handling fees or related costs, and the cost of first class postage.
Fee rule: 20-7c(d): a provider returning records a patient brought, or a successor provider returning records, may not charge the patient for copying costs.
Goes beyond the federal floor: yes.
Access to medical records: free copy for Social Security or veterans' benefits claim. Conn. Gen. Stat. 20-7c(d)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
provided no such charge shall be made for furnishing a health record or part thereof to a patient, a patient's attorney or authorized representative if the record or part thereof is necessary for the purpose of supporting a claim or appeal under any provision of the Social Security Act
Who it binds, in our words: a provider
Access to medical records: deadline. Conn. Gen. Stat. 20-7c(d)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
A provider shall furnish a health record requested pursuant to this section within thirty days of the request.
Who it binds, in our words: A provider
Furnishing of health records by licensed institutions: free copy for benefits claims and deadline. Conn. Gen. Stat. 19a-490b(b)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
No institution licensed pursuant to this chapter shall charge for furnishing a health record or part thereof to a patient, his attorney or conservator if the record or part thereof is necessary for the purpose of supporting a claim or appeal under any provision of the Social Security Act
Who it binds, in our words: institution licensed pursuant to this chapter
Furnishing of health records by licensed institutions: per-page fee cap. Conn. Gen. Stat. 19a-490b(a)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
No such institution shall charge more than sixty-five cents per page, including any research fees, clerical fees, handling fees or related costs, and the cost of first class postage, if applicable, for furnishing or providing access to a health record pursuant to this subsection
Who it binds, in our words: an institution licensed pursuant to this chapter
Furnishing of health records by licensed institutions: inability to pay. Conn. Gen. Stat. 19a-490b(d)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
No institution may deny a person the records available under subsection (a) of this section because of the person's inability to pay the required fees.
Who it binds, in our words: institution licensed pursuant to this chapter
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Not checked We did not finish the research on this question here, so this is not a no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute sets no routine consent rule, so the value comes from Connie policy. Connie pages show no policy date. OHS page still shows the designation; P.A. 26-68 moved that authority to OPM on July 1, 2026. Connie says opt-out data is deleted within 5 business days; page undated.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: Connie.
State page: how to opt out of Connie. Office of Health Strategy knowledge base, How to opt out of Connie (dated June 09, 2024)
In force · effective · read October 3, 2026 · source(portal.ct.gov, reached from portal.ct.gov)
Individuals who do not want their data shared with their health care providers through Connie can complete the
Who it binds, in our words: Patients whose data is shared through Connie, the HIE designated under Conn. Gen. Stat. 17b-59d.
State-wide Health Information Exchange: designation, now by OPM Secretary. Conn. Gen. Stat. 17b-59d(f), as amended by P.A. 26-68, s. 79
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Systems, technologies, entities, and programs that have not been so designated shall not be considered part of said exchange.
Who it binds, in our words: State-wide Health Information Exchange
Provider connection duty: no sharing without legally required consent. Conn. Gen. Stat. 17b-59e(d)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Nothing in this section shall be construed to require a health care provider to share patient information with the State-wide Health Information Exchange if (1) sharing such information is prohibited by state or federal privacy and security laws, or (2) affirmative consent from the patient is legally required
Who it binds, in our words: a health care provider
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure in civil, probate, legislative or administrative proceedings needs the patient's explicit written consent, subject to listed exceptions.
Disclosure of reproductive or gender-affirming health care information in proceedings. Conn. Gen. Stat. 52-146w(a)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
in any civil action or any proceeding preliminary thereto or in any probate, legislative or administrative proceeding, no covered entity or business associate, as defined in 45 CFR 160.103, shall disclose (1) any communication made to such covered entity or business associate
Who it binds, in our words: covered entity or business associate, as defined in 45 CFR 160.103
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure needs the patient's consent, except as listed in 52-146f to 52-146i.
Psychiatric and psychological communications and records: consent to disclose. Conn. Gen. Stat. 52-146e(a)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
no individual shall disclose or transmit any communication or record thereof, or the substance or any part or resume thereof, that identifies a person or patient to any individual, corporation or governmental agency without the consent of the person or patient or his or her authorized representative.
Who it binds, in our words: Communications and records as defined in 52-146d.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure is limited to the listed recipients. Chapter 368x was not in the 2026 Supplement.
Limitations on disclosure of HIV-related information. Conn. Gen. Stat. 19a-583(a)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
No person who obtains confidential HIV-related information may disclose or be compelled to disclose such information, except to the following:
Who it binds, in our words: Any person who obtains confidential HIV-related information.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
P.A. 26-64 also bars disclosure of test results to others without express consent and bars disclosure to employers and insurers. 38a-833 covers listed non-health insurance lines.
Direct-to-consumer genetic testing companies: separate express consent to disclose genetic data. P.A. 26-64, s. 19(a)(5)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
(5) In addition to the express consent required under subdivision (4) of this subsection, separately obtain a consumer's express consent to (A) disclose or transfer the consumer's genetic data to any person other than a vendor or service provider for the company
Who it binds, in our words: any person doing business in this state who, in the ordinary course of such business, (i) offers genetic testing directly to a consumer, or (ii) collects, uses or analyzes genetic data that a consumer has provided to such person
Insurers: nonconsensual use of direct-to-consumer genetic test information. Conn. Gen. Stat. 38a-833(1)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
request, require, purchase or use information obtained from an entity providing direct-to-consumer genetic testing without the informed written consent of the individual who has been tested
Who it binds, in our words: No insurer, health care center or fraternal benefit society doing business in this state
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Suits are available only for psychiatric records and HIV information. The CTDPA, consumer health data, genetic testing and breach laws are enforced by the Attorney General only.
Damages a court may award: None set. 52-146j(b) and 19a-590 allow civil damages for injury; no fixed amount.
Psychiatric communications and records: civil damages. Conn. Gen. Stat. 52-146j(b)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Any individual aggrieved by a violation of any provision of sections 52-146d to 52-146i, inclusive, may prove a cause of action for civil damages.
Who it binds, in our words: Violations of 52-146d to 52-146i (psychiatric and psychological communications and records).
HIV-related information: private cause of action. Conn. Gen. Stat. 19a-590
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Any person, except as otherwise provided in this chapter, who wilfully violates any provision of this chapter shall be liable in a private cause of action for injuries suffered as a result of such violation.
Who it binds, in our words: Wilful violations of chapter 368x (HIV-related information).
CTDPA and consumer health data: no private right of action. Conn. Gen. Stat. 42-525(d)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Nothing in sections 42-515 to 42-524, inclusive, or section 42-526, shall be construed as providing the basis for, or be subject to, a private right of action for violations of said sections or any other law.
Who it binds, in our words: Sections 42-515 to 42-524 and 42-526.
Direct-to-consumer genetic testing: no private right of action. P.A. 26-64, s. 19(b)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Any violation of subsection (a) of this section shall be deemed an unfair or deceptive trade practice under subsection (a) of section 42-110b of the general statutes and shall be enforced solely by the Attorney General.
Who it binds, in our words: Direct-to-consumer genetic testing companies.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both medical information and health insurance identifiers are in the definition. HIPAA-compliant entities are deemed compliant but must also notify the Attorney General. Section 36a-701b is not in the 2026 Supplement.
Deadline to tell people: without unreasonable delay but not later than sixty days after discovery.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Breach of security: definition of personal information. Conn. Gen. Stat. 36a-701b(a)(2)(A)(vii)-(viii)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
(vii) medical information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; (viii) health insurance policy number or subscriber identification number, or any unique identifier used by a health insurer to identify the individual
Who it binds, in our words: Any person who owns, licenses or maintains computerized data that includes personal information
Breach of security: notice deadline. Conn. Gen. Stat. 36a-701b(b)(1)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Such notice shall be made without unreasonable delay but not later than sixty days after the discovery of such breach, unless a shorter time is required under federal law
Who it binds, in our words: Any person who owns, licenses or maintains computerized data that includes personal information
Breach of security: notice to Attorney General. Conn. Gen. Stat. 36a-701b(b)(2)(A)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
shall, not later than the time when notice is provided to the resident, also provide notice of the breach of security to the Attorney General
Who it binds, in our words: The person who owns, licenses or maintains computerized data that includes personal information
Breach of security: HIPAA and HITECH compliance deemed compliance. Conn. Gen. Stat. 36a-701b(h)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Any person that is subject to and in compliance with the privacy and security standards under the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act
Who it binds, in our words: Persons subject to HIPAA and HITECH, who must still notify the Attorney General.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No. A law is in force, but it has none of the three rules.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
CTDPA lets a person question a profiling decision on health care services, but requires no human review, clinician role or AI disclosure. P.A. 26-15 companion rules take effect 2027-01-01.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: not found.
You can reach a human, or have a human review the decision: not found.
CTDPA: rights after profiling in furtherance of an automated decision. Conn. Gen. Stat. 42-518(a)(6), as amended by P.A. 26-64, s. 13
In force · effective · read October 3, 2026 · source(cga.ct.gov)
if the consumer's personal data were processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly significant effect concerning the consumer, and if feasible, (A) question the result of such profiling
Who it binds, in our words: Controllers within Conn. Gen. Stat. 42-516.
CTDPA: decisions covered include health care services. Conn. Gen. Stat. 42-515, as amended by P.A. 26-64, s. 12
In force · effective · read October 3, 2026 · source(cga.ct.gov)
means any decision made by the controller, or on behalf of the controller, that results in the provision or denial by the controller of any financial or lending service, any housing, any insurance, any education enrollment or opportunity, any criminal justice, any employment opportunity or any health care service.
Who it binds, in our words: Controllers within Conn. Gen. Stat. 42-516.
AI companions and minors: limit on offering mental health services. P.A. 26-15, s. 6(a)(1)(B)
Signed, not yet in force · effective · read October 3, 2026 · source(cga.ct.gov)
(B) Offering mental health services to such user, unless (i) such artificial intelligence companion is designed to deliver mental health services to users
Who it binds, in our words: operator of an artificial intelligence companion, where the operator knows, or has reason to believe, that the user is younger than eighteen years of age
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
7.0%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
94.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
90.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
7.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$90,213 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.3%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
8.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
22.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. In force The state offers a way to ask registered data brokers to delete your data.
Data broker registration with Department of Consumer Protection. P.A. 26-64, s. 2(a)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
no data broker shall sell or license brokered personal data in this state on or after January 1, 2027, unless the data broker is actively registered with the Department of Consumer Protection
Who it binds, in our words: data broker
Accessible deletion mechanism program. P.A. 26-64, s. 5(a)(1)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Not later than July 1, 2028, the Commissioner of Consumer Protection shall establish an accessible deletion mechanism program.
Who it binds, in our words: registered data brokers and data service providers
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
