Health record rights in Louisiana: what state law adds
In Louisiana, as of October 3, 2026, a law on health data held outside HIPAA is signed but not yet in force (it takes effect January 1, 2027); you get a copy of your record within 15 days; we found no law on the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices need not cover medical or health insurance information; and no rule we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Also signed, not yet in force: Louisiana Data Privacy Act; enforcement (January 1, 2027). Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Signed, not yet in force Not yet. A law is signed and takes effect January 1, 2027. Until then, none is in force.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Act 502 of 2026 requires consent to process sensitive data, including health diagnosis. It takes effect 2027-01-01, so it earns nothing yet. No in-force Louisiana law found that requires consent for non-HIPAA health data.
Louisiana Data Privacy Act, consent for sensitive data. Acts 2026, No. 502 (SB 386), enacting R.S. 51:1780.1 through 1780.5
Signed, not yet in force · effective · read October 3, 2026 · source(legis.la.gov)
Process the sensitive data of a consumer without obtaining the
Who it binds, in our words: Has annual gross revenues in excess of twenty-five million dollars.
Louisiana Data Privacy Act, definition of sensitive data. Acts 2026, No. 502, R.S. 51:1780.1(29)
Signed, not yet in force · effective · read October 3, 2026 · source(legis.la.gov)
mental or physical health diagnosis, sexuality, or citizenship or immigration
Who it binds, in our words: Also applies to an entity that annually buys, receives, sells or shares personal information of 75,000 or more consumers, households, or devices, or derives 50 percent or more of revenue from selling it. HIPAA covered entities and business associates are excluded.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a deadline of 15 days, shorter than HIPAA's 30.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both statutes set a 15-day limit, enforced by fee-shifting after certified notice. No required free copy found; R.S. 40:1165.1(C)(2) only permits a waiver. Per-page fees above HIPAA cost-based fees do not count.
Deadline in the law: 15 days.
Fee rule: R.S. 40:1165.1(A)(2)(b)(i), paper records: "not to exceed one dollar per page for the first twenty-five pages, fifty cents per page for twenty-six to three hundred fifty pages, and twenty-five cents per page thereafter"
Fee rule: R.S. 40:1165.1(A)(2)(b)(i), handling: "a handling charge not to exceed twenty-five dollars for hospitals, nursing homes, and other health care providers, and actual postage"
Fee rule: R.S. 40:1165.1(A)(2)(b)(i), digital records: "the charges for providing digital copies shall not exceed one hundred dollars, plus all postage charges actually incurred"
Fee rule: R.S. 40:1165.1(C)(2), optional only: providers giving records to a nonprofit assisting with Social Security or Medicaid applications "may waive or charge an amount less than the maximum charges"
Fee rule: R.S. 46:18(A), Social Security disability claims: "Cost of each photocopy shall not exceed fifty cents per page for the first five pages and twenty-five cents for each additional page"
Goes beyond the federal floor: yes.
Healthcare information; records (15-day limit). La. R.S. 40:1165.1(A)(2)(c)
In force · effective · current version date not confirmed · read October 3, 2026 · source(legis.la.gov)
If a copy of the record is not provided within a reasonable period of time, not to exceed fifteen days following the receipt of the request and written authorization, and production of the record is obtained through a court order or subpoena duces tecum
Who it binds, in our words: Health care providers as defined in R.S. 40:1231.1, state health care providers, and clinical laboratories or medical facilities.
Health care records; copies for Social Security disability claims. La. R.S. 46:18
In force · effective · read October 3, 2026 · source(legis.la.gov)
If a copy of the record is not provided within a reasonable period of time, not to exceed fifteen days following the receipt of the request and written authorization, and production of the record is obtained through a court order or subpoena duces tecum
Who it binds, in our words: The provider of health care, for records needed for social security disability or supplemental security income claims.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
R.S. 40:1165.2 creates an advisory collaborative but sets no consent rule. No current state page designating an HIE and no published HIE consent policy found. The Quality Forum HIE page states no patient choice policy.
How we searched (October 3, 2026): the official code search for health information exchange consent, health information exchange, LaHIE, opt out health information exchange. Agency pages checked: legis.la.gov, ldh.la.gov, lhcqf.org.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The rule covers individual abortion reports sent to the health department, not the full patient chart. Latest amendment is Acts 2022, No. 545, Section 3, effective on the default date.
Abortion reports. La. R.S. 40:1061.21(A)
In force · effective · read October 3, 2026 · source(legis.la.gov)
An individual abortion report for each abortion performed or induced shall be completed by the attending physician. The report shall be confidential and shall not contain the name or address of the woman.
Who it binds, in our words: Attending physicians filing reports with the Louisiana Department of Health.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
R.S. 37:2363 limits disclosure of psychologist records in legal proceedings. Title 28 (R.S. 28:171) lists patient rights but its text has no records confidentiality clause.
In force · effective · read October 3, 2026 · source(legis.la.gov)
a patient or client or his legal representative may refuse to disclose or prevent the disclosure of confidential information, including information contained in administrative records, communicated to a psychologist, a licensed psychological associate, or a licensed specialist in school psychology
Who it binds, in our words: Judicial, legislative and administrative proceedings; information given for diagnosis, evaluation, or treatment of any mental or emotional condition or disorder.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
R.S. 40:1171.4 also bars release under a general authorization that refuses HIV results. R.S. 40:1171.5 allows court-ordered disclosure only on stated grounds, with sealed filings.
Confidentiality of HIV test result; disclosure. La. R.S. 40:1171.4(D)
In force · effective · read October 3, 2026 · source(legis.la.gov)
No person to whom confidential HIV test results have been disclosed pursuant to this Subpart shall disclose the information to another person except as authorized by this Subpart
Who it binds, in our words: Any person who receives confidential HIV test results.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
R.S. 22:1023 requires written consent to obtain genetic information, a signed authorization to disclose it, and authorization to retain it. Latest amendment Acts 2016, No. 58.
In force · effective · read October 3, 2026 · source(legis.la.gov)
No insurer shall obtain genetic information from an insured or enrollee, or from their DNA sample, without first obtaining written informed consent from the insured, enrollee, or their representative.
Who it binds, in our words: Insurers; disclosure authorizations must be written, signed and dated under R.S. 22:1023(C)(2).
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Private suits exist for genetic information and for late breach notice. No general private action for unlawful disclosure of medical records found. Act 502, pending for 2027, excludes private actions.
Damages a court may award: Genetic: greater of actual damages or $50,000 per violation, treble damages if profit, plus costs and attorney fees (R.S. 22:1023(F)). Breach: actual damages only (R.S. 51:3075). Copy rule: $500 civil penalty per violation payable to requestor (R.S. 40:1165.1).
In force · effective · read October 3, 2026 · source(legis.la.gov)
Any person who through negligence collects, stores, or analyzes a DNA sample in violation of this Section, or discloses genetic information in violation of this Section, shall be liable to the individual for each such violation
Who it binds, in our words: Any person violating R.S. 22:1023.
In force · effective · read October 3, 2026 · source(legis.la.gov)
A civil action may be instituted to recover actual damages resulting from the failure to disclose in a timely manner to a person that there has been a breach of the security system resulting in the disclosure of a person's personal information.
Who it binds, in our words: Persons and agencies subject to R.S. 51:3074.
Signed, not yet in force · effective · read October 3, 2026 · source(legis.la.gov)
Consumer Protection Law, R.S. 51:1401 et seq., excluding private rights of
Who it binds, in our words: Controllers covered by the Louisiana Data Privacy Act.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The definition omits medical and health insurance information. AG notice within 10 days of resident notice, per rule published in the Louisiana Register, March 20, 2007. Only a financial institution deemed-compliance clause; none for HIPAA.
Deadline to tell people: Most expedient time possible and without unreasonable delay, not later than 60 days from discovery.
The attorney general or a regulator must also be told.
In force · effective · read October 3, 2026 · source(legis.la.gov)
"Personal information" means the first name or first initial and last name of an individual resident of this state in combination with any one or more of the following data elements, when the name or the data element is not encrypted or redacted:
Who it binds, in our words: Listed elements are SSN, driver's license or state ID, financial account with access code, passport number, and biometric data. No medical or health insurance element.
Notification requirements. La. R.S. 51:3074(E)
In force · effective · read October 3, 2026 · source(legis.la.gov)
shall be made in the most expedient time possible and without unreasonable delay but not later than sixty days from the discovery of the breach
Who it binds, in our words: Any person or agency that owns or licenses computerized data that includes personal information.
Attorney General rule: database security breach notification reporting requirements. LAC 16:III.701 (LR 33:466, March 2007)
In force · effective · read October 3, 2026 · source(ag.louisiana.gov)
Notice to the attorney general shall be timely if received within 10 days of distribution of notice to Louisiana citizens.
Who it binds, in our words: Persons or agencies required to notify Louisiana residents under R.S. 51:3074.
In force · effective · read October 3, 2026 · source(legis.la.gov)
A financial institution that is subject to and in compliance with the Federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice
Who it binds, in our words: Financial institutions only.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No. A law is in force, but it has none of the three rules.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure counted for AI transcription of an appointment or treatment. SB 246 of 2026, on insurer AI use and human review, was withdrawn on 2026-05-28. HB 114 of 2025 stayed in committee.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: not found.
You can reach a human, or have a human review the decision: not found.
In force · effective · read October 3, 2026 · source(legis.la.gov)
A healthcare professional licensed by this Title shall verbally disclose the
Who it binds, in our words: Healthcare professionals licensed under Title 37.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
9.2%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
91.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
83.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
14.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$57,852 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.2%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
8.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
7.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
