In Iowa, as of October 3, 2026, you can opt out of some uses of health data held outside HIPAA; you get a free copy of your record in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices need not cover medical or health insurance information; and one of the three rules we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Are there rules for AI used in your care?One of the three rules is in force. A licensed clinician decides, not AI alone. Also signed, not yet in force: Conversational AI services, mental health care (July 1, 2027). Same answer in 12 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Opt-out only. A privacy law treats health data as sensitive, but you have to tell a business to stop.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Chapter 715D lists mental or physical health diagnosis as sensitive data but requires only notice and a chance to opt out. In force 2025-01-01 (2023 Acts ch 17, §10). No dedicated consumer health data law found.
Iowa Consumer Data Protection Act, data controller duties (sensitive data). Iowa Code §715D.4(2)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
A controller shall not process sensitive data collected from a consumer for a nonexempt purpose without the consumer having been presented with clear notice and an opportunity to opt out of such processing
Who it binds, in our words: This chapter applies to a person conducting business in the state or producing products or services that are targeted to consumers who are residents of the state and that during a calendar year does either of the following: a. Controls or processes personal data of at least one hundred thousand consumers.
Iowa Consumer Data Protection Act, scope and exemptions. Iowa Code §715D.2(1)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
a person conducting business in the state or producing products or services that are targeted to consumers who are residents of the state and that during a calendar year does either of the following: a. Controls or processes personal data of at least one hundred thousand consumers.
Who it binds, in our words: Also covers a business that controls or processes personal data of at least 25,000 consumers and derives over 50 percent of gross revenue from the sale of personal data. HIPAA protected health information and health records are exempt.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Deadline is 30 days, not shorter. Free element: one free copy of the complete billing statement, also for a representative or attorney. That goes beyond HIPAA's cost-based fee. Subsection 6 dates from 2008 Acts ch 1191, §83.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Free copy: One copy of the patient's complete billing statement, free except postage or delivery, for the patient, legal representative or attorney (Iowa Code §622.10(6)(b))
Fee rule: "The fee charged for the cost of producing the requested records or images shall be based upon the actual cost of production." (§622.10(6)(a))
Fee rule: For a request covering all records for the period, the charge "shall not exceed the rates established by the workers' compensation commissioner for copies of records in workers' compensation cases" (§622.10(6)(a))
Fee rule: Affidavit of accuracy on request "for an additional fee not to exceed ten dollars" (§622.10(6)(a) and (b))
Goes beyond the federal floor: yes.
Copies of patient records on written request. Iowa Code §622.10(6)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
any provider shall provide copies of the requested records or images to the requester within thirty days of receipt of the written request.
Who it binds, in our words: Any provider, on written request from a patient, a patient's legal representative or attorney, or an adverse party.
Free copy of complete billing statement. Iowa Code §622.10(6)(b)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
is entitled to one copy free of charge of the patient’s complete billing statement, subject only to a charge for the actual costs of postage or delivery charges incurred in providing the statement.
Who it binds, in our words: A patient or a patient's legal representative or a patient's attorney.
Fee for producing records. Iowa Code §622.10(6)(a)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
The fee charged for the cost of producing the requested records or images shall be based upon the actual cost of production.
Who it binds, in our words: Any provider producing records under §622.10(6).
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute gives an opt-out from the record locator service. Section 135D.7(7) exempts participants from state laws stricter than HIPAA, so no stricter state consent rule for sensitive data was found.
Set by state law.
Designated exchange: Iowa Health Information Network; Iowa HHS selected Converge Health Iowa to replace CyncHealth Iowa (transition announced December 2025).
Iowa health information network, patient right to decline exchange. Iowa Code §135D.7(1)(c)(2)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
The designated entity shall provide the means and process by which a patient may decline participation.
Who it binds, in our words: The designated entity administering the Iowa health information network and its record locator service.
Exemption from state laws more restrictive than HIPAA for network participants. Iowa Code §135D.7(7)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
is exempt from any other state law that is more restrictive than HIPAA that would otherwise prevent or hinder the exchange of patient information by the participant.
Who it binds, in our words: A participant authorized by the designated entity to use the record locator service, sharing for treatment, payment, operations, public health or care coordination.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The rule covers termination of pregnancy reports held by the department, not provider medical records. Text from 1997 Acts ch 172. No rule specific to provider reproductive health records was found.
Termination of pregnancy reporting, confidentiality of reports. Iowa Code §144.29A(3)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
Except as specified in subsection 2, reports, information, and records submitted and maintained pursuant to this section are strictly confidential and shall not be released or made public upon subpoena, search warrant, discovery proceedings, or by any other means.
Who it binds, in our words: Termination of pregnancy reports filed by health care providers with the department.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Chapter 228 limits disclosure of mental health information to listed exceptions. Date is 2016 Acts ch 1055, Division I. Current text from 2016 Acts ch 1055, sec 5, effective March 31, 2017.
Mental health information disclosure prohibited, exceptions. Iowa Code §228.2(1)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
a mental health professional, data collector, or employee or agent of a mental health professional, of a data collector, or of or for a mental health facility shall not disclose or permit the disclosure of mental health information.
Who it binds, in our words: Mental health professionals, data collectors and mental health facilities, with exceptions in sections 228.3 to 228.8 and for care coordination.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Section 141A.9 limits release of HIV-related information to listed recipients. Current subsection 1 text dates from 2007 Acts ch 70, §10.
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
is strictly confidential medical information. The information shall not be released, shared with an agency or institution, or made public upon subpoena, search warrant, discovery proceedings, or by any other means except as provided in this chapter.
Who it binds, in our words: Information, reports and records obtained, submitted and maintained under chapter 141A.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Section 729.6 requires written consent to use or transmit genetic information. Section 729.6(4) also requires written authorization before a health insurer releases it. Added by 2010 Acts ch 1153.
Genetic testing, consent to collect, retain, transmit or use genetic information. Iowa Code §729.6(3)(b)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
A person shall not perform genetic testing of an individual or collect, retain, transmit, or use genetic information without the informed and written consent of the individual or the individual’s authorized representative.
Who it binds, in our words: Any person, with exceptions in §729.6(3)(c), including law enforcement identification, newborn screening, parental identity and de-identified research.
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Rights to sue exist for narrow categories: HIV information (141A.11), genetic testing (729.6), and the HIE opt-out (equitable relief only). No general right found for medical records or consumer health data.
Damages a court may award: None set for the person. 141A.11 allows damages; a separate $1,000 civil penalty applies to care providers for intentional or reckless disclosure.
HIV chapter remedies. Iowa Code §141A.11(1)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
A person aggrieved by a violation of this chapter shall have a right of civil action for damages in district court.
Who it binds, in our words: Violations of chapter 141A (HIV-related testing and information).
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
Subsections 2, 3, 5, 6, and 7 of this section may be enforced through a civil action.
Who it binds, in our words: Violations of genetic testing and consent rules in §729.6.
Iowa health information network, civil action for failure to honor opt-out. Iowa Code §135D.7(8)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
A patient aggrieved or adversely affected by the designated entity’s failure to comply with subsection 1, paragraph “c”, may bring a civil action for equitable relief as the court deems appropriate.
Who it binds, in our words: The designated entity's duty to let patients decline exchange.
Iowa Consumer Data Protection Act, no private right of action. Iowa Code §715D.8(4)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations of this chapter or under any other law.
Who it binds, in our words: Chapter 715D; the attorney general has exclusive enforcement authority.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The definition lists no medical or health insurance information. Entities that comply with HIPAA breach rules are exempt from the section.
Deadline to tell people: in the most expeditious manner possible and without unreasonable delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Personal information security breach protection, definition of personal information. Iowa Code §715C.1(11)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
“Personal information” means an individual’s first name or first initial and last name in combination with any one or more of the following data elements that relate to the individual
Who it binds, in our words: Listed elements are SSN, government ID number, financial account or card numbers with access codes, electronic identifiers with access codes, and biometric data.
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
shall give written notice of the breach of security to the director of the consumer protection division of the office of the attorney general within five business days after giving notice of the breach of security to any consumer pursuant to this section.
Who it binds, in our words: Attorney general notice applies when a breach requires notice to more than 500 Iowa residents. Section 715C.2(7)(d) exempts persons subject to and complying with HIPAA and HITECH rules.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
One of the three rules is in force. A licensed clinician decides, not AI alone.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HF 2635 bars AI as the sole basis for denying, delaying or downgrading prior authorization. Signed 2026-05-13, effective 2026-07-01 under Iowa Code 3.7(1). SF 2417 chatbot rules apply 2027-07-01.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): Not yet applicable (applies 2027-07-01), Iowa Code §554J.5: "An operator shall not knowingly and intentionally cause or program a conversational AI service to make a representation or statement that would lead a reasonable individual to believe that the conversational AI service is designed to provide professional psychology or behavioral health services"
Utilization review organizations, use of artificial intelligence in prior authorization. 2026 Iowa Acts ch 1087 (HF 2635), §2, adding Iowa Code §514F.8(2A)
In force · effective · read October 3, 2026 · source(legis.iowa.gov)
a utilization review organization shall not use an artificial intelligence-based algorithm or system as the sole basis for the utilization review organization’s decision to deny, delay, or downgrade the prior authorization request.
Who it binds, in our words: Utilization review organizations, for prior authorization requests for a health care service based on medical necessity.
Conversational AI services, mental health care. 2026 Iowa Acts ch 1068 (SF 2417), §5, Iowa Code §554J.5
Signed, not yet in force · effective · read October 3, 2026 · source(legis.iowa.gov)
An operator shall not knowingly and intentionally cause or program a conversational AI service to make a representation or statement that would lead a reasonable individual to believe that the conversational AI service is designed to provide professional psychology or behavioral health services
Who it binds, in our words: APPLICABILITY. This Act applies July 1, 2027.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
6.4%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
92.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
86.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
9.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$70,571 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.4%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
5.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
8.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
