Health record rights in Illinois: what state law adds
In Illinois, as of October 3, 2026, we found no law on health data held outside HIPAA; you get a free copy of your record in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices must cover medical and health insurance information; and two of the three rules we look for on AI in care are in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Do you get a copy faster or free in some cases?In one way: a free copy in at least one case. Also signed, not yet in force: Examination of health care records, text after amendment by P.A. 104-598 (January 1, 2027). Same answer in 24 of the 50 states, counting this one.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Also signed, not yet in force: Reproductive Health Records Privacy Act, violations (right to sue electronic health networks) (July 1, 2027). Same answer in 31 of the 50 states, counting this one.
Are there rules for AI used in your care?Two of the three rules are in force. You must be told when AI is used in your care. A licensed clinician decides, not AI alone. Same answer in 6 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No consumer health data law or comprehensive privacy law is in force. HB 3494 was re-referred to House Rules on 2026-04-17. SB 2875 was re-referred to Senate Assignments on 2026-05-22.
How we searched (October 3, 2026): the official code search for consumer health data, health data privacy, privacy, data, health, Protect Health Data Privacy Act, Consumer Data Privacy Act. Agency pages checked: illinoisattorneygeneral.gov, ilga.gov.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy for benefits claims goes beyond HIPAA and Part 171. Deadline is 30 days, not shorter. P.A. 104-598, effective 2027-01-01, only renames one benefit program in subsection (h).
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Free copy: One complete copy free to support a claim for federal veterans' disability benefits
Free copy: One complete copy free to support a claim for Social Security or SSI benefits
Free copy: One complete copy free to support a claim for Aid to the Aged, Blind, or Disabled benefits
Free copy: Updated records free for the same purposes
Free copy: No handling fee for a patient or personal representative obtaining copies under Section 8-2001.5
Fee rule: not to exceed a $20 handling charge for processing the request and the actual postage or shipping charge, if any
Fee rule: for paper copies 75 cents per page for the first through 25th pages
Fee rule: 50 cents per page for pages 26 to 50, 25 cents per page above 50, electronic copies at 50% of the paper rate, rates adjusted under Section 8-2006
Goes beyond the federal floor: yes.
Examination of health care records, free copy for benefits claims. 735 ILCS 5/8-2001(h)
In force · effective · read October 3, 2026 · source(ilga.gov)
Notwithstanding any other provision of the law, a health care facility or health care practitioner shall provide without charge one complete copy of a patient's records if the records are being requested by the patient
Who it binds, in our words: Health care facilities and health care practitioners. Free copy only when records support a veterans' disability, Social Security or SSI, or Aid to the Aged, Blind, or Disabled claim.
Examination of health care records, deadline. 735 ILCS 5/8-2001(e)
In force · effective · read October 3, 2026 · source(ilga.gov)
The requirements of this Section shall be satisfied within 30 days of the receipt of a written request
Who it binds, in our words: Health care facilities and health care practitioners. Extension allowed to no later than 60 days with a written statement of reasons.
Examination of health care records, fees. 735 ILCS 5/8-2001(d), (d-5)
In force · effective · read October 3, 2026 · source(ilga.gov)
The handling fee shall not be collected from the patient or the patient's personal representative who obtains copies of records under Section 8-2001.5.
Who it binds, in our words: Health care facilities and health care practitioners
Examination of health care records, text after amendment by P.A. 104-598. 735 ILCS 5/8-2001(h), as amended by P.A. 104-598
Signed, not yet in force · effective · read October 3, 2026 · source(ilga.gov)
Aid to the Aged, Blind, or Persons with Disabilities benefits
Who it binds, in our words: Health care facilities and health care practitioners
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute gives an opt-out with notice pointing to an HIE website. Mental health records follow the same opt-out under 9.5. P.A. 104-471 adds out-of-state limits for some codes from 2027-07-01.
Set by state law.
Designated exchange: None. The Illinois Health Information Exchange and Technology Act (20 ILCS 3860) is listed as repealed by P.A. 103-508.
Medical Patient Rights Act, HIE opt-out. 410 ILCS 50/3
In force · effective · read October 3, 2026 · source(ilga.gov)
Patients shall be provided the opportunity to opt out of their health information being transmitted to or through a health information exchange in accordance with Section 9.6 of the Mental Health and Developmental Disabilities Confidentiality Act
Who it binds, in our words: Patient information transmitted to or through a health information exchange
Mental Health and Developmental Disabilities Confidentiality Act, HIE opt-out notice. 740 ILCS 110/9.6
In force · effective · read October 3, 2026 · source(ilga.gov)
These rules, standards, or contractual obligations shall provide for written notice of a recipient's right to opt out which directs the recipient to a health information exchange website
Who it binds, in our words: Participants of any HIE. Does not apply to point-to-point transmission directed by the data custodian.
Mental Health and Developmental Disabilities Confidentiality Act, use and disclosure to an HIE. 740 ILCS 110/9.5
In force · effective · read October 3, 2026 · source(ilga.gov)
may, without a recipient's consent, use or disclose information from a recipient's record in connection with an HIE
Who it binds, in our words: Mental health and developmental disability records
Reproductive Health Records Privacy Act, out-of-state disclosure by electronic health networks. P.A. 104-471 (HB 5295), Section 10
Signed, not yet in force · effective · read October 3, 2026 · source(ilga.gov)
An electronic health network shall prevent the disclosure of a patient's coded private health care information to a provider, business entity, other electronic health network, or health information exchange located outside this State unless the disclosure is:
Who it binds, in our words: Electronic health networks, not providers or licensed hospitals. Covers abortion-related and gender dysphoria codes.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Clerks may not issue subpoenas from foreign subpoenas seeking records on lawful reproductive health care. P.A. 104-471 limits out-of-state disclosure by electronic health networks from 2027-07-01.
In force · effective · read October 3, 2026 · source(ilga.gov)
(b) No clerk of court shall issue a subpoena based on a foreign subpoena that: (1) requests information or documents related to lawful health care activity, as defined in the Lawful Health Care Activity Act;
Who it binds, in our words: Foreign subpoenas seeking documents or information related to lawful health care activity
Lawful Health Care Activity Act, definitions. 735 ILCS 40/28-10
In force · effective · read October 3, 2026 · source(ilga.gov)
"Lawful health care" means: (1) reproductive health care that is not unlawful under the laws of this State
Who it binds, in our words: Definition used by 735 ILCS 35/3.5
Reproductive Health Records Privacy Act. P.A. 104-471 (HB 5295), Section 10
Signed, not yet in force · effective · read October 3, 2026 · source(ilga.gov)
An electronic health network shall prevent the disclosure of a patient's coded private health care information to a provider, business entity, other electronic health network, or health information exchange located outside this State unless the disclosure is:
Who it binds, in our words: Electronic health networks. Coded information on abortion-related services and gender dysphoria diagnoses.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Written consent with listed elements is required for disclosure, with exceptions in Sections 6 through 12.2.
Mental Health and Developmental Disabilities Confidentiality Act, disclosure and consent. 740 ILCS 110/5
In force · effective · read October 3, 2026 · source(ilga.gov)
records and communications may be disclosed to someone other than those persons listed in Section 4 of this Act only with the written consent of those persons who are entitled to inspect and copy a recipient's record pursuant to Section 4 of this Act.
Who it binds, in our words: Records and communications of recipients of mental health or developmental disabilities services, subject to Sections 6 through 12.2
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure of HIV-related information is limited to listed persons.
AIDS Confidentiality Act, disclosure. 410 ILCS 305/9
In force · effective · read October 3, 2026 · source(ilga.gov)
No person may disclose or be compelled to disclose HIV-related information, except to the following persons:
Who it binds, in our words: Any person holding HIV-related information
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Release only to the person tested or persons they authorize in writing. P.A. 104-642 adds biomarker testing from 2027-01-01.
Genetic Information Privacy Act, confidentiality. 410 ILCS 513/15(a)
In force · effective · read October 3, 2026 · source(ilga.gov)
genetic testing and information derived from genetic testing is confidential and privileged and may be released only to the individual tested and to persons specifically authorized, in writing in accordance with Section 30, by that individual to receive the information.
Who it binds, in our words: Genetic testing and information derived from it
Genetic Information Privacy Act, confidentiality, text after amendment by P.A. 104-642. 410 ILCS 513/15(a), as amended by P.A. 104-642
Signed, not yet in force · effective · read October 3, 2026 · source(ilga.gov)
biomarker testing, information derived from biomarker testing, genetic testing, and information derived from genetic testing are confidential and privileged
Who it binds, in our words: Adds biomarker testing and information derived from it
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Rights to sue exist for genetic and HIV records. 740 ILCS 110/15 also lets a person sue for mental health records; its page gives no effective date. No general medical records right found.
Damages a court may award: Genetic Information Privacy Act: $2,500 negligent or $15,000 intentional or reckless per violation, or actual damages if greater. AIDS Confidentiality Act: $2,000 negligent or $10,000 intentional or reckless per violation, or actual damages if greater.
Genetic Information Privacy Act, right of action. 410 ILCS 513/40
In force · effective · read October 3, 2026 · source(ilga.gov)
Any person aggrieved by a violation of this Act shall have a right of action in a State circuit court or as a supplemental claim in a federal district court against an offending party.
Who it binds, in our words: Violations of the Genetic Information Privacy Act
AIDS Confidentiality Act, right of action. 410 ILCS 305/13
In force · effective · read October 3, 2026 · source(ilga.gov)
Any person aggrieved by a violation of this Act or of a regulation promulgated hereunder shall have a right of action in the circuit court
Who it binds, in our words: Violations of the AIDS Confidentiality Act
Reproductive Health Records Privacy Act, violations (right to sue electronic health networks). P.A. 104-471, Sec. 20
Signed, not yet in force · effective · read October 3, 2026 · source(ilga.gov)
Any person aggrieved by a violation of this Act by an electronic health network may bring an action against that electronic health network.
Who it binds, in our words: Electronic health networks; the Act bars actions against health care providers
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both medical information and health insurance information are listed data elements. Medical information includes data given to a website or mobile app.
Deadline to tell people: in the most expedient time possible and without unreasonable delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Personal Information Protection Act, definitions. 815 ILCS 530/5
In force · effective · read October 3, 2026 · source(ilga.gov)
(D) Medical information. (E) Health insurance information.
Who it binds, in our words: Data elements in combination with first name or first initial and last name, when not encrypted or redacted
Personal Information Protection Act, notice to Attorney General. 815 ILCS 530/10
In force · effective · read October 3, 2026 · source(ilga.gov)
500 Illinois residents as a result of a single breach of the security system shall provide notice to the Attorney General of the breach
Who it binds, in our words: Data collectors required to notify more than 500 Illinois residents of a single breach
Personal Information Protection Act, HIPAA entities. 815 ILCS 530/50
In force · effective · read October 3, 2026 · source(ilga.gov)
shall be deemed to be in compliance with the provisions of this Act, provided that any covered entity or business associate required to provide notification of a breach to the Secretary of Health and Human Services
Who it binds, in our words: HIPAA covered entities and business associates in compliance with HIPAA and HITECH. They must notify the Attorney General within 5 business days of notifying HHS.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
Two of the three rules are in force. You must be told when AI is used in your care. A licensed clinician decides, not AI alone.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Elements apply only to therapy and psychotherapy. HB 35 and SB 1425 on AI in insurance denials were not enacted; both were re-referred in 2025. No human recourse rule found.
You must be told when AI is used in your care: in force.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): An individual, corporation, or entity may not provide, advertise, or otherwise offer therapy or psychotherapy services, including through the use of Internet-based artificial intelligence, to the public in this State unless the therapy or psychotherapy services are conducted by an individual who is a licensed professional.
Related limit on AI (recorded, not counted in the answer): A licensed professional may not allow artificial intelligence to do any of the following: (1) make independent therapeutic decisions; (2) directly interact with clients in any form of therapeutic communication;
Related limit on AI (recorded, not counted in the answer): (4) detect emotions or mental states.
Wellness and Oversight for Psychological Resources Act, permitted use of artificial intelligence. 225 ILCS 155/15(b)
In force · effective · read October 3, 2026 · source(ilga.gov)
the patient or the patient's legally authorized representative is informed in writing of the following: (A) that artificial intelligence will be used;
Who it binds, in our words: Licensed professionals using AI for supplementary support in therapy or psychotherapy where the session is recorded or transcribed
Wellness and Oversight for Psychological Resources Act, prohibition on unauthorized therapy services. 225 ILCS 155/20(b)(3)
In force · effective · read October 3, 2026 · source(ilga.gov)
(3) generate therapeutic recommendations or treatment plans without review and approval by the licensed professional;
Who it binds, in our words: Licensed professionals providing therapy or psychotherapy services
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
8.1%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
93.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
88.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
8.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$78,433 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.7%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
10.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
23.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
