Health record rights in New Jersey: what state law adds
In New Jersey, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a free copy of your record in some cases; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices need not cover medical or health insurance information; and we found no law on AI in care. One answer is not checked yet (health information exchange). Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The New Jersey Data Privacy Act requires opt-in consent to process sensitive data, which includes health data. Since 30 June 2026 sale of sensitive data is banned. It is a comprehensive law, not a dedicated consumer health data law.
New Jersey Data Privacy Act: controller duties (consent for sensitive data; no sale of sensitive data). N.J.S.A. 56:8-166.12 (P.L.2023, c.266, s.9, amended P.L.2026, c.25, s.1)
In force · effective · read October 3, 2026 · source(lis.njleg.state.nj.us)
not process sensitive data concerning a consumer without first obtaining the consumer's consent
Who it binds, in our words: Controllers that "control or process the personal data of at least 100,000 consumers, excluding personal data processed solely for the purpose of completing a payment transaction" (N.J.S.A. 56:8-166.5, P.L.2023, c.266, s.2), or 25,000 consumers plus revenue from sale. The sale ban applies "regardless of the number of consumers".
New Jersey Data Privacy Act: definition of sensitive data. N.J.S.A. 56:8-166.4 (P.L.2023, c.266, s.1, amended P.L.2025, c.367, s.2)
In force · effective · read October 3, 2026 · source(lis.njleg.state.nj.us)
"Sensitive data" means personal data revealing racial or ethnic origin; religious beliefs; mental or physical health condition, treatment, or diagnosis
Who it binds, in our words: Definition used by P.L.2023, c.266 (C.56:8-166.4 et seq.).
Data brokers and data collectors: ban on sale of sensitive data. P.L.2026, c.25, s.3 (C.56:8-166.22)
In force · effective · read October 3, 2026 · source(pub.njleg.state.nj.us)
In no case shall a data broker or data collector sell or license sensitive data to any other individual or entity.
Who it binds, in our words: Data brokers and data collectors; excludes protected health information held by a HIPAA covered entity or business associate.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Hospital copies are free for low-income patients and Social Security disability claimants, beyond the HIPAA and 45 CFR 171.302 floor. The 30-day deadline is not shorter than HIPAA. Physician rule N.J.A.C. 13:35-6.5 could not be opened.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Free copy: Hospital records: patient at or below 250 percent of the federal poverty level, or enrolled in SNAP, SSI, Medicaid, NJ FamilyCare, WIC, Work First NJ or similar assistance
Free copy: Hospital records: a not-for-profit corporation representing a patient
Free copy: Hospital records: a health care practitioner
Free copy: Hospital records: an attorney representing a patient pro bono
Free copy: Hospital records: a patient or attorney with a pending application for, or receiving, Social Security disability benefits
Free copy: Hospital billing records: no fee for patient or legally authorized representative
Fee rule: Hospital medical record, patient or representative: "shall not exceed $1 per page or $50 per individual admission record, whichever is less" (N.J.S.A. 26:2H-5n(a)(1)(a))
Fee rule: Patient request under HIPAA: 45 CFR 164.524(b) time and fee rules apply (N.J.S.A. 26:2H-5n(a)(1)(b))
Fee rule: Hospital billing record: "A hospital shall not charge any fee" (N.J.S.A. 26:2H-5n(a)(1)(c))
Fee rule: Authorized third party: no more than $1 per page, $1.50 per microfilm image (N.J.S.A. 26:2H-5n(a)(1)(d))
Fee rule: X-rays and other media: no more than $15 per printed image or $30 per CD or DVD, plus $10 administrative fee (N.J.S.A. 26:2H-5n(a)(1)(e))
In force · effective · read October 3, 2026 · source(lis.njleg.state.nj.us)
The fees authorized by this section shall not be imposed on: (1) A patient who does not have the ability to pay and who presents either: (a) a statement certifying to annual income at or below 250 percent of the federal poverty level
Who it binds, in our words: General, special, or psychiatric hospitals licensed under P.L.1971, c.136 (C.26:2H-1 et seq.).
Hospital patient records: deadline and fee cap. N.J.S.A. 26:2H-5n(a)
In force · effective · read October 3, 2026 · source(lis.njleg.state.nj.us)
the hospital shall provide a legible paper or electronic reproduction of the requested records within the dates requested to the patient, the patient's legally authorized representative, or the authorized third party within 30 days of the request
Who it binds, in our words: General, special, or psychiatric hospitals licensed under P.L.1971, c.136 (C.26:2H-1 et seq.).
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Not checked We did not finish the research on this question here, so this is not a no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No statute sets an HIE consent rule; code search found none. NJII policy states opt-out since 2014 (year only, so date set to 1 January). NJHIN's own site publishes no patient opt-out form; opt-out runs through providers.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: New Jersey Health Information Network (NJHIN), operated by NJII, the State Designated Entity.
In force · effective · read October 3, 2026 · source(njii.com, reached from nj.gov)
it adopted the Opt-Out model of patient consent to participation. The Opt-Out model is one in which the default for all patients is to participate within the HIE and, should a patient elect to Opt-Out, they must request that opportunity.
Who it binds, in our words: Patients whose records are exchanged through NJHIN.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Quoted words appear in both the 2022 text and the 2026 amendment. P.L.2026, c.74 replaced "services" with "activity" and added federal investigations. The official code page still showed the 2022 text on 3 Oct 2026.
Disclosure of reproductive health care information by covered entities in civil, probate, legislative or administrative proceedings. N.J.S.A. 2A:84A-22.18 (P.L.2022, c.51, s.1, amended P.L.2026, c.74, s.3)
In force · effective · read October 3, 2026 · source(lis.njleg.state.nj.us)
shall not disclose, unless the patient or that patient's conservator, guardian, or other authorized legal representative explicitly consents in writing to the disclosure
Who it binds, in our words: HIPAA covered entities, in any civil action or proceeding preliminary thereto or in any probate, legislative or administrative proceeding.
Public entities: no information for interstate investigations into reproductive health care. N.J.S.A. 2A:84A-22.19 (P.L.2022, c.51, s.2, amended P.L.2026, c.74, s.9)
In force · effective · read October 3, 2026 · source(lis.njleg.state.nj.us)
A public entity of this State or employee, appointee, officer or official or any other person acting on behalf of a public entity shall not provide any information
Who it binds, in our words: State and local public entities and persons acting for them.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Records of people served in noncorrectional institutions under Title 30 are confidential. Disclosure needs the person's consent, a court determination, or another listed exception.
Confidentiality of records of persons receiving services in noncorrectional institutions. N.J.S.A. 30:4-24.3 (L.1965, c.59, s.11, amended 2009, c.183, s.4)
In force · effective · read October 3, 2026 · source(lis.njleg.state.nj.us)
directly or indirectly identifying any individual presently or formerly receiving services in a noncorrectional institution under Title 30 of the Revised Statutes, or for whom services in a noncorrectional institution shall be sought under this act shall be kept confidential and shall not be disclosed by any person
Who it binds, in our words: Certificates, applications, records, and reports made under Title 30; disclosure allowed with consent, court direction, and listed exceptions.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Records identifying a person with or suspected of having AIDS or HIV infection may be disclosed only for purposes the act authorizes (N.J.S.A. 26:5C-8 to -13).
Confidentiality of AIDS and HIV infection records. N.J.S.A. 26:5C-7 (L.1989, c.303, s.3)
In force · effective · read October 3, 2026 · source(lis.njleg.state.nj.us)
which contains identifying information about a person who has or is suspected of having AIDS or HIV infection is confidential and shall be disclosed only for the purposes authorized by this act
Who it binds, in our words: The department, local health departments, contractors, health care providers and facilities, laboratories, blood banks, third-party payors, and any other institution or person.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure of genetic test identity or results needs the tested person's signed consent or another of ten listed exceptions, such as a court order or a criminal investigation.
Genetic Privacy Act: conditions for disclosure of genetic information. N.J.S.A. 10:5-47 (L.1996, c.126, s.8)
In force · effective · read October 3, 2026 · source(lis.njleg.state.nj.us)
a person may not disclose or be compelled, by subpoena or any other means, to disclose the identity of an individual upon whom a genetic test has been performed or to disclose genetic information about the individual in a manner that permits identification of the individual
Who it binds, in our words: Any person, regardless of the manner of receipt or the source of genetic information.
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Private suits exist for two narrow record categories: genetic information and HIV records. The Data Privacy Act has no private right. Willful breach-law violations are Consumer Fraud Act violations (N.J.S.A. 56:8-166), which allows suits for ascertainable loss.
Damages a court may award: None fixed. Genetic Privacy Act: all actual damages. HIV records: actual damages, equitable relief, attorney's fees, punitive damages for wanton or malicious conduct; each disclosure a separate offense.
In force · effective · read October 3, 2026 · source(lis.njleg.state.nj.us)
Any person who discloses an individual's genetic information in violation of P.L.1996, c.126, shall be liable to the individual for all actual damages, including damages for economic, bodily, or emotional harm which is proximately caused by the disclosure.
Who it binds, in our words: Any person who discloses genetic information in violation of the act.
AIDS and HIV records: civil actions against violators. N.J.S.A. 26:5C-14 (L.1989, c.303, s.10)
In force · effective · read October 3, 2026 · source(lis.njleg.state.nj.us)
A person who has or is suspected of having AIDS or HIV infection who is aggrieved as a result of a violation of this act may commence a civil action against the individual or institution who committed the violation to obtain appropriate relief
Who it binds, in our words: Individuals or institutions violating the AIDS and HIV records provisions.
New Jersey Data Privacy Act: Attorney General enforcement only. P.L.2023, c.266, s.16
In force · effective · read October 3, 2026 · source(pub.njleg.state.nj.us)
shall be construed as providing the basis for, or subject to, a private right of action for violations of P.L.2023, c.266
Who it binds, in our words: All of P.L.2023, c.266.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Personal information covers SSN, license or ID number, financial account data, and online credentials. Medical and health insurance information are not listed. Notice goes to the State Police first. Only an own-policy deemed-compliance clause exists, not a HIPAA one.
Deadline to tell people: most expedient time possible and without unreasonable delay.
The attorney general or a regulator must also be told.
Definitions relative to security of personal information. N.J.S.A. 56:8-161 (L.2005, c.226, s.10, amended 2019, c.95, s.1)
In force · effective · read October 3, 2026 · source(lis.njleg.state.nj.us)
"Personal information" means an individual's first name or first initial and last name linked with any one or more of the following data elements: (1) Social Security number; (2) driver's license number or State identification card number;
Who it binds, in our words: Businesses that conduct business in New Jersey and public entities.
Disclosure of breach of security; report to State Police. N.J.S.A. 56:8-163 (L.2005, c.226, s.12, amended 2019, c.95, s.2)
In force · effective · read October 3, 2026 · source(lis.njleg.state.nj.us)
in advance of the disclosure to the customer, report the breach of security and any information pertaining to the breach to the Division of State Police in the Department of Law and Public Safety
Who it binds, in our words: Any business or public entity required to disclose a breach.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute hits for AI did not concern health care. P.L.2023, c.296 requires a physician to make prior authorization denials but does not mention AI. DOBI Bulletin 25-03 is guidance only. AI therapy bills remain pending.
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
9.0%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
94.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
90.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
6.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$97,126 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
5.4%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
11.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
32.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
11.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. In force No state deletion mechanism. Registrants must report whether they let individuals direct deletion of personal data.
Data broker and data collector annual registration. P.L.2026, c.25, s.2(c) (C.56:8-166.20)
In force · effective · read October 3, 2026 · source(pub.njleg.state.nj.us)
Each data broker and data collector engaged in selling or licensing personal data of New Jersey consumers shall annually register with the division and pay to the division a registration fee
Who it binds, in our words: Data brokers and data collectors selling or licensing personal data of New Jersey consumers; fees from $5,000 to $1,500,000 by number of consumers.
Public registry of data brokers and data collectors. P.L.2026, c.25, s.2(b) (C.56:8-166.20)
Signed, not yet in force · effective · read October 3, 2026 · source(pub.njleg.state.nj.us)
The Division of Consumer Affairs in the Department of Law and Public Safety shall establish and maintain a public registry of data brokers and data collectors engaged in selling or licensing personal data of New Jersey consumers.
Who it binds, in our words: Subsection b. is inoperative for 270 days after enactment on 30 June 2026.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
