Health record rights in Washington, DC: what DC law adds
In Washington, DC, as of October 3, 2026, we found no law on health data held outside HIPAA; copy rights go no further than HIPAA; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices must cover medical and health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Washington, DC is not a state. It makes its own laws on these questions, so we checked it the same way, and show it apart from the 50 states.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what DC adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No consumer health data or comprehensive privacy law found in the D.C. Law Library list of laws through Council Period 26. B26-0525 would require consent but is a bill in committee, not enacted.
How we searched (October 3, 2026): the official code index (a data file) for health, data, privacy, consumer, broker, medical, consumer health data, personal health data. Agency pages checked: oag.dc.gov.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
No. A law is in force, but it adds nothing to HIPAA's terms.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Deadline is 30 days and applies only to requests by an authorized third party, not shorter than HIPAA. No free copy case found. Per-page caps are facts only. Under Ruling D-1, nothing goes beyond the federal floor.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Fee rule: D.C. Code 3-1210.11(b)(1): patient may be charged "a reasonable fee for copying, as determined by the board through rulemaking".
Fee rule: D.C. Code 3-1210.11(b)(2): a health care power of attorney holder or listed survivor may not be charged a fee different from the patient's fee.
Fee rule: D.C. Code 3-1210.12(b), requests by a person the patient authorizes, electronic: search and handling fee $22.88 plus up to 66 cents per page, total not over $86.54.
Fee rule: D.C. Code 3-1210.12(b), non-electronic: search and handling fee $22.88, up to 88 cents per page, plus actual postage.
Fee rule: D.C. Code 3-1210.12(d): fees adjusted yearly by CPI from January 1, 2024. DC Health 2026 maximums: $25.00 search fee, $0.72 per page electronic (total $94.57), $0.96 per page non-electronic.
Fee rule: D.C. Code 3-1210.12(a)(3)(B): fee reduced by $15 per day if the record is not sent within 60 days.
Goes beyond the federal floor: no.
Patient or client records. D.C. Code § 3-1210.11
In force · effective · read October 3, 2026 · source(code.dccouncil.gov)
a health care entity having custody and control of the patient's or client's personal medical record shall furnish a complete and current copy of that personal medical record.
Who it binds, in our words: Health care entities with custody and control of the record; request by the patient or client, a health care power of attorney holder, or listed survivors.
Patient or client records: fee. D.C. Code § 3-1210.11(b)(1)
In force · effective · read October 3, 2026 · source(code.dccouncil.gov)
to pay a reasonable fee for copying, as determined by the board through rulemaking.
Who it binds, in our words: Health care entities.
Persons authorized by a patient or client to receive personal medical records. D.C. Code § 3-1210.12(a)(1)
In force · effective · read October 3, 2026 · source(code.dccouncil.gov)
the health care entity shall transmit to the requester, within 30 days from the date the request was received, a complete and current copy of the personal medical record in the form and format requested
Who it binds, in our words: "the term "health care entity" means a health care provider or a business associate as defined in 45 C.F.R. § 160.103." Applies to requests by a person the patient authorizes.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
DHCF page names CRISP DC as the District Designated HIE since April 2020. The rule took effect on publication, May 1, 2026. Whether DC law needs added consent for sensitive data in the HIE was not determined.
Set by a regulation.
Designated exchange: CRISP DC (Chesapeake Regional Information System for our Patients), District Designated HIE Entity.
Designated HIE entity requirements to promote consumer participation, access, and education. 29 DCMR § 8710.12(c), as amended by DHCF final rulemaking, 73 DCR (Vol. 73, No. 18, May 1, 2026)
In force · effective · read October 3, 2026 · source(dhcf.dc.gov)
A designated HIE entity shall not disclose information derived from a health care consumer's PHI if the health care consumer has submitted a written notice or request to opt-out of health information exchange, except as otherwise permitted under applicable law.
Who it binds, in our words: Designated HIE entity under 29 DCMR Chapter 87. Section 8710.17 requires it to act on an opt-out request within seven calendar days.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
D.C. Law 24-257 limits District disclosure of information to other states' proceedings on abortion and contraception, and conditions foreign subpoenas. These rules cover information generally, not only medical records.
Human Rights Sanctuary: limits on District assistance to interstate investigations. D.C. Code § 2-1461.01(a)
In force · effective · read October 3, 2026 · source(code.dccouncil.gov)
The District and its officers and employees acting in their official capacities shall not provide any information or expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any interstate investigation or proceeding seeking to impose civil or criminal liability upon any person
Who it binds, in our words: District government and its officers and employees. Covered conduct includes receiving or seeking an abortion or contraception, and gender-affirming care.
In force · effective · read October 3, 2026 · source(code.dccouncil.gov)
A subpoena issued under the authority of a court of record of a foreign jurisdiction shall not be recognized as a valid foreign subpoena unless it is accompanied by a sworn written statement signed by the party seeking enforcement or their counsel under penalty of perjury
Who it binds, in our words: Foreign subpoenas; the statement must say the subpoena does not further an investigation or proceeding of a type in § 2-1461.01(a).
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
D.C. Law 2-136 bars disclosure of mental health information except as the Act authorizes, including disclosure by client authorization under § 7-1202.01.
Mental Health Information Act: disclosures prohibited; exceptions. D.C. Code § 7-1201.02(a)
In force · effective · read October 3, 2026 · source(code.dccouncil.gov)
Except as specifically authorized by subchapter II, III, or IV of this chapter, no mental health professional, mental health facility, data collector or employee or agent of a mental health professional, mental health facility or data collector shall disclose or permit the disclosure of mental health information to any person
Who it binds, in our words: Mental health professionals, mental health facilities, data collectors, and their employees or agents.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
§ 7-1605 needs prior written permission for other disclosure of identifying HIV or AIDS information. § 31-1606 limits insurer disclosure of HIV test results.
Confidentiality of medical records and information (AIDS Health-Care Response Act). D.C. Code § 7-1605
In force · effective · read October 3, 2026 · source(code.dccouncil.gov)
All identifying information obtained, collected, or created by the Department under this subchapter shall not be discoverable or admissible as evidence in a civil or criminal action unless the person about whom the information pertains gives his or her prior written permission.
Who it binds, in our words: Records of HIV infection or AIDS cases reported to the Department of Health, and any person holding the identifying information.
Insurer HIV testing: informed consent and restrictions on disclosure. D.C. Code § 31-1606
In force · effective · read October 3, 2026 · source(code.dccouncil.gov)
An insurer shall not disclose the fact that a proposed insured was tested or the results of the test except to:
Who it binds, in our words: Insurers that request or require the certified HIV testing protocol of a proposed insured.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
D.C. Code 2-1401.03(e) requires an employer to get written consent before obtaining genetic information and bars its disclosure to others. It applies only in the employment context.
§ 2–1401.03. Exceptions. D.C. Code 2-1401.03(e)
In force · effective · read October 3, 2026 · source(code.dccouncil.gov)
provided, that the employee or applicant for employment provides, in writing, his or her informed consent, the genetic information is provided to the employee or applicant for employment in writing as soon as it is available, and the genetic information is not disclosed to any other person.
Who it binds, in our words: an employer, an employment agency, or a labor organization
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
A person can sue for breach law violations through the CPPA, and for mental health information violations. No general right to sue over medical records or consumer health data found. A 2026 amendment to § 28-3905 is not implemented.
Damages a court may award: Consumer Protection Procedures Act: treble damages or $1,500 per violation, whichever is greater. Mental Health Information Act: actual damages for negligent violation; not less than $1,000 for willful or intentional violation, plus costs and attorney's fees.
In force · effective · read October 3, 2026 · source(code.dccouncil.gov)
A consumer may bring an action seeking relief from the use of a trade practice in violation of a law of the District.
Who it binds, in our words: Consumers. Remedies include "Treble damages, or $1,500 per violation, whichever is greater, payable to the consumer".
Mental Health Information Act: civil liability. D.C. Code § 7-1207.01(b)
In force · effective · read October 3, 2026 · source(code.dccouncil.gov)
any person who willfully or intentionally violates the provisions of this chapter shall be liable in damages sustained by the client in an amount not less than $1,000 plus the costs of the action and reasonable attorney’s fees.
Who it binds, in our words: Violations of the Mental Health Information Act, except § 7-1205.05(a).
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both medical information and health insurance information are in the definition since D.C. Law 23-98 (June 17, 2020). HIPAA-compliant entities are deemed compliant for resident notice but must still notify the Attorney General.
Deadline to tell people: most expedient time possible and without unreasonable delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
In force · effective · read October 3, 2026 · source(code.dccouncil.gov)
(III) Medical information;
Who it binds, in our words: Personal information means name or other identifier in combination with listed data elements. "Medical Information" means any information about a consumer's dental, medical, or mental health treatment or diagnosis by a health-care professional.
In force · effective · read October 3, 2026 · source(code.dccouncil.gov)
(V) Health insurance information, including a policy number, subscriber information number, or any unique identifier used by a health insurer to identify the person that permits access to an individual's health and billing information;
Who it binds, in our words: Any person or entity who conducts business in the District and owns or licenses computerized or other electronic data that includes personal information.
Notification of security breach. D.C. Code § 28-3852(b-1), (g)
In force · effective · read October 3, 2026 · source(code.dccouncil.gov)
The person or entity shall, in all cases, provide written notice of the breach of the security of the system to the Office of the Attorney General for the District of Columbia as required under subsection (b-1) of this section.
Who it binds, in our words: Attorney General notice is required "if the breach affects 50 or more District residents." HIPAA or HITECH compliant notice to residents is deemed compliance under § 28-3852(g).
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No DC statute or regulation on AI in care or coverage found. DISB Bulletin 24-IB-002 (May 2024) sets supervisory expectations for insurer AI use; it is guidance, not law, and earns nothing.
How we searched (October 3, 2026): the official code index (a data file) for artificial intelligence, algorithm, automated decision, utilization review, health, insurance. Agency pages checked: disb.dc.gov.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for Washington, DC, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
4.8%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
95.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
89.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
7.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$101,722 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
6.7%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
35.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
17.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
10.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Find a state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
