Health record rights in North Dakota: what state law adds
In North Dakota, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a free copy of your record in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices must cover medical and health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No comprehensive privacy law or consumer health data law found in the Century Code. A 2023 privacy bill, HB 1330, failed in committee per leads. The legislature meets in odd years, so 2025 is the latest session.
N.D. Admin. Code 45-14-01-17
In force · effective · read October 3, 2026 · source(ndlegis.gov)
A licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought to be disclosed.
Who it binds, in our words: insurance licensees; 45-14-01-20 exempts a licensee that complies with the HIPAA privacy rule
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy element met: a free copy to a provider the patient designates for continuing care goes beyond HIPAA, which permits a fee. No deadline shorter than 30 days found. Page fee caps are recorded only.
Free copy: A copy sent to a health care provider designated by the patient, when requested to transfer care for continuation of treatment (NDCC 23-12-14(1))
Fee rule: Paper or fax: no more than $20 for the first 25 pages and $0.75 per page after 25 pages; electronic: $30 for the first 25 pages and $0.25 per page after 25 pages; charge includes administration, retrieval and postage (NDCC 23-12-14(2))
Goes beyond the federal floor: yes.
Copies of medical records and medical bills (free copy for continuation of treatment). N.D. Cent. Code § 23-12-14(1)
In force · effective · read October 3, 2026 · source(ndlegis.gov)
Upon the request of a health care provider's patient or any person authorized by a patient, the provider shall provide a free copy of a patient's health care records to a health care provider designated by the patient or
Who it binds, in our words: "health care provider" means a licensed individual or licensed facility providing health care services
Copies of medical records and medical bills (fee caps). N.D. Cent. Code § 23-12-14(2)
In force · effective · read October 3, 2026 · source(ndlegis.gov)
at a charge of no more than twenty dollars for the first twenty-five pages and seventy-five cents per page after twenty-five pages or in an electronic, digital, or other computerized format at a charge of thirty dollars for the first twenty-five pages and twenty-five cents per page after twenty-five pages
Who it binds, in our words: "health care provider" means a licensed individual or licensed facility providing health care services
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute and NDHIN rule both set opt-out, with a full or emergency-only choice. No category with a stricter consent rule found in the statute or rule.
Set by state law.
Designated exchange: North Dakota Health Information Network (NDHIN), the health information exchange created under NDCC chapter 54-59.
Voluntary participation in the health information organization. N.D. Cent. Code § 23-12-19
In force · effective · read October 3, 2026 · source(ndlegis.gov)
An individual may opt-out of participating in the health information organization by providing notice to the organization.
Who it binds, in our words: "Health information organization" means the health information exchange created under chapter 54-59.
In force · effective · read October 3, 2026 · source(ndlegis.gov)
All individuals are considered to be participating until an individual has made a written decision to opt out of participation in the North Dakota health information network.
Who it binds, in our words: Participants and authorized users of the North Dakota health information network
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Section 14-02.1-07 makes abortion facility and hospital medical records confidential and limits department use to statistics and compliance. Date is from 2023 SB 2150, an emergency measure.
Records required - Reporting of practice of abortion. N.D. Cent. Code § 14-02.1-07(1)(b)
In force · effective · read October 3, 2026 · source(ndlegis.gov)
The medical records of abortion facilities and hospitals in which abortions are performed and all information contained therein must remain confidential and may be used by the department of health and human services only for gathering statistical data and ensuring compliance with the provisions of this chapter.
Who it binds, in our words: Abortion facilities and hospitals in which abortions are performed
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Records under the commitment chapter are confidential. Disclosure is allowed to a court for chapter purposes and as HIPAA permits. Date assumes the August 1, 2011 default for HB 1269.
Confidential records (commitment and treatment). N.D. Cent. Code § 25-03.1-43
In force · effective · read October 3, 2026 · source(ndlegis.gov)
All information and records obtained in the course of an investigation, an evaluation, an examination, or treatment under this chapter and the presence or past presence of a patient in a treatment facility are confidential
Who it binds, in our words: Information and records under chapter 25-03.1 (commitment procedures)
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HIV reports held by the department are confidential and not open to subpoena, with three listed exceptions. A separate chapter limits disclosure of bloodborne pathogen test results.
Confidentiality of reports (HIV). N.D. Cent. Code § 23-07-02.2
In force · effective · read October 3, 2026 · source(ndlegis.gov)
A report required by section 23-07-02.1 and held by the department of health and human services is confidential information. The information may not be disclosed, shared with any agency or institution, or made public, upon subpoena, search warrant, discovery proceedings, or otherwise, except that:
Who it binds, in our words: HIV infection reports held by the department of health and human services
Expanded disclosure of test results prohibited (bloodborne pathogens, including HIV). N.D. Cent. Code § 23-07.5-06
In force · effective · read October 3, 2026 · source(ndlegis.gov)
The results of a test for bloodborne pathogens may be disclosed only to the individual who was tested; to an exposed individual for whom a test was conducted; and to the exposed individual's health care provider as provided by this chapter
Who it binds, in our words: Bloodborne pathogen test results after an exposure; definition names the human immunodeficiency virus
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The only genetic record rule found covers parentage test reports and specimens. No general genetic privacy statute was found in the Century Code.
Confidentiality of genetic testing (parentage). N.D. Cent. Code § 14-20-35
In force · effective · read October 3, 2026 · source(ndlegis.gov)
The report of genetic testing for parentage is confidential. An individual who knowingly releases an identifiable specimen of another individual for any purpose other than that relevant to the proceeding regarding parentage without a court order or the written permission of the individual who furnished the specimen
Who it binds, in our words: Genetic testing for parentage under the Uniform Parentage Act
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Two narrow routes: a suit over bloodborne pathogen test result disclosure, and a breach claim through chapter 51-15. No general private right over medical records or health data found. 23-12-14 has no private remedy.
Damages a court may award: None fixed. 23-07.5-07: actual damages, costs and exemplary damages. 51-15-09: up to three times actual damages if knowing, plus costs and attorney's fees.
In force · effective · read October 3, 2026 · source(ndlegis.gov)
A violation of this chapter is deemed a violation of chapter 51-15. The remedies, duties, prohibitions, and penalties of this chapter are not exclusive and are in addition to all other causes of action, remedies, and penalties under chapter 51-15, or otherwise provided by law.
Who it binds, in our words: Security breach notification duties under chapter 51-30
In force · effective · read October 3, 2026 · source(ndlegis.gov)
this chapter does not bar any claim for relief by any person against any person who has acquired any moneys or property by means of any practice declared to be unlawful in this chapter.
Who it binds, in our words: A person who acquired money or property through a practice unlawful under chapter 51-15
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both medical information and health insurance information are in the definition. The attorney general must be told when a breach exceeds 250 people. HIPAA-regulated entities are deemed compliant.
Deadline to tell people: most expedient time possible and without unreasonable delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Definitions (personal information includes medical and health insurance information). N.D. Cent. Code § 51-30-01(4)(a)
In force · effective · read October 3, 2026 · source(ndlegis.gov)
(7) Medical information; (8) Health insurance information;
Who it binds, in our words: An individual's first name or first initial and last name in combination with the listed data elements, when not encrypted
Notice to attorney general and consumers. N.D. Cent. Code § 51-30-02
In force · effective · read October 3, 2026 · source(ndlegis.gov)
shall disclose to the attorney general by mail or electronic mail any breach of the security system which exceeds two hundred fifty individuals. The disclosure must be made in the most expedient time possible and without unreasonable delay
Who it binds, in our words: Any person that owns or licenses computerized data that includes personal information; attorney general notice when a breach exceeds 250 individuals
In force · effective · read October 3, 2026 · source(ndlegis.gov)
A covered entity, business associate, or subcontractor subject to breach notification requirements under title 45, Code of Federal Regulations, subpart D, part 164, is considered to be in compliance with this chapter.
Who it binds, in our words: HIPAA covered entities, business associates and subcontractors
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Press calls 2025 SB 2280 an AI limit, but the enacted text never mentions AI, algorithms or automation. It requires physician or pharmacist adverse determinations generally. No AI-specific health rule found, so no element is counted.
Personnel qualified to make adverse determinations (prior authorization; does not name AI). N.D. Cent. Code § 26.1-36.12-03
In force · effective · read October 3, 2026 · source(ndlegis.gov)
A prior authorization review organization shall ensure all adverse determinations are made by a licensed physician or licensed pharmacist.
Who it binds, in our words: Prior authorization review organizations
How we searched (October 3, 2026): the official code search for artificial intelligence, algorithm, automated, generative, prior authorization. Agency pages checked: attorneygeneral.nd.gov.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
6.6%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
93.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
85.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
8.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$73,959 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
2.6%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
5.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
6.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
11.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
