Health record rights in Indiana: what state law adds
In Indiana, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a free copy of your record in some cases; we found no law on the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you cannot sue under these laws; breach notices need not cover medical or health insurance information; and one of the three rules we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?No. Only the attorney general or a regulator can enforce these laws. Same answer in 5 of the 50 states, counting this one.
Are there rules for AI used in your care?One of the three rules is in force. A licensed clinician decides, not AI alone. Same answer in 12 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
IC 24-15, effective 1 January 2026, requires consent to process sensitive data, which includes a health diagnosis by a provider. HIPAA entities are exempt. No dedicated consumer health data law found. Act effective date read from SEA 5 enrolled text.
Indiana Consumer Data Protection Act: controller duties, processing of sensitive data. IC 24-15-4-1(5)
In force · effective · read October 3, 2026 · source(iga.in.gov)
A controller shall not process sensitive data concerning a consumer without obtaining the consumer's consent
Who it binds, in our words: Persons that "controls or processes personal data of at least one hundred thousand (100,000) consumers who are Indiana residents", or 25,000 with over 50% of revenue from sale (IC 24-15-1-1). HIPAA covered entities and business associates are exempt.
Indiana Consumer Data Protection Act: definition of sensitive data. IC 24-15-2-28
In force · effective · read October 3, 2026 · source(iga.in.gov)
a mental or physical health diagnosis made by a health care provider
Who it binds, in our words: Same thresholds as IC 24-15-1-1.
Consumer genetic testing providers: acts requiring consent. IC 24-4-24-9(a)
In force · effective · read October 3, 2026 · source(iga.in.gov)
may not take any of the following actions unless the provider has solicited and received the individual's freely given, specific, informed, and unambiguous consent to the action:
Who it binds, in our words: Consumer genetic testing providers (IC 24-4-24-2). Excludes testing ordered by a health care provider and subject to HIPAA (IC 24-4-24-1(b)).
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free x-ray image copy for the patient or designee goes beyond the HIPAA cost-based fee. The deadline is 30 days plus one 30-day extension, equal to HIPAA. Free digital copy alone would not count under Ruling D-1.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Free copy: Copy of or access to the patient's x-ray image, at no cost, for the patient or designee (IC 16-39-1-2)
Free copy: Digital copy or digital access through an interoperability platform of an electronic health record (IC 16-39-9-2(1))
Fee rule: IC 16-39-9-2: "A provider may not charge a person for: (1) providing a digital copy or digital access through an interoperability platform of an individual's electronic health record; or (2) making and providing paper copies of medical records at an amount greater than the amount set in rules"
Fee rule: Paper copy amounts are set by Department of Insurance rule under IC 16-39-9-4. Rule text not read in this session.
Goes beyond the federal floor: yes.
X-rays: copy or access at no cost. IC 16-39-1-2
In force · effective · read October 3, 2026 · source(iga.in.gov)
a provider shall, at no cost, provide to the patient or the patient's designee: (1) access to; or (2) a copy of; the patient's x-ray image possessed by the provider.
Who it binds, in our words: Any provider holding the patient's x-ray image.
Right of access; deadline for written requests. IC 16-39-1-1(e)
In force · effective · read October 3, 2026 · source(iga.in.gov)
a provider shall provide the health records requested under this section within thirty (30) days after the date the written request is made
Who it binds, in our words: Providers, for all health records except mental health records, communicable disease records and 42 CFR Part 2 records. One 30-day extension is allowed.
Fees for records. IC 16-39-9-2
In force · effective · read October 3, 2026 · source(iga.in.gov)
A provider may not charge a person for: (1) providing a digital copy or digital access through an interoperability platform of an individual's electronic health record; or (2) making and providing paper copies of medical records at an amount greater than the amount set in rules
Who it binds, in our words: Providers.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Searched Titles 4, 12, 16, 24 and 27 indexes. No HIE consent statute found. A state page calls IHIE the state's primary HIE, not designated. No published IHIE patient opt-out policy found. IC 16-39-5-1 allows provider record requests without consent.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
IC 16-34-2-5 bars identifying information of the pregnant woman in the public report built from abortion reports. IC 16-34-2-4(i) makes court records of minor consent waiver proceedings confidential.
Abortion reports: quarterly public report, no identifying information. IC 16-34-2-5(e)
In force · effective · read October 3, 2026 · source(iga.in.gov)
The state department shall ensure that no identifying information of a pregnant woman is contained in the report.
Who it binds, in our words: Department of Health reports compiled from abortion reports filed by health care providers.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Text unchanged since P.L.2-1993, approved 30 April 1993 with no section date, so July 1, 1993 under IC 1-1-3-3. Exceptions are listed in IC 16-39-2, 16-39-3, 16-39-4 and 16-39-5-3.
Mental health records: confidentiality. IC 16-39-2-3
In force · effective · read October 3, 2026 · source(iga.in.gov)
A patient's mental health record is confidential and shall be disclosed only with the consent of the patient unless otherwise provided in the following:
Who it binds, in our words: Mental health records held by providers (IC 16-39-2-1).
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
IC 16-41-6-8 names HIV tests. IC 16-41-8-1 covers listed communicable diseases. IC 16-39-1-1(b) routes communicable disease records to IC 16-41-8-1.
Prenatal HIV tests: results confidential. IC 16-41-6-8(g)
In force · effective · read October 3, 2026 · source(iga.in.gov)
(g) The results of a test performed under section 5 or 6 of this chapter are confidential.
Who it binds, in our words: A physician or advanced practice registered nurse who orders an HIV test for a pregnant woman under IC 16-41-6-5 or 16-41-6-6.
Communicable disease information: confidentiality. IC 16-41-8-1(b)
In force · effective · read October 3, 2026 · source(iga.in.gov)
a person may not disclose or be compelled to disclose medical or epidemiological information involving a communicable disease or other serious disease
Who it binds, in our words: Diseases on the list published under IC 16-41-2-1. Release allowed with written consent of each person identified, among other listed cases.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
IC 24-4-24-9 requires separate consent for third party access. IC 24-4-24-10(b) bars giving data to insurers or employers even with consent. P.L.233-2025 took effect on passage, approved 6 May 2025.
Consumer genetic testing providers: third party access requires consent. IC 24-4-24-9(a)(3)
In force · effective · read October 3, 2026 · source(iga.in.gov)
(3) Subject to section 10(b) of this chapter, provide access by a third party to: (A) the individual's biological material; or (B) data, other than deidentified data, resulting from genetic testing performed on the individual's biological material.
Who it binds, in our words: Consumer genetic testing providers. Excludes testing ordered by a health care provider and subject to HIPAA.
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
No. Only the attorney general or a regulator can enforce these laws.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Indiana's privacy, genetic testing and breach laws give enforcement to the attorney general only. No civil action found in IC 16-39 or IC 16-41-8, which use fines, discipline and misdemeanors.
Damages a court may award: None for individuals. Attorney general civil penalty up to $7,500 per violation under IC 24-15-10-2 and IC 24-4-24-11.
Indiana Consumer Data Protection Act: no private right of action. IC 24-15-10-4
In force · effective · read October 3, 2026 · source(iga.in.gov)
Nothing in this article shall be construed as providing the basis for a private right of action for violations of this article or any other law.
Who it binds, in our words: Controllers and processors under IC 24-15.
Consumer genetic testing providers: enforcement. IC 24-4-24-11(f)
In force · effective · read October 3, 2026 · source(iga.in.gov)
Nothing in this section may be construed as providing the basis for a private right of action for violations of this chapter or any other law.
Who it binds, in our words: Consumer genetic testing providers.
Security breach disclosure: enforcement. IC 24-4.9-4-1(a)
In force · effective · read October 3, 2026 · source(iga.in.gov)
commits a deceptive act that is actionable only by the attorney general under this chapter.
Who it binds, in our words: Persons required to disclose a breach under IC 24-4.9-3.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Personal information covers Social Security, driver's license, state ID, card and account numbers, and adult website data. Medical and health insurance information are not listed.
Deadline to tell people: Without unreasonable delay, not more than 45 days after discovery (IC 24-4.9-3-3).
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Definition of personal information. IC 24-4.9-2-10
In force · effective · read October 3, 2026 · source(iga.in.gov)
one (1) or more of the following data elements that are not encrypted or redacted: (A) A driver's license number. (B) A state identification card number. (C) A credit card number.
Who it binds, in our words: Data base owners doing business in Indiana.
Timing of disclosure. IC 24-4.9-3-3(a)
In force · effective · read October 3, 2026 · source(iga.in.gov)
shall make the disclosure or notification without unreasonable delay, but not more than forty-five (45) days after the discovery of the breach.
Who it binds, in our words: Persons required to disclose under IC 24-4.9-3.
Disclosure of breach to the attorney general. IC 24-4.9-3-1(c)
In force · effective · read October 3, 2026 · source(iga.in.gov)
If a data base owner makes a disclosure described in subsection (a), the data base owner shall also disclose the breach to the attorney general.
Who it binds, in our words: Data base owners.
Own disclosure procedures under federal law, including HIPAA. IC 24-4.9-3-4(d)
In force · effective · read October 3, 2026 · source(iga.in.gov)
(6) the federal Health Insurance Portability and Accountability Act (HIPAA) (P.L. 104-191); is not required to make a disclosure under this chapter
Who it binds, in our words: Data base owners whose HIPAA compliance plan requires notice without unreasonable delay and who follow it.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
One of the three rules is in force. A licensed clinician decides, not AI alone.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Counted: AI may not be the sole basis to downcode a claim. Not counted: 9(c) covers coverage decisions, not care communication or diagnosis, and names no recipient. Provider appeals in 27-1-52-12 are not patient recourse.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): IC 27-1-52-9(b): "A provider may not use an automated: (1) process; (2) system; or (3) tool, including artificial intelligence; to submit a health benefits claim without the review of a provider or other person involved in the development of the claim for submission."
Downcoding: limit on automated process, system or tool. IC 27-1-52-9(a)
In force · effective · read October 3, 2026 · source(iga.in.gov)
as the sole basis to downcode a claim based on medical necessity without the review of the covered individual's medical record by an employee or contractor of the insurer.
Who it binds, in our words: Insurers issuing accident and sickness policies, HMOs, dental PPO insurers and their contractors. Not Medicaid or Medicaid managed care (IC 27-1-52-0.3).
Disclosure of AI use in prior authorization denials and downcoding. IC 27-1-52-9(c)
In force · effective · read October 3, 2026 · source(iga.in.gov)
An insurer must disclose in an easily accessible and readable manner when artificial intelligence is used to: (1) make an adverse determination on a prior authorization request; or (2) downcode a claim.
Who it binds, in our words: Same insurers as IC 27-1-52-9(a).
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
9.0%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
92.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
86.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
10.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$67,173 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.5%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
6.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
9.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
11.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
