Health record rights in Maine: what state law adds
In Maine, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; copy rights go no further than HIPAA; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue over misuse of your records; breach notices need not cover medical or health insurance information; and two of the three rules we look for on AI in care are in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general. Same answer in 11 of the 50 states, counting this one.
Are there rules for AI used in your care?Two of the three rules are in force. You must be told when AI is used in your care. A licensed clinician decides, not AI alone. Same answer in 6 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No comprehensive privacy law. LD 1822 died on 4/13/2026. The ISP law (one class of non-HIPAA holder) lists the customer's health information as customer personal information and requires express, affirmative consent.
Privacy of broadband Internet access service customer personal information. 35-A M.R.S. §9301, sub-§3
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
A provider may use, disclose, sell or permit access to a customer's customer personal information if the customer gives the provider express, affirmative consent to such use, disclosure, sale or access.
Who it binds, in our words: The requirements of this section apply to providers operating within the State when providing broadband Internet access service to customers that are physically located and billed for service received in the State.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
No. A law is in force, but it adds nothing to HIPAA's terms.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Deadline follows 45 CFR 164.524, so no shorter deadline. No free-copy case found in statute. Per-page caps are facts only. Nothing beyond the HIPAA and information blocking floor.
Fee rule: Practitioners, paper copies: may not exceed $5 for the first page and 45¢ for each additional page, up to $250 (22 M.R.S. §1711-A)
Fee rule: Practitioners, electronic copies: reasonable actual costs, no retrieval fee, may not exceed $150 (22 M.R.S. §1711-A)
Fee rule: Hospitals, paper copies: may not exceed $5 for the first page and 45¢ for each additional page, up to $250; electronic copies capped at $150 (22 M.R.S. §1711)
Goes beyond the federal floor: no.
Release of treatment records to the patient. 22 M.R.S. §1711-B, sub-§2
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
The copies or narrative must be released to the designated person in accordance with the requirements of 45 Code of Federal Regulations, Section 164.524 (2019) or for a health care practitioner not subject to the requirements of 45 Code of Federal Regulations, Section 164.524 (2019) within a reasonable time.
Who it binds, in our words: Health care practitioners as defined in section 1711-B
Fees charged for records. 22 M.R.S. §1711-A
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
The charge for the copies or the report may not exceed $5 for the first page and 45¢ for each additional page, up to a maximum of $250 for the entire treatment record or medical report.
Who it binds, in our words: Whenever a health care practitioner defined in section 1711-B furnishes in paper form requested copies of a patient's treatment record
Patient access to hospital medical records. 22 M.R.S. §1711
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
The charge for paper copies of records may not exceed $5 for the first page and 45¢ for each additional page, up to a maximum of $250 for the entire medical record.
Who it binds, in our words: an institution licensed as a hospital by the State
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute requires an opt-out mechanism, a decline form at first contact, and processing within 2 business days. Mental health and HIV records need the person's opt-in before HIE disclosure, with emergency exceptions.
Set by state law.
Designated exchange: HealthInfoNet.
Some sensitive records need your consent even where routine records do not.
Participation in a state-designated statewide health information exchange. 22 M.R.S. §1711-C, sub-§18, ¶C
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
A state-designated statewide health information exchange to which health care information is disclosed under this section shall provide an individual protection mechanism by which an individual may opt out from participation to prohibit the state-designated statewide health information exchange from disclosing the individual's health care information
Who it binds, in our words: A state-designated statewide health information exchange
Mental health records: opt-in for HIE disclosure. 34-B M.R.S. §1207, sub-§1
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
a state-designated statewide health information exchange that provides and maintains an individual protection mechanism by which a client may choose to opt in to allow the state-designated statewide health information exchange to disclose that client's health care information covered under this section
Who it binds, in our words: Client records covered by 34-B §1207
HIV test results: opt-in for HIE disclosure. 5 M.R.S. §19203
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
To a statewide health information exchange designated by the State that provides and maintains an individual protection mechanism by which an individual may choose to opt in to allow that statewide health information exchange to disclose that individual's health care information covered under this section
Who it binds, in our words: HIV test results covered by 5 §19203
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Added by PL 2023, c. 648 (LD 227). Covers communications about, and examination information relating to, reproductive or gender-affirming health care services. Exceptions include court orders on good cause and some malpractice and licensing matters.
Prohibited disclosure: reproductive and gender-affirming health care information in civil or administrative proceedings. 22 M.R.S. §1711-C, sub-§8, ¶B
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
a health care practitioner, facility or state-designated statewide health information exchange may not disclose any of the following in a civil or administrative action or proceeding or in response to a subpoena issued in a civil or administrative action or proceeding unless authorized in writing by the individual
Who it binds, in our words: Health care practitioners, facilities and the state-designated statewide health information exchange
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Section 1207 makes client records confidential, with listed exceptions such as written consent. The quoted paragraph requires the client's opt-in before HIE disclosure, and excludes psychotherapy notes.
Confidentiality of information (mental health clients). 34-B M.R.S. §1207, sub-§1
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
a state-designated statewide health information exchange that provides and maintains an individual protection mechanism by which a client may choose to opt in to allow the state-designated statewide health information exchange to disclose that client's health care information covered under this section
Who it binds, in our words: Records pertaining to any client covered by 34-B §1207
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure limited to listed recipients, such as the subject and a provider the subject designates (PL 2025, c. 559, effective 2026-07-29, removed 'in writing' and added 5 MRSA §19203-D, sub-§7 on insurance reimbursement). HIE disclosure needs the person's opt-in (PL 2011, c. 347).
Confidentiality of test. 5 M.R.S. §19203
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
No person may disclose the results of an HIV test, except as follows:
Who it binds, in our words: Any person
PL 2025, c. 559 (LD 1970), amending 5 MRSA §19203, sub-§2 and enacting §19203-D, sub-§7
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
This section does not preclude disclosure of information in a medical record for the purpose of seeking insurance reimbursement for HIV testing.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Rule applies to insurers only. Section 2159-C also bars health carriers from requesting, requiring or purchasing genetic information for underwriting.
Use of information obtained through direct-to-consumer genetic testing. 24-A M.R.S. §2159-C, sub-§4
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
an insurer may not request, require, purchase or use information obtained from an entity providing direct-to-consumer genetic testing without the informed written consent of the individual who has been tested.
Who it binds, in our words: Insurers issuing life, credit life, disability, long-term care, accidental injury, specified disease, hospital indemnity or credit accident insurance or an annuity
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Right covers intentional unlawful disclosure of health care information generally. Suit must be brought within 2 years of discovery. AG may also sue.
Damages a court may award: None stated for the individual. Action may seek injunction, costs, and a forfeiture or penalty under ¶C (civil penalty up to $5,000, payable to the State; up to $10,000 or $50,000 for a general business practice). Common law remedies preserved.
Confidentiality of health care information: enforcement. 22 M.R.S. §1711-C, sub-§13, ¶B
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
An individual who is aggrieved by conduct in violation of this section may bring a civil action against a person who has intentionally unlawfully disclosed health care information in the Superior Court in the county in which the individual resides or the disclosure occurred.
Who it binds, in our words: Health care practitioners, facilities and the state-designated statewide health information exchange under 22 §1711-C
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Definition lists no medical or health insurance element. Notice also goes to Department of Professional and Financial Regulation regulators or the Attorney General. §1349(4) deems a person compliant if it follows federal or state breach rules at least as protective as §1348.
Deadline to tell people: As expediently as possible and without unreasonable delay; no more than 30 days after becoming aware of the breach and identifying its scope, absent a law enforcement delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Notice of Risk to Personal Data Act: definitions. 10 M.R.S. §1347, sub-§6
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
"Personal information" means an individual's first name, or first initial, and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:
Who it binds, in our words: Listed elements: Social Security number; driver's license or state ID number; account, credit or debit card number; passwords, PINs or access codes
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
the notices must be made no more than 30 days after the person identified in paragraph A or B becomes aware of a breach of security and identifies its scope
Who it binds, in our words: Information brokers and other persons maintaining computerized personal information
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
Two of the three rules are in force. You must be told when AI is used in your care. A licensed clinician decides, not AI alone.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Applies to mental health therapy only. Written notice of AI use and licensee review of AI treatment recommendations in force from 7/29/2026. AI coverage-denial bills LD 955 and LD 1301 died.
You must be told when AI is used in your care: in force.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): 10 M.R.S. §1500-EE, sub-§2: "A person may not provide, advertise or otherwise offer therapy or psychotherapy services, including through the use of Internet-based artificial intelligence, to the public unless the therapy or psychotherapy services are provided by a licensed professional."
Related limit on AI (recorded, not counted in the answer): 32 M.R.S. §2113, sub-§4 and parallel sections: a licensee may not allow AI to make independent therapeutic decisions or directly interact with clients in therapeutic communication
An Act to Regulate the Use of Artificial Intelligence in Providing Certain Mental Health Services: supplementary support, written notice and consent. PL 2025, c. 687 (LD 2082), §2, enacting 32 M.R.S. §2113, sub-§3 (parallel text in §§2600-G, 3300-J, 3820-A, 6207-D, 7009, 13870)
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
The client or the client's legally authorized representative is informed in writing of the following: (1) That artificial intelligence will be used;
Who it binds, in our words: Licensees who provide therapy or psychotherapy services, when the session is recorded or transcribed
An Act to Regulate the Use of Artificial Intelligence in Providing Certain Mental Health Services: prohibition of use. PL 2025, c. 687 (LD 2082), §2, enacting 32 M.R.S. §2113, sub-§4
In force · effective · read October 3, 2026 · source(legislature.maine.gov)
Generate therapeutic recommendations or treatment plans without review and approval by the licensee.
Who it binds, in our words: Licensees who provide therapy or psychotherapy services
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
7.2%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
92.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
87.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
6.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$68,251 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.3%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
6.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
5.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
14.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
