Health record rights in Montana: what state law adds
In Montana, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a copy of your record within 10 days; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue over misuse of your records; breach notices cover one of medical or health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general. Same answer in 11 of the 50 states, counting this one.
Must you be told if health data leaks in a breach?Partly. The breach notice law covers one of the two: medical information or health insurance information. Same answer in 3 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The MCDPA requires consent to process sensitive data, including health conditions. No dedicated consumer health data law was found. Genetic data and mental health apps have their own consent rules. Effective dates are from the Legislature's 2023 and 2025 effective-date tables.
Montana Consumer Data Privacy Act: data processing by controller, limitations. Mont. Code Ann. 30-14-2812(2)(b)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
process sensitive data concerning a consumer without obtaining the consumer's consent
Who it binds, in our words: 30-14-2803(1)(a): "control or process the personal data of not less than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction"
Montana Consumer Data Privacy Act: definition of sensitive data. Mont. Code Ann. 30-14-2802(28)(a)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, information about a person's sex life, sexual orientation, or citizenship or immigration status;
Who it binds, in our words: Controllers meeting 30-14-2803 thresholds (25,000 consumers, or 15,000 consumers and more than 25% of gross revenue from sale of personal data).
Montana Consumer Data Privacy Act: applicability. Mont. Code Ann. 30-14-2803
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
control or process the personal data of not less than 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data.
Who it binds, in our words: Persons that conduct business in Montana or target products or services to Montana residents.
Genetic Information Privacy Act: consumer genetic or neurotechnology data, consent. Mont. Code Ann. 30-23-104(2)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
obtain initial express consent from a consumer, parent, guardian, or power of attorney for the collection, use, or disclosure of the consumer's genetic or neurotechnology data
Who it binds, in our words: 30-23-102(4): an entity that "offers consumer genetic testing products or services directly to a consumer" or "collects, uses, or analyzes genetic data."
Digital health care information: mental health digital services. Mont. Code Ann. 50-16-546(1)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
A mental health digital service is subject to the disclosure and confidentiality provisions of Title 50, chapter 16, part 5, when handling health care information as defined in 50-16-504 on behalf of an individual.
Who it binds, in our words: A mobile-based application or internet website that collects information on mental health or substance use disorder and markets itself as facilitating those services (50-16-546(3)).
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a deadline of 10 days, shorter than HIPAA's 30.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Beyond the federal floor: a 10-day deadline, shorter than 30 days. No free copy case found. Fees are capped per page. Effective dates for 1999 text use the 1-2-201 October 1 default; Ch. 300, L. 1999 was not opened.
Deadline in the law: 10 days.
Fee rule: 50-16-540: "A reasonable fee for providing health care information may not exceed 50 cents for each page for a paper copy or photocopy. A reasonable fee may include an administrative fee that may not exceed $15 for searching and handling recorded health care information."
Fee rule: 50-16-816 (government providers): "Unless prohibited by federal law, a reasonable fee for providing copies of health care information may not exceed 50 cents for each page for a paper copy or photocopy."
Fee rule: 50-16-541(1)(a): examination is "without charge, during regular business hours"; copies are not free.
Goes beyond the federal floor: yes.
Uniform Health Care Information Act: requirements and procedures for patient's examination and copying. Mont. Code Ann. 50-16-541(1)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
a health care provider, as promptly as required under the circumstances but no later than 10 days after receiving the request, shall:
Who it binds, in our words: Health care providers receiving a written request from a patient. Delay for unusual circumstances may run to "not later than 21 days after receiving the request" (50-16-541(1)(d)).
Uniform Health Care Information Act: reasonable fees allowed. Mont. Code Ann. 50-16-540
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
A reasonable fee for providing health care information may not exceed 50 cents for each page for a paper copy or photocopy.
Who it binds, in our words: Health care providers under Title 50, chapter 16, part 5.
Privacy of electronic health records: release of certain test results. Mont. Code Ann. 50-16-806(2)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
must be disclosed to a patient as part of the patient's electronic health record 72 hours after the results are finalized or when the patient's health care provider directs the release of the results, whichever occurs first:
Who it binds, in our words: Listed results only: malignancy pathology or radiology reports, genetic marker tests, positive HIV tests, hepatitis antigens.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No statute sets HIE consent. Executive Order 14-2019 designates Big Sky Care Connect. Its FAQ offers patient opt-out with an online form. Effective date is page metadata. Sensitive-record handling at the HIE was not determined.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: Big Sky Care Connect.
Big Sky Care Connect FAQ: Can I opt out as a patient?. Big Sky Care Connect patient FAQ (HIE policy)
We encourage you to discuss any potential opt-out requests with your provider regarding the extent to which you do or don’t want your health information shared, and how your provider can accommodate the request.
Who it binds, in our words: Patients of participating Big Sky Care Connect providers. The page links an online opt-out form ("To opt out now, click here").
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
50-20-110(6) requires abortion reports and documents to be treated as confidential medical records. 50-20-308 also lets courts seal records to keep the patient's identity private. Its effective date was not verified.
Reporting of practice of abortion: confidentiality. Mont. Code Ann. 50-20-110(6)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
Names and identities of persons submitting to abortion shall remain confidential among medical and medical support personnel directly involved in the abortion
Who it binds, in our words: Facilities where abortions are performed and reports filed with the department.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
53-21-166 lists the only cases where these records may be disclosed. 50-16-546 applies the health care information disclosure rules to mental health apps and websites.
Mental health commitment and treatment: records to be confidential. Mont. Code Ann. 53-21-166
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
All information obtained and records prepared in the course of providing any services under this part to individuals under any provision of this part are confidential and privileged matter
Who it binds, in our words: Services under Title 53, chapter 21, part 1.
Digital health care information: mental health digital services. Mont. Code Ann. 50-16-546(1)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
A mental health digital service is subject to the disclosure and confidentiality provisions of Title 50, chapter 16, part 5, when handling health care information as defined in 50-16-504 on behalf of an individual.
Who it binds, in our words: Mental health apps and websites as defined in 50-16-546(3).
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure is allowed only as the health care information acts or federal law allow. Unlawful disclosure is a misdemeanor. Ch. 362, L. 2009 has no effective-date section, so October 1, 2009 applies.
AIDS Prevention Act: confidentiality of records. Mont. Code Ann. 50-16-1009(1)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
A person may not disclose or be compelled to disclose the identity of a subject of an HIV diagnostic test or the results of a test in a manner that permits identification of the subject of the test
Who it binds, in our words: Any person.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Separate express consent is required for third-party transfer, secondary use, and sale. Disclosure to government needs valid legal process. SB 163 (2025) added neurotechnology data.
Genetic Information Privacy Act: consent for collection, use, or disclosure. Mont. Code Ann. 30-23-104(2)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
obtain initial express consent from a consumer, parent, guardian, or power of attorney for the collection, use, or disclosure of the consumer's genetic or neurotechnology data
Who it binds, in our words: Entities offering consumer genetic testing or that collect, use, or analyze genetic data (30-23-102(4)).
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The health care information act allows suits for any violation, including unlawful disclosure. The MCDPA and Genetic Information Privacy Act (30-23-106) have no private right. 50-16-553's 2009 date uses the 1-2-201 default.
Damages a court may award: 50-16-553: pecuniary loss, plus up to $5,000 for willful or grossly negligent violations. 50-16-1013 (HIV): $5,000 or actual damages if negligent; $20,000 or actual damages if intentional or reckless.
Uniform Health Care Information Act: civil remedies. Mont. Code Ann. 50-16-553(1)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
A person aggrieved by a violation of this part may maintain an action for relief as provided in this section.
Who it binds, in our words: Violations of Title 50, chapter 16, part 5, including disclosure without authorization. Also reaches mental health digital services (50-16-546(2)).
AIDS Prevention Act: civil remedy. Mont. Code Ann. 50-16-1013(1)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
A person aggrieved by a violation of this part has a right of action in the district court and may recover for each violation:
Who it binds, in our words: Violations of Title 50, chapter 16, part 10.
Montana Consumer Data Privacy Act: enforcement. Mont. Code Ann. 30-14-2817(5)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
Nothing in this part may be construed as providing the basis for or be subject to a private right of action for violations of this part or any other law.
Who it binds, in our words: MCDPA only. Attorney general enforcement.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Partly. The breach notice law covers one of the two: medical information or health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Medical information is in the definition. Health insurance information, such as a policy or subscriber number, is not listed. No HIPAA deemed-compliance clause.
Deadline to tell people: without unreasonable delay.
The attorney general or a regulator must also be told.
Computer security breach. Mont. Code Ann. 30-14-1704(4)(b)(i)(D)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
medical record information as defined in 33-19-104 ;
Who it binds, in our words: "Any person or business that conducts business in Montana and that owns or licenses computerized data that includes personal information"
Computer security breach: notice to attorney general. Mont. Code Ann. 30-14-1704(8)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
shall simultaneously submit an electronic copy of the notification and a statement providing the date and method of distribution of the notification to the attorney general's consumer protection office
Who it binds, in our words: Any person or business required to notify under 30-14-1704.
Insurance Information and Privacy Protection: definition of medical record information. Mont. Code Ann. 33-19-104(19)
In force · effective · read October 3, 2026 · source(mca.legmt.gov)
relates to an individual's physical or mental condition, medical history, medical claims history, or medical treatment; and
Who it binds, in our words: Definition cross-referenced by 30-14-1704.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
2-21-103 and 2-21-104 (2025) require AI disclosure and human review for government entities only. They do not name health care or coverage, so they do not count. HB 556 (2025) did not pass.
How we searched (October 3, 2026): the official code search for site:mca.legmt.gov "artificial intelligence", site:mca.legmt.gov algorithm OR "automated decision" health insurer utilization review, Montana 2025 law artificial intelligence health insurance utilization review. Agency pages checked: csimt.gov, mca.legmt.gov.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
11.1%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
92.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
86.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
7.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$66,341 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.6%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
4.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
4.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
13.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
