Health record rights in New Hampshire: what state law adds
In New Hampshire, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a copy of your record faster than HIPAA requires, and free in some cases; a rule for reproductive health records is signed but not yet in force, while mental health, HIV and genetic records each have one; you can sue only in a narrow case; breach notices need not cover medical or health insurance information; and we found no law on AI in care. One answer is not checked yet (health information exchange). Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
RSA 507-H requires consent to process sensitive data, which includes mental or physical health condition or diagnosis. In force since 1 Jan 2025. No dedicated consumer health data law found.
New Hampshire Privacy Act, controller responsibilities (sensitive data consent). RSA 507-H:6, I(d)
In force · effective · read October 3, 2026 · source(gc.nh.gov)
Not process sensitive data concerning a consumer without obtaining the consumer's consent
Who it binds, in our words: Controlled or processed the personal data of not less than 35,000 unique consumers
New Hampshire Privacy Act, definition of sensitive data. RSA 507-H:1, XXVIII
In force · effective · read October 3, 2026 · source(gc.nh.gov)
Sensitive data" means personal data that includes data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis
Who it binds, in our words: Controllers covered by RSA 507-H:2. Protected health information under HIPAA is exempt (RSA 507-H:3).
New Hampshire Privacy Act, application thresholds. RSA 507-H:2, I
In force · effective · read October 3, 2026 · source(gc.nh.gov)
Controlled or processed the personal data of not less than 35,000 unique consumers
Who it binds, in our words: Controlled or processed the personal data of not less than 35,000 unique consumers; or 10,000 consumers with more than 25 percent of gross revenue from the sale of personal data.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
Yes, both. A deadline shorter than 30 days, and a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both elements rest on provider requests: 14-day free transfer. Late records (over 30 days) are also free. Beyond the HIPAA and Part 171 floor. effectiveDate is the section's latest amendment (2025 ch. 233).
Deadline in the law: 14 days.
Free copy: Request by the patient's health care provider: transfer within 14 days at no cost (RSA 332-I:1, I(f))
Free copy: Records not provided within 30 days of a requestor's request are free (RSA 332-I:1, I(d))
Free copy: Records provided on additional requests after an incomplete copy are free (RSA 332-I:1, I(e))
Fee rule: Requestor, electronic copies: "the cost for electronic copies of the patient's medical records, and all related services, shall be charged at a reasonable rate not to exceed $50.00"
Fee rule: Requestor, paper copies: "shall not exceed $5 for the first page, $.41 per page for pages 2 through 50, and $.30 per page for pages 51 and higher"
Fee rule: Requested redactions: up to $25 per hour of labor
Goes beyond the federal floor: yes.
Medical records; provider-to-provider transfer within 14 days at no cost. RSA 332-I:1, I(f)
In force · effective · read October 3, 2026 · source(gc.nh.gov)
Notwithstanding any other provision of law, when the requestor of medical records is the person's health care provider, the requested transfer must be made within 14 days of the request at no cost
Who it binds, in our words: Health care providers and their third-party records vendors; requests by the patient's health care provider
Medical records; 30-day deadline for requestors, late records free. RSA 332-I:1, I(d)
In force · effective · read October 3, 2026 · source(gc.nh.gov)
any records not provided within 30 days shall be provided at no cost
Who it binds, in our words: a "requestor" means the patient's personal representative, the patient's health care provider, an individual authorized to access the patient's medical record through a valid power of attorney, or the patient's attorney
Medical records; fee caps for requestors. RSA 332-I:1, I(b)
In force · effective · read October 3, 2026 · source(gc.nh.gov)
the cost for electronic copies of the patient's medical records, and all related services, shall be charged at a reasonable rate not to exceed $50.00
Who it binds, in our words: Requests by a requestor as defined in RSA 332-I:1, I(a)
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Not checked We did not finish the research on this question here, so this is not a no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
RSA 332-I:3, VI is kept as a fact only. Its entity (RSA 332-I:1, II(c)) was repealed by 2020, 37:4, XXIII, eff. July 29, 2020.
Set by state law.
Use and disclosure of protected health information; health information exchange. RSA 332-I:3, VI
In force · effective · read October 3, 2026 · source(gc.nh.gov)
An individual shall be given an opportunity to opt out of sharing his or her name and address and his or her protected health care information through the health information organization
Who it binds, in our words: Exchange through the health information organization
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Signed, not yet in force Not yet. A law is signed and takes effect July 1, 2027. Until then, none is in force.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No in-force statute on reproductive records found. SB 551 (2026) was killed in the Senate. RSA 132 holds no records rule. AG and DHHS sites returned HTTP 403.
RSA 329:49-a, II
Signed, not yet in force · effective · read October 3, 2026 · source(gc.nh.gov)
These reports shall not identify the patient or health care provider by name or include other personally identifiable information.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
RSA 330-A:32 gives client communications the status of attorney-client privilege. RSA 135-C:19-a sets consent steps for disclosure to family members.
Mental health practice; privileged communications. RSA 330-A:32
In force · effective · read October 3, 2026 · source(gc.nh.gov)
The confidential relations and communications between any person licensed under provisions of this chapter and such licensee's client are placed on the same basis as those provided by law between attorney and client
Who it binds, in our words: Persons licensed under RSA 330-A and persons under their supervision
Mental health services system; disclosure of certain information. RSA 135-C:19-a, I
In force · effective · read October 3, 2026 · source(gencourt.state.nh.us)
Prior to the disclosure, the mental health center or facility shall request in writing the consent of the client.
Who it binds, in our words: Community mental health centers and state facilities serving seriously or chronically mentally ill clients
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
RSA 141-F:8 limits disclosure of the identity of a person tested for HIV. Written authorization permits disclosure under paragraph III.
HIV testing; confidentiality; release of information. RSA 141-F:8, I
In force · effective · read October 3, 2026 · source(gc.nh.gov)
The identity of a person tested for the human immunodeficiency virus shall not be disclosed except as provided in RSA 141-F:7 and RSA 141-F:8, III, IV and V
Who it binds, in our words: Any person holding the identity of a person tested for HIV
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
RSA 141-H:2 requires prior written and informed consent to disclose that a person had a genetic test or its results.
Genetic testing; disclosure of testing and results. RSA 141-H:2, III
In force · effective · read October 3, 2026 · source(gc.nh.gov)
no person shall disclose to any other person that an individual has undergone genetic testing, and no person shall disclose the results of such testing to any other person, without the prior written and informed consent of the individual
Who it binds, in our words: Any person
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Private actions exist for marketing and fundraising misuse of records, genetic testing, HIV disclosure and data breach. No general action for unlawful use or disclosure of records. RSA 507-H bars private suits.
Damages a court may award: Not less than $1,000 per violation (RSA 332-I:6, RSA 141-H:6). HIV identity disclosure: actual damages plus civil penalty up to $5,000 (RSA 141-F:10). Breach: actual damages, 2 to 3 times if willful (RSA 359-C:21).
Medical records; complaints; right of action (marketing and fundraising). RSA 332-I:6
In force · effective · read October 3, 2026 · source(gc.nh.gov)
An aggrieved individual may bring a civil action under RSA 332-I:4 or RSA 332-I:5 and, if successful, shall be awarded special or general damages of not less than $1,000 for each violation
Who it binds, in our words: Health care providers and business associates; marketing and fundraising uses under RSA 332-I:4 and 332-I:5
Genetic testing; civil action. RSA 141-H:6
In force · effective · read October 3, 2026 · source(gc.nh.gov)
An aggrieved individual may bring a civil action under this chapter and, if successful, shall be awarded special or general damages of not less than $1,000 for each violation
Who it binds, in our words: Violations of RSA 141-H (genetic testing)
HIV testing; civil liability. RSA 141-F:10
In force · effective · read October 3, 2026 · source(gc.nh.gov)
Any person who purposely violates RSA 141-F:7, I or RSA 141-F:8, I and thereby discloses the identity of a person infected by a human immunodeficiency virus shall be liable to such person for actual damages, court costs and attorneys' fees
Who it binds, in our words: Purposeful disclosure of HIV test identity or results
Security breach; violation; private action. RSA 359-C:21, I
In force · effective · read October 3, 2026 · source(gc.nh.gov)
Any person injured by any violation under this subdivision may bring an action for damages and for such equitable relief, including an injunction, as the court deems necessary and proper
Who it binds, in our words: Breach notification duties under RSA 359-C:19 to 359-C:21
New Hampshire Privacy Act; enforcement; no private right of action. RSA 507-H:11, IV
In force · effective · read October 3, 2026 · source(gc.nh.gov)
Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action
Who it binds, in our words: RSA 507-H
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Definition lists SSN, ID numbers and financial account numbers only. Neither medical nor health insurance information is included. RSA 359-C:20, V deems regulated businesses compliant if they follow their regulator's rules; HIPAA is not named.
Deadline to tell people: as quickly as possible.
The attorney general or a regulator must also be told.
In force · effective · read October 3, 2026 · source(gc.nh.gov)
Personal information" means an individual's first name or initial and last name in combination with any one or more of the following data elements
Who it binds, in our words: Elements listed: Social security number; Driver's license number or other government identification number; Account number, credit card number, or debit card number
Notification of security breach required. RSA 359-C:20, I(b)
In force · effective · read October 3, 2026 · source(gc.nh.gov)
The disclosure shall be made to affected individuals as quickly as possible, after the determination required under this section
Who it binds, in our words: Any person doing business in this state who owns or licenses computerized data that includes personal information; All other persons shall notify the New Hampshire attorney general's office
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No AI rule for care or coverage found. RSA 5-D covers state agency AI use and does not name health care. HB 1406 (2026) was killed. Insurance Department page returned HTTP 403.
How we searched (October 3, 2026): the official code search for artificial intelligence, RSA 5-D, RSA 420-J utilization review, algorithm, automated decision, HB 1406, SB 640. Agency pages checked: gc.nh.gov, insurance.nh.gov.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
5.8%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
95.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
91.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
5.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$90,845 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.2%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
4.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
7.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
