Health record rights in Hawaii: what state law adds
In Hawaii, as of October 3, 2026, we found no law on health data held outside HIPAA; copy rights go no further than HIPAA; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices need not cover medical or health insurance information; and no rule we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No consumer health data or comprehensive privacy law in force. SB1163 (geolocation sale consent) stalled in House committee in 2026. HB2463 died in committee. HRS volume 11 lists no privacy chapter of this kind.
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
No. A law is in force, but it adds nothing to HIPAA's terms.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Patient copies cost reasonable costs, with no free case. The 10 working day deadline binds copies to a patient's attorney only, not the patient, so it is not counted. Fee bills HB248 and SB305 died.
Fee rule: HRS 622-57(g): "Reasonable costs incurred by a health care provider in making copies of medical records shall be borne by the requesting person". No dollar amount set.
Goes beyond the federal floor: no.
Availability of medical records. HRS 622-57
In force · effective · read October 3, 2026 · source(data.capitol.hawaii.gov)
Reasonable costs incurred by a health care provider in making copies of medical records shall be borne by the requesting person
Who it binds, in our words: a health care provider as defined in section 671-1
Availability of medical records (copies to patient's attorney). HRS 622-57(b)
In force · effective · read October 3, 2026 · source(data.capitol.hawaii.gov)
complete and accurate copies of the records shall be given to the attorney within a reasonable time not to exceed ten working days
Who it binds, in our words: If an attorney for a patient asks a health care provider for copies of the patient's medical records and presents a proper authorization from the patient
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No Hawaii statute sets an HIE consent rule. Default is participation; an opt-out form is published. SCR36 SD1 (2014) designates Hawaii HIE. Part 2 records and psychotherapy notes are not exchanged at all.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: Hawaii Health Information Exchange (Hawaii HIE, Health eNet).
Some sensitive records need your consent even where routine records do not.
Hawaii HIE policy HEN-009, Individual Notice and Participation. Hawaii HIE Operational Policy HEN-009, section 4.5
To change participation status, an individual, or his/her personal representative, may request stopping (i.e. to “Opt-Out” of) his/her PHI participation in one or more Health eNet service lines.
Who it binds, in our words: Hawaii HIE Participants exchanging PHI via the Health eNet
Hawaii HIE policy HEN-007, Restricted and Sensitive Health Information. Hawaii HIE Operational Policy HEN-007, section 4.2.1
Data-contributing Participants shall not exchange Restricted Information using any Health eNet service.
Who it binds, in our words: Restricted Information: 42 CFR Part 2 substance use treatment records and psychotherapy notes
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Act 59 (signed 2026-05-29, effective 2026-07-01) rewrote HRS 323J-2. It also requires a signed attestation for some requests. The HRS web page still shows the 2023 text.
Protected health information; use or disclosure, when prohibited; covered entities; written consent (as amended by Act 59, SLH 2026). HRS 323J-2, as amended by Act 59, SLH 2026 (HB1875 HD2 SD2), section 3
No covered entity shall use or disclose protected health information for purposes or activities relating to conducting a civil, criminal, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care services
Who it binds, in our words: "Covered entity" has the same meaning as in title 45 Code of Federal Regulations section 160.103
Disclosures prohibited (Act 2, SLH 2023 text, replaced by Act 59, SLH 2026). HRS 323J-2 (L 2023, c 2)
Repealed or replaced · effective · read October 3, 2026 · source(data.capitol.hawaii.gov)
unless the patient or that patient's conservator, guardian, or other authorized legal representative explicitly consents to the disclosure in writing
Who it binds, in our words: covered entity, as defined in title 45 Code of Federal Regulations section 160.103
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HRS 334-5 sets a confidentiality rule for chapter 334 mental health records and ties permitted disclosures to the HIPAA Privacy Rule. Current text from Act 214, SLH 2014, approved 2014-07-07.
Confidentiality of records. HRS 334-5
In force · effective · read October 3, 2026 · source(data.capitol.hawaii.gov)
shall be kept confidential and shall not be disclosed by any person except as allowed by title 45 Code of Federal Regulations part 164, subpart E
Who it binds, in our words: records made for the purposes of chapter 334 that are maintained, used, or disclosed by health care providers, health plans, and health care clearinghouses
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HRS 325-101 lists permitted releases, including with the person's prior written consent and by court order after in camera review. Latest amendment Act 135, SLH 2010, effective 2010-09-01.
Confidentiality of records and information (HIV infection, ARC, and AIDS). HRS 325-101
In force · effective · read October 3, 2026 · source(data.capitol.hawaii.gov)
This information shall not be released or made public upon subpoena or any other method of discovery
Who it binds, in our words: any state agency, health care provider or facility, physician, osteopathic physician, laboratory, clinic, blood bank, third party payor, or any other agency, individual, or organization in the State
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The rule binds accident and health or sickness insurers. Consent is required for each disclosure and must name each recipient. No general genetic records statute for providers was found.
Genetic information nondiscrimination in accident and health or sickness insurance coverage. HRS 431:10A-118(a)(3)
In force · effective · read October 3, 2026 · source(data.capitol.hawaii.gov)
Disclose an individual's or a family member's genetic information without the written consent of the person affected
Who it binds, in our words: No insurer may; does not apply to life, disability income, and long-term care insurance
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Suits are limited to a security breach (487N-3) and HIV records (325-102). Neither is a general right to sue over medical records. Breach chapter personal information excludes health data. Level 1.
"Level" is the step on our rulebook's scale for this question. 0 means nothing beyond HIPAA. Higher means the law gives you more here.
Damages a court may award: HRS 325-102: $1,000 to $10,000 per wilful violation of HIV records confidentiality, plus court costs and attorney's fees, paid to the person whose records were released. HRS 487N-3(b): actual damages only, plus attorney's fees.
In force · effective · read October 3, 2026 · source(data.capitol.hawaii.gov)
any business that violates any provision of this chapter shall be liable to the injured party in an amount equal to the sum of any actual damages sustained by the injured party as a result of the violation
Who it binds, in our words: No such action may be brought against a government agency.
Civil penalty (HIV records). HRS 325-102
In force · effective · read October 3, 2026 · source(data.capitol.hawaii.gov)
fined not less than $1,000 nor more than $10,000 for each violation plus reasonable court costs and attorney's fees as determined by the court, which penalty and costs shall be paid to the person or persons whose records were released
Who it binds, in our words: Any person or institution who wilfully violates any provision of this part
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Personal information covers SSN, license or ID number, and financial account data only. Neither medical nor health insurance information is listed. Act 10, SLH 2008 Special Session became law 2008-07-08 by veto override.
Deadline to tell people: without unreasonable delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Definitions (personal information). HRS 487N-1
In force · effective · read October 3, 2026 · source(data.capitol.hawaii.gov)
means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted
Who it binds, in our words: Data elements listed: Social security number; driver's license or Hawaii identification card number; financial account, credit or debit card number, access code, or password
Notice of security breach. HRS 487N-2(a), (f), (g)
In force · effective · read October 3, 2026 · source(data.capitol.hawaii.gov)
Any health plan or healthcare provider that is subject to and in compliance with the standards for privacy or individually identifiable health information
Who it binds, in our words: Office of consumer protection notice applies when a business provides notice to more than one thousand persons at one time
Privacy of individually identifiable health information (breach notice deemed compliance). HRS 323B-3(c)
In force · effective · read October 3, 2026 · source(data.capitol.hawaii.gov)
any notice of breach of unsecured protected health information that complies with 45 Code of Federal Regulations part 164, subpart D, shall be deemed to comply with all state laws relating to notice of breach of protected health information
Who it binds, in our words: HIPAA breach notices of unsecured protected health information
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No. A law is in force, but it has none of the three rules.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Act 248 covers AI companions, not health care or coverage decisions, so no element counts. AI bills on insurer decisions (SB3027, HB2175, HB2537, SB1449) did not pass in 2026.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: not found.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): Act 248, SLH 2026 (new HRS 481B section): an operator shall "Not cause or program an AI companion to make any representation or statement that indicates that the AI companion is designed to provide professional mental or behavioral health care"
Artificial intelligence; AI companion; disclosures; reports; penalties. Act 248, SLH 2026 (SB3001 SD2 HD3 CD1), new section in HRS chapter 481B
Not cause or program an AI companion to make any representation or statement that indicates that the AI companion is designed to provide professional mental or behavioral health care
Who it binds, in our words: operators of AI companions
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
4.1%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
94.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
89.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
7.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$94,814 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
2.2%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
8.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
25.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
11.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
