Health record rights in Nebraska: what state law adds
In Nebraska, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a free copy of your record in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you cannot sue under these laws; breach notices need not cover medical or health insurance information; and two of the three rules we look for on AI in care are in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?No. Only the attorney general or a regulator can enforce these laws. Same answer in 5 of the 50 states, counting this one.
Are there rules for AI used in your care?Two of the three rules are in force. A licensed clinician decides, not AI alone. You can reach a human, or have a human review the decision. Also signed, not yet in force: Conversational Artificial Intelligence Safety Act (LB525, 2026) (July 1, 2027). Same answer in 6 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
LB1074 (2024) sections 1 to 30 became operative January 1, 2025. Consent is needed to process sensitive data, including a mental or physical health diagnosis. HIPAA entities, nonprofits and state agencies are excluded.
Data Privacy Act; controller may not process sensitive data without consent. Neb. Rev. Stat. 87-1112(2)(d)
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
Process the sensitive data of a consumer without obtaining the consumer's consent, or, in the case of processing the sensitive data of a known child, without processing that data in accordance with the federal Children's Online Privacy Protection Act of 1998
Who it binds, in our words: Is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024
Data Privacy Act; definition of sensitive data. Neb. Rev. Stat. 87-1102(30)
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status;
Who it binds, in our words: Covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, 45 C.F.R. parts 160 and 164
Data Privacy Act; applicability. Neb. Rev. Stat. 87-1103
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
Conducts business in this state or produces a product or service consumed by residents of this state;
Who it binds, in our words: Is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024, except to the extent that section 87-1118 applies to a person described by this subdivision.
Data Privacy Act; small business sale of sensitive data needs consent. Neb. Rev. Stat. 87-1118
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
A person described by subdivision (1)(c) of section 87-1103 shall not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer.
Who it binds, in our words: A person described by subdivision (1)(c) of section 87-1103
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy for Social Security, Medicare, Medicaid and state aid claims or appeals goes beyond HIPAA and 45 CFR 171.302. The 30-day copy deadline equals the federal floor. Inspection within 10 days is not a copy deadline.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Free copy: Records requested by a patient to support an application or appeal for disability or other benefits or assistance under Neb. Rev. Stat. 43-501 to 43-536, the Medical Assistance Act, or Titles II, XVI or XVIII of the Social Security Act (71-8405(1)). The request must include a statement from the administering agency confirming the application or appeal (71-8405(3)).
Fee rule: 71-8404: "a provider may charge no more than twenty dollars as a handling fee and may charge no more than fifty cents per page as a copying fee." Reasonable cost for records not copied on a standard photocopier; labor and materials for X-rays.
Fee rule: 71-8405(2): a provider may charge the 71-8404 fee when a state or federal agency requests the records for the benefits application or appeal.
Goes beyond the federal floor: yes.
Medical records; no fee for records used in a benefits application or appeal. Neb. Rev. Stat. 71-8405(1)
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
A provider shall not charge a fee for medical records requested by a patient for use in supporting an application for disability or other benefits or assistance or an appeal relating to the denial of such benefits or assistance under:
Who it binds, in our words: Providers under 71-8401 to 71-8407; sections do not apply to the release of medical records under the Nebraska Workers' Compensation Act (71-8407).
Medical records; copy within thirty days. Neb. Rev. Stat. 71-8403(2)
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
the provider shall furnish the person making the request a copy of such records not later than thirty days after the written request is received.
Who it binds, in our words: Upon receiving a written request for a copy of the patient's medical records under subsection (1) of this section
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute gives an opt-out and requires the HIE to adopt an opt-out policy. CyncHealth publishes an opt-out form. Facility participation is required by January 1, 2027. Sensitive-category consent rules were not researched.
Set by state law.
Designated exchange: Statewide health information exchange described in 71-2455 (Nebraska Health Information Initiative or successor, operating as CyncHealth).
Population Health Information Act; individual right to opt out of designated HIE. Neb. Rev. Stat. 81-6,125(7)
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
an individual shall have the right to opt out of the designated health information exchange or the sharing of information required under subsections (3) and (4) of this section.
Who it binds, in our words: Such policy shall not apply to mandatory public health reporting requirements.
Statewide health information exchange named. Neb. Rev. Stat. 71-2455
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
in collaboration with the Nebraska Health Information Initiative or any successor public-private statewide health information exchange,
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The rule covers the state abortion reporting form, not the clinical record. The form omits the patient name and is released only on a court order in a civil or criminal proceeding.
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
The abortion reporting form shall not include the name of the person upon whom the abortion was performed. The abortion reporting form shall be confidential and shall not be revealed except upon the order of a court of competent jurisdiction in a civil or criminal proceeding.
Who it binds, in our words: Abortion reporting forms sent by the attending physician to the Department of Health and Human Services
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
38-2136 lists exceptions, including HIPAA-permitted disclosures and the duty to warn. 71-961 lists who may access commitment records. 71-8403 lets a clinician withhold mental health records from the patient.
Mental health practitioners; confidentiality. Neb. Rev. Stat. 38-2136
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
shall disclose any information he or she may have acquired from any person consulting him or her in his or her professional capacity except: (1) With the written consent of the person
Who it binds, in our words: No person who is licensed or certified pursuant to the Mental Health Practice Act
Nebraska Mental Health Commitment Act; subject's records confidential. Neb. Rev. Stat. 71-961
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
All records kept on any subject shall remain confidential except as otherwise provided by law.
Who it binds, in our words: Records kept on any subject under the Nebraska Mental Health Commitment Act
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
29-2290 limits disclosure of court-ordered HIV test results. LB 1199 (2006) had no emergency clause and the session adjourned April 13, 2006. 71-511 also covers infectious disease information, including HIV.
HIV test of convicted sex offender; results available only to listed persons. Neb. Rev. Stat. 29-2290(1)
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
The Department of Correctional Services shall make the results of the test available only to the victim, to the parents or guardian of the victim if the victim is a minor or is mentally incompetent, to the convicted person,
Who it binds, in our words: HIV tests ordered for persons convicted of sexual assault or other offenses involving sexual contact or penetration
HIV test; right to remain anonymous. Neb. Rev. Stat. 71-531(1)
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
A person seeking a human immunodeficiency virus test shall have the right to remain anonymous. If an anonymous test is requested, a health care provider shall confidentially refer such person to a site which provides anonymous testing.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
87-903 also requires separate express consent to transfer genetic data and a court order before disclosure to government. 71-551 requires written consent before a physician orders a predictive genetic test.
Genetic Information Privacy Act; disclosure to insurers and employers. Neb. Rev. Stat. 87-903(2)
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
A direct-to-consumer genetic testing company shall not disclose a consumer's genetic data to any entity offering health insurance, life insurance, or long-term care insurance or to any employer of the consumer without the consumer's written consent.
Who it binds, in our words: Direct-to-consumer genetic testing company
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
No. Only the attorney general or a regulator can enforce these laws.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Data Privacy Act and Genetic Information Privacy Act are enforced by the Attorney General. 87-1125 bars a private action under the Data Privacy Act. The medical records access sections 71-8401 to 71-8407 state no private remedy.
Damages a court may award: None for individuals. Genetic Information Privacy Act: AG civil penalty of $2,500 per violation plus the consumer's actual damages (87-903(3)).
Data Privacy Act; no private right of action. Neb. Rev. Stat. 87-1125
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
The Data Privacy Act shall not be construed as providing a basis for, or being subject to, a private right of action for a violation of the Data Privacy Act or any other law.
Data Privacy Act; Attorney General enforcement. Neb. Rev. Stat. 87-1119
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
The Attorney General has exclusive authority to enforce the Data Privacy Act.
Genetic Information Privacy Act; Attorney General enforcement. Neb. Rev. Stat. 87-903(3)
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
The Attorney General may bring an action to enforce the provisions of the Genetic Information Privacy Act.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Data elements are SSN, license or state ID number, account numbers with codes, electronic ID numbers, biometric data, and online credentials. Neither medical nor health insurance information is listed. The deemed-compliance clause is general and does not name HIPAA.
Deadline to tell people: as soon as possible and without unreasonable delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Breach notification act; definition of personal information. Neb. Rev. Stat. 87-802(5)
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
A Nebraska resident's first name or first initial and last name in combination with any one or more of the following data elements that relate to the resident
Who it binds, in our words: Individual or commercial entity that conducts business in Nebraska and owns or licenses computerized data that includes personal information
Breach notice to resident and Attorney General. Neb. Rev. Stat. 87-803
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
the individual or commercial entity shall also, not later than the time when notice is provided to the Nebraska resident, provide notice of the breach of security of the system to the Attorney General.
Deemed compliance for entities regulated by state or federal law. Neb. Rev. Stat. 87-804(2)
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
that is regulated by state or federal law and that maintains procedures for a breach of the security of the system pursuant to the laws, rules, regulations, guidances, or guidelines established by its primary or functional state or federal regulator is deemed to be in compliance with section 87-803
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
Two of the three rules are in force. A licensed clinician decides, not AI alone. You can reach a human, or have a human review the decision.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
LB77 sections operative January 1, 2026. Clinician decides and human appeal count. AI disclosure to enrollees covers utilization review, not care communication or diagnosis, so it is not counted. LB525 operative July 1, 2027.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: in force.
Related limit on AI (recorded, not counted in the answer): LB525 (2026) sec. 17, operative July 1, 2027: "An operator shall not knowingly and intentionally cause or program a conversational artificial intelligence service to make any representation or statement that explicitly indicates that the conversational artificial intelligence service is designed to provide professional mental or behavioral health care."
Ensuring Transparency in Prior Authorization Act; AI not sole basis of denial. Neb. Rev. Stat. 44-5443(1)
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
An artificial intelligence-based algorithm shall not be the sole basis of a utilization review agent's decision to deny, delay, or modify health care services based, in whole or in part, on medical necessity.
Who it binds, in our words: Utilization review agents for enrollees in a health benefit plan as defined in 44-1303
AI use disclosure in utilization review. Neb. Rev. Stat. 44-5443(2)
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
A utilization review agent shall disclose to the department, to each health care provider in its network, to each enrollee, and on its public website if artificial intelligence-based algorithms are used or will be used in the utilization review process.
Adverse determinations made by a physician. Neb. Rev. Stat. 44-5435(1)
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
A utilization review agent shall ensure that all adverse determinations for prior authorization are made by a physician, except that if the requesting health care provider is not a physician, the adverse determination may be made by a clinical peer of the requesting health care provider.
Appeals of adverse determinations reviewed by a physician. Neb. Rev. Stat. 44-5436
In force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
A utilization review agent shall ensure that all appeals of an adverse determination for prior authorization are reviewed by a physician.
Signed, not yet in force · effective · read October 3, 2026 · source(nebraskalegislature.gov)
An operator shall not knowingly and intentionally cause or program a conversational artificial intelligence service to make any representation or statement that explicitly indicates that the conversational artificial intelligence service is designed to provide professional mental or behavioral health care.
Who it binds, in our words: Operators of conversational artificial intelligence services
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
8.2%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
93.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
88.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
8.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$71,722 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.0%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
5.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
11.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
