Health record rights in Missouri: what state law adds
In Missouri, as of October 3, 2026, we found no law on health data held outside HIPAA; copy rights go no further than HIPAA; the health information exchange offers no general choice; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices must cover medical and health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No comprehensive privacy law or consumer health data law found in RSMo. The AG statutory guide to privacy laws lists none. Revisor search is a form postback, so terms were also run through web searches.
How we searched (October 3, 2026): the official code search for consumer health data, consumer data privacy, sensitive data, health data consent, data broker. Agency pages checked: ago.mo.gov.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
No. A law is in force, but it adds nothing to HIPAA's terms.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Deadline is a reasonable time, not under 30 days. No free-copy case found. Fees also allow postage and adjust each February 1 by medical CPI-U. Nothing goes beyond the HIPAA and information blocking floor.
Fee rule: Search and retrieval, in an amount not more than twenty-four dollars and eighty-five cents plus copying in the amount of fifty-seven cents per page for the cost of supplies and labor
Fee rule: at the time of the request or one hundred eight dollars and eighty-eight cents total, whichever is less
Fee rule: Notary fee, not to exceed two dollars, if requested.
Goes beyond the federal floor: no.
Medical records to be released to patient; fees. RSMo 191.227
In force · effective · read October 3, 2026 · source(revisor.mo.gov)
such record shall be furnished within a reasonable time of the receipt of the request therefor and upon payment of a fee as provided in this section.
Who it binds, in our words: All physicians, chiropractors, hospitals, dentists, and other duly licensed practitioners in this state, herein called "providers"
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
No general choice. Sharing through the exchange follows HIPAA's rules, and no state rule or exchange policy offers a general choice.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No HIE consent statute found. No state page found that designates one HIE; search results describe several state-contracted networks. Missouri Health Connection policy was not used because no state designation was shown.
Set by state law.
RSMo 191.237.2
In force · effective · read October 3, 2026 · source(revisor.mo.gov)
A health information organization shall not restrict the exchange of state agency data or standards-based clinical summaries for patients for federal Health Insurance Portability and Accountability Act (HIPAA) allowable uses.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Covers records and reports required under sections 188.010 to 188.085. Litigation over other chapter 188 sections was not reviewed for this cell.
Breach of confidentiality prohibited (abortion records and reports). RSMo 188.070
In force · effective · read October 3, 2026 · source(revisor.mo.gov)
Any physician or other person who fails to maintain the confidentiality of any records or reports required under sections 188.010 to 188.085 is guilty of a misdemeanor
Who it binds, in our words: Any physician or other person
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Records of department-run, funded or licensed mental health facilities and programs are confidential, with listed disclosures.
Mental health records confidential; permitted disclosures. RSMo 630.140
In force · effective · read October 3, 2026 · source(revisor.mo.gov)
in the course of providing services to either voluntary or involuntary patients, residents or clients shall be confidential
Who it binds, in our words: residential facility, mental health program operated, funded or licensed by the department or otherwise, specialized service, or by any mental health facility or mental health program in which people may be civilly detained pursuant to chapter 632
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HIV status and test results may be disclosed only to listed recipients, including on the person's written authorization.
Confidentiality of HIV reports and records. RSMo 191.656
In force · effective · read October 3, 2026 · source(revisor.mo.gov)
concerning an individual's HIV infection status or the results of any individual's HIV testing shall be strictly confidential and shall not be disclosed except to
Who it binds, in our words: any person, or by any agency, department, or political subdivision of the state
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure needs written authorization. Exceptions include statistical data, certain research, legal or regulatory process, and body identification.
Confidentiality of genetic information. RSMo 375.1309
In force · effective · read October 3, 2026 · source(revisor.mo.gov)
shall hold such information as confidential medical records and shall not disclose such genetic information except pursuant to written authorization of the person to whom such information pertains
Who it binds, in our words: Any person who, in the ordinary course of business, practice of a profession or rendering of a service, creates, stores, receives or furnishes genetic information
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Private suit exists for one category, HIV records. Breach law is AG only. Genetic confidentiality (375.1309) is enforced by the insurance director. No general medical records private right found.
Damages a court may award: Greater of actual damages or $1,000 per negligent violation, or $5,000 per willful, intentional or reckless violation, plus costs and attorney fees (RSMo 191.656, HIV records only).
Civil action for violation of HIV confidentiality. RSMo 191.656(6)
In force · effective · read October 3, 2026 · source(revisor.mo.gov)
Any individual aggrieved by a violation of this section or regulations promulgated by the department of health and senior services may bring a civil action for damages
Who it binds, in our words: Violations of HIV status and test result confidentiality
Breach notification enforcement by attorney general. RSMo 407.1500(4)
In force · effective · read October 3, 2026 · source(revisor.mo.gov)
The attorney general shall have exclusive authority to bring an action
Who it binds, in our words: Breach notification law
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both medical and health insurance information are in the definition. AG notice applies above 1,000 consumers. Deemed compliance covers entities regulated by state or federal law; HIPAA is not named.
Deadline to tell people: without unreasonable delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Breach notification: definition of medical information. RSMo 407.1500(1)(6), (1)(9)(e)
In force · effective · read October 3, 2026 · source(revisor.mo.gov)
"Medical information", any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional
Who it binds, in our words: Any person that owns or licenses personal information of residents of Missouri
Breach notification: definition of health insurance information. RSMo 407.1500(1)(5), (1)(9)(f)
In force · effective · read October 3, 2026 · source(revisor.mo.gov)
"Health insurance information", an individual's health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual
Who it binds, in our words: Any person that owns or licenses personal information of residents of Missouri
Breach notification: AG notice above 1,000 consumers. RSMo 407.1500(2)(8)
In force · effective · read October 3, 2026 · source(revisor.mo.gov)
the person shall notify, without unreasonable delay, the attorney general's office
Who it binds, in our words: In the event a person provides notice to more than one thousand consumers at one time
Breach notification: deemed compliance for regulated entities. RSMo 407.1500(3)(2)
In force · effective · read October 3, 2026 · source(revisor.mo.gov)
is deemed to be in compliance with this section if the person notifies affected consumers in accordance with the maintained procedures when a breach occurs
Who it binds, in our words: A person that is regulated by state or federal law and that maintains procedures for a breach pursuant to its primary or functional state or federal regulator
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Truly agreed SB 1019 and HB 2372 (2026) contain no AI terms. Revisor says sections 407.3007 and 1.2045 do not exist. No in-force AI rule for care or coverage found.
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
9.2%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
93.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
86.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
10.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$65,920 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.9%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
6.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
6.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
