In Ohio, as of October 3, 2026, we found no law on health data held outside HIPAA; you get a free copy of your record in some cases; you can opt out of the health information exchange; no specific rule for genetic records is in force, while reproductive health, mental health and HIV records each have one; you can sue only in a narrow case; breach notices need not cover medical or health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The Revised Code search found no comprehensive privacy law or consumer health data law. The AG business guide lists only card, Social Security number and breach laws.
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy for a Social Security disability claim goes beyond the federal floor. The access statute sets no day count, only a reasonable time. The $50 electronic cap is recorded as a fee fact.
Free copy: One free copy to a patient, personal representative or authorized person when the record supports a Social Security Title II or Title XVI claim and the request includes proof the claim was filed (R.C. 3701.741(C)(1)(e)).
Fee rule: Patient or representative: reasonable, cost-based amounts allowed under federal law; per-page charges capped at the (B)(2)(b) and (c) rates (R.C. 3701.741(B)(1)(a)).
Fee rule: Patient or representative, digital or electronically transmitted records: total cost shall not exceed fifty dollars (R.C. 3701.741(B)(1)(b)).
Fee rule: Other requesters: initial fee $16.84 plus $1.11 per page for pages 1 to 10, $0.57 for pages 11 to 50, $0.23 from page 51, $1.87 per page for x-ray, MRI or CAT data, plus postage, adjusted under R.C. 3701.742 (R.C. 3701.741(B)(2)).
Fee rule: Free copy without charge to the Bureau of Workers' Compensation, Industrial Commission, Department of Medicaid or county JFS, and the attorney general (R.C. 3701.741(C)(1)(a) to (d)).
Goes beyond the federal floor: yes.
Fees for providing copies of medical records. Ohio Rev. Code 3701.741(C)(1)(e)
In force · effective · read October 3, 2026 · source(codes.ohio.gov)
A patient, patient's personal representative, or authorized person if the medical record is necessary to support a claim under Title II or Title XVI of the "Social Security Act,"
Who it binds, in our words: "Each health care provider and medical records company shall provide copies of medical records in accordance with this section."
Fees for providing copies of medical records (electronic access cap). Ohio Rev. Code 3701.741(B)(1)(b)
In force · effective · read October 3, 2026 · source(codes.ohio.gov)
the request is for access to digital records or electronically transmitted records, the total cost for that access or for the electronic transmission, and all related services, shall not exceed fifty dollars.
Who it binds, in our words: Requests by the patient, the patient's personal representative, or a person holding a valid power of attorney.
Patient access to medical records. Ohio Rev. Code 3701.74(B)
In force · effective · read October 3, 2026 · source(codes.ohio.gov)
Within a reasonable time after receiving a request that meets the requirements of this division and includes sufficient information to identify the record requested, a health care provider that has the patient's medical records shall permit the patient to examine the record during regular business hours without charge
Who it binds, in our words: "Health care provider" means a hospital, ambulatory care facility, long-term care facility, pharmacy, emergency facility, or health care practitioner.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Exchange proceeds unless the person submits a written request to restrict all records. Minor-consent and federal limits apply under 3798.07(A)(1) and (2); no added state consent rule for adult sensitive categories was found.
Set by state law.
Conditions for disclosure to health information exchange. Ohio Rev. Code 3798.07(A)(3)
In force · effective · read October 3, 2026 · source(codes.ohio.gov)
The covered entity shall restrict disclosure in a manner that is consistent with a written request from the individual or the individual's personal representative to restrict disclosure of all of the individual's protected health information.
Who it binds, in our words: A covered entity when it discloses protected health information to a health information exchange.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The rule covers abortion reports filed with the Department of Health. Division (H) makes postabortion complication reports confidential. No rule on legal process or out-of-state requests for reproductive records was found.
Abortion reports. Ohio Rev. Code 3701.79(C)
In force · effective · read October 3, 2026 · source(codes.ohio.gov)
The attending physician shall complete an individual abortion report for the abortion, by surgical procedure or by abortion-inducing drugs, of each zygote, blastocyte, embryo, or fetus the physician performs. The report shall be confidential and shall not contain the woman's name.
Who it binds, in our words: Attending physicians reporting each abortion to the Department of Health.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure is allowed on the person's consent, by court order, for payment, and in other listed cases.
Confidentiality of mental health records. Ohio Rev. Code 5122.31(A)
In force · effective · read October 3, 2026 · source(codes.ohio.gov)
directly or indirectly identifying a patient or former patient or person whose hospitalization or commitment has been sought under this chapter, shall be kept confidential and shall not be disclosed by any person except
Who it binds, in our words: Certificates, applications, records and reports made for the purpose of Chapter 5122 and R.C. 2945.38 to 2945.402.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Covers identity of persons tested, identifying test results, and AIDS diagnoses. Disclosure is allowed by written release and to listed recipients in 3701.243(B).
Disclosure of HIV test results or diagnosis. Ohio Rev. Code 3701.243(A)
In force · effective · read October 3, 2026 · source(codes.ohio.gov)
no person or agency of state or local government that acquires the information while providing any health care service or while in the employ of a health care facility or health care provider shall disclose or compel another to disclose any of the following
Who it binds, in our words: Persons and government agencies that acquire the information while providing health care or working for a health care facility or provider.
Second check by a separate agent: confirmed.
Genetic records
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Sections 3901.491 and 3901.501 limit insurer and self-insurer inquiry into and use of genetic test results in underwriting. No section on confidentiality or disclosure of genetic records by holders was found.
Genetic screening or testing information - insurers. Ohio Rev. Code 3901.491(B)(2)
In force · effective · read October 3, 2026 · source(codes.ohio.gov)
Inquire, directly or indirectly, into the results of genetic screening or testing or use such information, in whole or in part, to cancel, refuse to issue or renew, limit benefits under, or set premiums for a sickness and accident insurance policy or public employee benefit plan.
Who it binds, in our words: "No insurer or public employee benefit plan shall do either of the following"
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The disclosure right of action covers HIV records only. 3701.74(C) enforces access, not unlawful disclosure. The breach law, 1349.19(I), gives enforcement to the attorney general only.
Damages a court may award: None set. Compensatory damages, equitable relief and reasonable attorney's fees for a knowing HIV disclosure violation (R.C. 3701.244(B)); one-year limit.
Civil action for HIV disclosure violations. Ohio Rev. Code 3701.244(B)
In force · effective · read October 3, 2026 · source(codes.ohio.gov)
may be found liable in a civil action; the action may be brought by any individual injured by the violation. Except as otherwise provided in division (C) or (D) of this section, the court may award compensatory damages and any equitable relief
Who it binds, in our words: A person or government agency that knowingly violates 3701.242(A), 3701.243(A) or 3701.248(E).
Patient access to medical records - civil action. Ohio Rev. Code 3701.74(C)
In force · effective · read October 3, 2026 · source(codes.ohio.gov)
If a health care provider fails to furnish a medical record as required by division (B) of this section, the patient, personal representative, or authorized person who requested the record may bring a civil action to enforce the patient's right of access to the record.
Who it binds, in our words: Health care providers as defined in 3701.74(A)(5).
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Personal information covers Social Security, license and financial account numbers only. Notice goes to consumer reporting agencies when over 1,000 residents are affected, not to the AG. HIPAA covered entities are excluded entirely.
Deadline to tell people: Most expedient time possible, not later than 45 days after discovery.
No duty found to tell the attorney general or a regulator.
A business that follows HIPAA's breach rules is treated as following this law.
In force · effective · read October 3, 2026 · source(codes.ohio.gov)
(i) Social security number; (ii) Driver's license number or state identification card number; (iii) Account number or credit or debit card number, in combination with and linked to any required security code, access code, or password that would permit access to an individual's financial account.
Who it binds, in our words: Any person that owns or licenses computerized data that includes personal information and conducts business in Ohio. "This section does not apply to any person or entity that is a covered entity as defined in 45 C.F.R. 160.103, as amended."
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
SB 315 enacts R.C. 5162.90 and 5164.11, effective 2026-10-06, requiring human review of Medicaid automated tools. They cover provider agreements, overpayments and visit verification, not a person's care or coverage.
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
8.1%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
92.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
87.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
9.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$66,990 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.4%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
7.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
7.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
