Health record rights in Massachusetts: what state law adds
In Massachusetts, as of October 3, 2026, you get a free copy of your record in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue over misuse of your records; and breach notices need not cover medical or health insurance information. Two answers are not checked yet (health data outside HIPAA, AI in care). Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general. Same answer in 11 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Not checked We did not finish the research on this question here, so this is not a no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Data Privacy Act bills S.2619 and H.5479 went to a conference committee on 2026-06-11. No enacted act found in the 2026 session laws list. Code search tool returned an error, so the session laws index was used.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy for benefit claims counts (element b). The 30-day deadline is not shorter than HIPAA. Dates: Acts 2003 c.135 (effective 2004-07-01) set the fee text; Acts 2008 c.305 ss.12-13, an emergency act approved 2008-08-10, last amended s.70. Board of Medicine rules on mass.gov returned HTTP 403.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Free copy: Record requested to support a claim or appeal under the Social Security Act or any federal or state financial needs-based benefit program (c.111 s.70, c.111 s.70E(g), c.112 s.12CC)
Fee rule: c.111 s.70 hospitals and clinics: base charge of not more than $15 per request; not more than $0.50 per page for the first 100 pages; not more than $0.25 per page after 100 pages; may be adjusted by the medical care CPI; extra fee allowed for postage and for a summary if requested
Fee rule: c.112 s.12CC health care providers: reasonable fee as defined in c.111 s.70
Fee rule: No fee for a record requested to support a Social Security Act or needs-based benefit claim or appeal, with reasonable documentation of that purpose
Goes beyond the federal floor: yes.
Records of hospitals or clinics; custody; inspection; copies; fees. Mass. Gen. Laws c.111, s.70
In force · effective · read October 3, 2026 · source(malegislature.gov)
no fee shall be charged to any applicant, beneficiary or individual representing said applicant or beneficiary for furnishing a record if the record is requested for the purpose of supporting a claim or appeal under any provision of the Social Security Act
Who it binds, in our words: Hospitals or clinics subject to licensure by the department of public health or supported in whole or in part by the commonwealth
Health care providers; inspection of records. Mass. Gen. Laws c.112, s.12CC
In force · effective · read October 3, 2026 · source(malegislature.gov)
A health care provider shall furnish a health record requested pursuant to a claim or appeal under any provision of the Social Security Act or any federal or state financial needs-based benefit program within thirty days of the request.
Who it binds, in our words: ''health care provider'' shall mean a person or entity providing medical care or services, including but not limited to, physicians and surgeons, therapists, dentists, nurses, optometrists, chiropractors, psychologists, and podiatrists.
Patients' and residents' rights. Mass. Gen. Laws c.111, s.70E(g)
In force · effective · read October 3, 2026 · source(malegislature.gov)
upon request, to inspect his medical records and to receive a copy thereof in accordance with section seventy, and the fee for said copy shall be determined by the rate of copying expenses
Who it binds, in our words: Patients and residents of facilities as defined in s.70E
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
101 CMR 20.07(3) sets a central opt-out for Mass HIway-sponsored services. Direct messaging needs no patient choice.
Set by a regulation.
Designated exchange: Statewide health information exchange under Mass. Gen. Laws c.118I.
Plan requirements. Mass. Gen. Laws c.118I, s.11
In force · effective · read October 3, 2026 · source(malegislature.gov)
(1) establish a mechanism to allow patients to opt-in to the health information exchange and to opt-out at any time;
Who it binds, in our words: Any plan approved by the executive office and council or the e-Health institute, including every grantee and implementing organization that receives monies funded in whole or in part from the e-Health Institute Fund established in section 6E of chapter 40J or the Massachusetts Health Information Exchange Fund
Mass HIway regulation: centralized opt-out. 101 CMR 20.07(3)
In force · effective · read October 4, 2026 · source(archives.lib.state.ma.us)
Opt-out. The Mass HIway or its designee administers a centralized opt out system. Patients and/or their authorized designees may notify the Mass HIway or its designee directly if they choose to opt-out.
Who it binds, in our words: Mass HIway-sponsored services
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Acts 2025 c.16 approved 2025-08-07, no emergency preamble; the section page dates the amended subsection November 5, 2025. Section 28 sets 2027-07-01 for new s.70I.
Center for Health Information and Analysis; access to health information. Mass. Gen. Laws c.12C, s.12(b), as amended by Acts 2025 c.16, s.3
In force · effective · read October 3, 2026 · source(malegislature.gov)
Except as required by federal law, the center shall not provide access to any data, including de-identified data or any other data that would allow the identification of a patient or provider in response to an out-of-state or federal inquiry or investigation into services constituting legally-protected health care activity
Who it binds, in our words: The Center for Health Information and Analysis
Electronic medical information on abortion, IVF and gender-affirming care (new c.111 s.70I). Acts 2025 c.16, s.12 (inserting Mass. Gen. Laws c.111, s.70I)
Signed, not yet in force · effective · read October 3, 2026 · source(malegislature.gov)
prevent the disclosure, access, transfer, transmission or processing of medical information related to abortion or abortion-related health care services, in vitro fertilization or gender-affirming health care services to persons and entities outside of the commonwealth, absent the express written consent of the patient
Who it binds, in our words: A business that electronically stores or maintains such medical information on behalf of a health care provider, health care insurance plan, pharmaceutical company, pharmacy benefit manager, contractor or employer
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Latest amendment: Acts 2025 c.73, s.41, an emergency law approved 2025-11-25.
Records of department of mental health facilities. Mass. Gen. Laws c.123, s.36
In force · effective · read October 3, 2026 · source(malegislature.gov)
Such records shall be private and not open to public inspection except (1) upon proper judicial order whether or not in connection with pending judicial proceedings
Who it binds, in our words: Records of persons admitted to facilities under the supervision of the department of mental health
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Section rewritten by Acts 2012 c.84, approved 2012-04-27, no emergency preamble; date is the 91st day.
HIV testing; disclosure of results. Mass. Gen. Laws c.111, s.70F
In force · effective · read October 3, 2026 · source(malegislature.gov)
(2) disclose the results of such test to any person other than the subject of the test without first obtaining the subject's written informed consent
Who it binds, in our words: A facility, as defined in section 70E, physician or health care provider
Second check by a separate agent: disputed, then settled by the authors on October 4, 2026.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Inserted by Acts 2000 c.254, approved 2000-08-22. No later amending act found. Date is the 91st day.
Genetic information and reports protected as private information. Mass. Gen. Laws c.111, s.70G
In force · effective · read October 3, 2026 · source(malegislature.gov)
(2) disclose the results of a genetic test to any person other than the subject thereof without first obtaining the informed written consent
Who it binds, in our words: No facility, as defined in section 70E, and no physician or health care provider
Second check by a separate agent: disputed, then settled by the authors on October 4, 2026.
Can you sue if your records are misused?
Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
A patient can sue for breach of the s.70E records confidentiality right. Limited to facility patients. Latest amendment found: Acts 2022 c.144, s.25, in effect 2023-03-01. Breach law c.93H has no private right of action.
Damages a court may award: None stated. Action is brought under c.231 ss.60B to 60E.
Patients' and residents' rights; civil action. Mass. Gen. Laws c.111, s.70E
In force · effective · read October 3, 2026 · source(malegislature.gov)
Any person whose rights under this section are violated may bring, in addition to any other action allowed by law or regulation, a civil action under sections sixty B to sixty E, inclusive, of chapter two hundred and thirty-one
Who it binds, in our words: Patients and residents of facilities as defined in s.70E
Patients' and residents' rights; confidentiality of records. Mass. Gen. Laws c.111, s.70E(b)
In force · effective · read October 3, 2026 · source(malegislature.gov)
(b) to confidentiality of all records and communications to the extent provided by law;
Who it binds, in our words: Patients and residents of facilities as defined in s.70E
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Chapter 93H inserted by Acts 2007 c.82, s.16, approved 2007-08-02; date is the 91st day. Section 3 amended by Acts 2018 c.444, approved 2019-01-10.
Deadline to tell people: as soon as practicable and without unreasonable delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Security breaches; definitions. Mass. Gen. Laws c.93H, s.1
In force · effective · read October 3, 2026 · source(malegislature.gov)
''Personal information'' a resident's first name and last name or first initial and last name in combination with any 1 or more of the following data elements that relate to such resident:
Who it binds, in our words: Data elements listed: (a) Social Security number; (b) driver's license or state ID number; (c) financial account or card number. No medical or health insurance element.
Duty to report known security breach. Mass. Gen. Laws c.93H, s.3(b)
In force · effective · read October 3, 2026 · source(malegislature.gov)
(b) A person or agency that owns or licenses data that includes personal information about a resident of the commonwealth, shall provide notice, as soon as practicable and without unreasonable delay,
Who it binds, in our words: A person or agency that owns or licenses data that includes personal information about a resident; notice goes to the attorney general, the director of consumer affairs and business regulation and the resident
Compliance with federal procedures. Mass. Gen. Laws c.93H, s.5
In force · effective · read October 3, 2026 · source(malegislature.gov)
a person who maintains procedures for responding to a breach of security pursuant to federal laws, rules, regulations, guidance, or guidelines, is deemed to be in compliance with this chapter if the person notifies affected Massachusetts residents in accordance with the maintained or required procedures when a breach occurs
Who it binds, in our words: Persons with federal breach procedures, who must also notify the attorney general and the consumer affairs director
Second check by a separate agent: disputed, then settled by the authors on October 4, 2026.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
Not checked We did not finish the research on this question here, so this is not a no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
S.2632 (AI in health care decision-making) was sent to Senate Ways and Means on 2026-04-02 and is not enacted. No AI act found in the 2026 session laws list.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
3.3%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
94.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
90.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
6.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$96,505 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.7%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
11.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
24.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
