Health record rights in Idaho: what state law adds
In Idaho, as of October 3, 2026, we found no law on health data held outside HIPAA; we found no law on faster or free copies; we found no law on the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; we found no law on a right to sue; breach notices need not cover medical or health insurance information; and a law on AI in care is signed but not yet in force (it takes effect July 1, 2027). Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Are there rules for AI used in your care?Signed, not yet in forceNot yet. A law is signed and takes effect July 1, 2027. Until then, none is in force. Same answer in 2 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Idaho Statutes search found no comprehensive privacy law or consumer health data law. The 2025 and 2026 session searches found no enacted bill of that kind.
How we searched (October 3, 2026): the official code search for "consumer health data", "sensitive data", "health data", "data privacy", "personal data", "data broker" (2025 and 2026 regular session databases). Agency pages checked: ag.idaho.gov.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No Idaho statute or rule in force sets a copy deadline or a free copy. Bills S1346 (2022), S1353 and S1395 (2024) and S1087 (2025) were not enacted. Idaho Code 9-420 covers hospital records under subpoena only.
Goes beyond the federal floor: no.
How we searched (October 3, 2026): the official code search for "medical records", "medical records" copy, "health care records", "patient records", "health records", "medical records" (2026 regular session database). Agency pages checked: healthandwelfare.idaho.gov.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No Idaho statute or rule on HIE consent. IHDE's undated FAQ says patients may opt out by form, but no form is linked and its 2022 form URL returns 403. No current state designation page found.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: Idaho Health Data Exchange (named the state designated entity for 2009 federal HIE funding, per Office of Performance Evaluations report, October 2023).
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Rule covers abortion complication reports filed with the department. Subsection (9) bars the department from disclosing report contents in a way that identifies the woman. Last amended by 2019 ch. 50 (H64).
Abortion complication reporting; confidentiality of reports. Idaho Code 39-9504(6)
In force · effective · read October 3, 2026 · source(legislature.idaho.gov)
Reports filed pursuant to this section shall not be deemed public records and shall remain confidential, except that disclosure may be made to law enforcement officials upon an order of a court after application showing good cause.
Who it binds, in our words: Abortion complication reports filed with the department of health and welfare under section 39-9504
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Records may also be disclosed with consent of the person, their mental health attorney in fact or guardian, to carry out the act, or on court direction. Last amended by 2015 ch. 141 (H91).
Hospitalization of mentally ill; disclosure of information. Idaho Code 66-348
In force · effective · read October 3, 2026 · source(legislature.idaho.gov)
All certificates, applications, records, and reports made for the purpose of this act and directly or indirectly identifying a patient or former patient or an individual whose involuntary assessment, detention or commitment is being sought under this act shall be kept subject to disclosure according to
Who it binds, in our words: Records made for the purpose of Idaho's mental health hospitalization and commitment act (Title 66, chapter 3)
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Section 39-610 governs disclosure of HIV and HBV reporting information. Section 39-606 also makes willful disclosure of confidential disease reports without written authorization a misdemeanor. Last amended by 2025 ch. 82 (H91).
Disclosure of HIV and HBV reporting information. Idaho Code 39-610(2)
In force · effective · read October 3, 2026 · source(legislature.idaho.gov)
The significantly exposed person shall not be informed of the name of the infected patient or deceased person.
Who it binds, in our words: Department of health and welfare notices to persons with a significant exposure to a patient with HIV or HBV
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Employers may not access private genetic information for job decisions. Court-ordered disclosure is limited to essential parts and persons. Last amended by 2022 ch. 141 (H598).
Genetic Testing Privacy Act; restrictions on employers. Idaho Code 39-8303(2)(b)
In force · effective · read October 3, 2026 · source(legislature.idaho.gov)
An order compelling the disclosure of private genetic information pursuant to this subsection may be entered only upon a finding that:
Who it binds, in our words: Employers, in connection with hiring, promotion, retention or other related decisions
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Breach law and genetic privacy law are enforced by the primary regulator or attorney general only. No Idaho health records law found that lets a person sue or links a violation to the Consumer Protection Act.
In force · effective · read October 3, 2026 · source(legislature.idaho.gov)
the primary regulator may bring a civil action to enforce compliance with that section and enjoin that agency, individual or commercial entity from further violations.
Who it binds, in our words: Agencies, individuals and commercial entities subject to section 28-51-105
In force · effective · read October 3, 2026 · source(legislature.idaho.gov)
Whenever the attorney general has reason to believe that any employer is engaging, has engaged, or is about to engage in any act in violation of this chapter, the attorney general may bring an action in the name of the state against that employer
Who it binds, in our words: Employers under the Genetic Testing Privacy Act
How we searched (October 3, 2026): the official code search for "private right of action", "medical records", "health records", "genetic information". Agency pages checked: ag.idaho.gov.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The definition lists only SSN, driver's license or ID number, and financial account data. Agencies must notify the attorney general within 24 hours (28-51-105(1)); no regulator notice for commercial entities. Entities following their federal regulator's breach procedures are deemed compliant.
Deadline to tell people: most expedient time possible and without unreasonable delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
In force · effective · read October 3, 2026 · source(legislature.idaho.gov)
"Personal information" means an Idaho resident’s first name or first initial and last name in combination with any one (1) or more of the following data elements that relate to the resident, when either the name or the data elements are not encrypted:
Who it binds, in our words: Listed elements are Social security number; driver's license or Idaho ID number; financial account or card number with access code. No medical or health insurance element.
Disclosure of breach of security of computerized personal information. Idaho Code 28-51-105(1)
In force · effective · read October 3, 2026 · source(legislature.idaho.gov)
Notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement
Who it binds, in our words: A city, county or state agency, individual or a commercial entity that conducts business in Idaho and owns or licenses computerized personal information of Idaho residents
Procedures deemed in compliance with security breach requirements. Idaho Code 28-51-106(2)
In force · effective · read October 3, 2026 · source(legislature.idaho.gov)
An individual or a commercial entity that is regulated by state or federal law and that maintains procedures for a breach of the security of the system pursuant to the laws, rules, regulations, guidances, or guidelines established by its primary or functional state or federal regulator
Who it binds, in our words: Individuals and commercial entities regulated by state or federal law
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
Signed, not yet in force Not yet. A law is signed and takes effect July 1, 2027. Until then, none is in force.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
S1297 is a general chatbot law effective 2027-07-01. Its AI disclosure duty is not tied to health care. Prior authorization bills H611, H841 and H829 (2026) and H127 (2025) were not enacted.
Related limit on AI (recorded, not counted in the answer): An operator shall not knowingly and intentionally cause or program a conversational AI service to make any representation or statement that explicitly indicates that the conversational AI service is designed to provide professional mental or behavioral health care. (S1297, 2026, effective 2027-07-01)
Conversational AI Safety Act; operator requirements. 2026 Idaho Sess. Laws ch. 249 (Senate Bill 1297), new Title 48 chapter, bill section 48-2103(3)
Signed, not yet in force · effective · quote not yet matched word for word to our stored copy of the page · read October 3, 2026 · source(legislature.idaho.gov, reached from legislature.idaho.gov)
An operator shall not knowingly and intentionally cause or program a conversational AI service to make any representation or statement that explicitly indicates that the conversational AI service is designed to provide professional mental or behavioral health care.
Who it binds, in our words: "Operator" means a person who makes available a conversational AI service to the public.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
11.1%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
95.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
89.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
7.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$70,214 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.6%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
3.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
10.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
10.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
