Health record rights in Oklahoma: what state law adds
In Oklahoma, as of October 3, 2026, a law on health data held outside HIPAA is signed but not yet in force (it takes effect January 1, 2027); copy rights go no further than HIPAA; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices need not cover medical or health insurance information; and one of the three rules we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Also signed, not yet in force: Oklahoma Consumer Data Privacy Act (SB 546, 2026), enforcement (January 1, 2027). Same answer in 31 of the 50 states, counting this one.
Are there rules for AI used in your care?One of the three rules is in force. A licensed clinician decides, not AI alone. Same answer in 12 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Signed, not yet in force Not yet. A law is signed and takes effect January 1, 2027. Until then, none is in force.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
SB 546 was approved by the Governor on 2026-03-20 and takes effect 2027-01-01. It requires consent to process sensitive data, including health diagnosis. No in-force Oklahoma law found that requires consent for non-HIPAA health data today.
Oklahoma Consumer Data Privacy Act (SB 546, 2026), controller duties: sensitive data consent. SB 546 (2026) Section 7, to be codified at 75A O.S. Section 306
Signed, not yet in force · effective · read October 3, 2026 · source(oklegislature.gov)
Process the sensitive data of a consumer without obtaining the consumer’s consent or, in the case of processing the sensitive data of a known child, without processing that data in accordance with the Children’s Online Privacy Protection Act of 1998.
Who it binds, in our words: SB 546 Section 15 (75A O.S. Section 314): a controller or processor that "controls or processes personal data of at least one hundred thousand (100,000) consumers, or" 25,000 consumers with over 50% of gross revenue from sale of personal data. Sensitive data includes "personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status,"
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
No. A law is in force, but it adds nothing to HIPAA's terms.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No deadline and no free-copy case found. 76 O.S. 19 sets per-page fees and bars search and retrieval fees. Per-page caps are facts only and do not go beyond HIPAA and 45 CFR 171.302.
Fee rule: 76 O.S. 19(A)(2): "The cost of each copy to such person or to the personal representative, spouse or responsible family member of such person, not including any x-ray or other photograph or image or pathology slide, shall be fifty cents ($0.50) for each page."
Fee rule: 76 O.S. 19(A)(2): providers and business associates "shall produce the records in digital form at the rate of thirty cents ($0.30) per page if:" the request can be met from an EHR, is asked for electronically, and can be delivered electronically.
Fee rule: 76 O.S. 19(A)(2): "In no event shall a charge for the reproduction of electronically stored and delivered medical records pursuant to this paragraph exceed Two Hundred Dollars ($200.00) plus postage or delivery fee."
Fee rule: 76 O.S. 19(A)(2): providers "shall not charge a person who requests their own record a fee for searching, retrieving, reviewing, and preparing medical records of the person."
Fee rule: 76 O.S. 19(A)(2): printed x-ray or image $15.00; image on CD/DVD $20.00; $20.00 base fee for attorneys, insurers and subpoenas; $15.00 for certification.
Goes beyond the federal floor: no.
Access to medical records - Copies. 76 O.S. Section 19
In force · effective · read October 3, 2026 · source(oklegislature.gov)
The cost of each copy to such person or to the personal representative, spouse or responsible family member of such person, not including any x-ray or other photograph or image or pathology slide, shall be fifty cents ($0.50) for each page.
Who it binds, in our words: A patient of "a doctor, hospital or other medical institution"; mental health and substance abuse records excluded and governed by 43A O.S. 1-109.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The statute defers to HIPAA and is silent on patient choice. OHCA states records are included unless the patient opts out by notarized form. 43A O.S. 1-109 requires authorization for substance abuse treatment data, even between providers. OAC 317:30-3-35 exempts 42 CFR Part 2 facilities from reporting.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: MyHealth Access Network (State Designated Entity for OKSHINE).
Some sensitive records need your consent even where routine records do not.
State-designated entity for health information exchange. 63 O.S. Section 1-133
In force · effective · read October 3, 2026 · source(oklegislature.gov)
Patient-specific protected health information shall only be disclosed in compliance with relevant state or federal privacy laws, rules, regulations, or policies including, but not limited to, the Health Insurance Portability and Accountability Act of 1996.
Who it binds, in our words: The state-designated entity and health care providers that report data to it.
OKSHINE FAQs, Oklahoma Health Care Authority (patient opt-out policy). OHCA OKSHINE FAQ page, last modified Sep 22, 2026
In force · effective · read October 3, 2026 · source(oklahoma.gov)
Your information is automatically included in the HIE if your doctor participates. However, you have the option to opt out if you don’t want your health data shared.
Who it binds, in our words: Patients of providers that participate in the HIE run by MyHealth Access Network, the State Designated Entity. Opt-out needs a notarized form.
Confidential and privileged information - disclosure. 43A O.S. 1-109(D), (E)(1)
In force · effective · read October 3, 2026 · source(oklegislature.gov)
Except as otherwise permitted, mental health and alcohol or substance abuse treatment information may not be disclosed without valid patient authorization or a valid court order issued by a court of competent jurisdiction.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Section 1-738.3h limits disclosure of the patient's identity in court actions. Section 1-738k bars the patient's name and address from the abortion report form. A 2021 conditional repeal was itself repealed in 2022.
Identity of woman upon whom abortion performed - Disclosure. 63 O.S. Section 1-738.3h
In force · effective · read October 3, 2026 · source(oklegislature.gov)
In the absence of written consent of the female upon whom an abortion has been performed or attempted, anyone, other than a public official, who brings an action under this act shall do so under a pseudonym.
Who it binds, in our words: Civil actions under the act containing 63 O.S. 1-738.3d to 1-738.3k. Section 1-738k also bars patient-identifying information on the Individual Abortion Form.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Mental health and substance use treatment information is privileged and confidential. Section 1-109(C) lists required elements of a written release. 76 O.S. 19 routes access to these records through this section.
Confidential and privileged information - Disclosure. 43A O.S. Section 1-109
In force · effective · read October 3, 2026 · source(oklegislature.gov)
Except as otherwise provided in this section, such information shall not be disclosed to anyone not involved in the treatment of the patient or related administrative work.
Who it binds, in our words: "All mental health and drug or alcohol abuse treatment information, whether or not recorded, and all communications between a physician or licensed mental health professional" and a consumer.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Section 1-525 limits release of STI records, including HIV. Section 1-502.2 makes reportable disease records confidential, sets written consent rules, and names HIV in subsections C to F.
Exposure of prescriptions and records - Disclosure. 63 O.S. Section 1-525
In force · effective · read October 3, 2026 · source(oklegislature.gov)
No information shall be given to any person concerning any infected person except to persons authorized pursuant to Sections
Who it binds, in our words: Infected persons with an STI. 63 O.S. 1-517: "The term "sexually transmitted infection (STI)" means syphilis, gonorrhea, chlamydia, human immunodeficiency virus (HIV)/acquired immune deficiency syndrome (AIDS)"
Certain information to be confidential - HIV multidisciplinary teams. 63 O.S. Section 1-502.2(C)
In force · effective · read October 3, 2026 · source(oklegislature.gov)
The State Department of Health may convene a confidential meeting of a multidisciplinary team for recommendation on school placement of a student who is infected with the human immunodeficiency virus.
Who it binds, in our words: Reportable disease records held by the State Department of Health; HIV-specific rules for students and health care workers.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Section 3614.3 limits compelled disclosure of genetic information in proceedings, with four exceptions. Section 3614.4 requires informed consent before genetic research records go to employers or health insurers.
Disclosure of genetic information. 36 O.S. Section 3614.3
In force · effective · read October 3, 2026 · source(oklegislature.gov)
No person who maintains genetic information shall be compelled to disclose such information pursuant to a request for compulsory disclosure in any judicial, legislative, or administrative proceeding, unless:
Who it binds, in our words: Any person who maintains genetic information; life, disability income and long-term care insurance excluded.
Genetic Research Studies Nondisclosure Act. 36 O.S. Section 3614.4(C)
In force · effective · read October 3, 2026 · source(oklegislature.gov)
The records shall not be disclosed to employers or health insurers without the informed consent of the subject.
Who it binds, in our words: Research records of individual subjects in IRB-approved genetic research studies.
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Suit allowed only for wrongful disclosure of state health department disease records. The breach act gives the AG and district attorneys exclusive authority. SB 546, effective 2027-01-01, bars a private right of action.
Damages a court may award: None fixed. 63 O.S. 1-502.2(H) allows court costs, attorney fees, exemplary damages and all actual damages.
Certain information to be confidential - Wrongful disclosure. 63 O.S. Section 1-502.2(H)
In force · effective · read October 3, 2026 · source(oklegislature.gov)
Any person who negligently, knowingly or intentionally discloses or fails to protect medical or epidemiological information classified as confidential pursuant to this section shall be civilly liable to the person who is the subject of the disclosure for court costs, attorney fees, exemplary damages and all actual damages
Who it binds, in our words: Information held by the State Department of Health about reportable communicable or noncommunicable diseases and public health investigations.
Oklahoma Consumer Data Privacy Act (SB 546, 2026), enforcement. SB 546 (2026) Section 14(E), to be codified at 75A O.S. Section 313
Signed, not yet in force · effective · read October 3, 2026 · source(oklegislature.gov)
Nothing in this act shall be construed as providing a basis for, or being subject to, a private right of action for a violation of this act or any other provision of law.
Who it binds, in our words: Controllers and processors covered by SB 546.
Security Breach Notification Act, enforcement. 24 O.S. Section 165
In force · effective · read October 3, 2026 · source(oklegislature.gov)
the Attorney General or a district attorney shall have exclusive authority to bring an action and may obtain actual damages for a violation of the Security Breach Notification Act
Who it binds, in our words: Breach notification duties under 24 O.S. 161 to 166.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
SB 626 (Laws 2025, c. 406), effective 2026-01-01, added government ID and biometric data but not medical or health insurance data. Enrolled SB 626 text checked. Some secondary sources say otherwise.
Deadline to tell people: without unreasonable delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Security Breach Notification Act, definitions. 24 O.S. Section 162(6)
In force · effective · read October 3, 2026 · source(oklegislature.gov)
“Personal information” means an individual’s first name or first initial and last name in combination with any one or more of the following data elements that relate to the individual
Who it binds, in our words: Listed elements are SSN, government ID number, financial account or card numbers with codes, electronic identifier with codes, and biometric data. No medical or health insurance element.
Duty to provide notice of breach, Attorney General notice. 24 O.S. Section 163(E)
In force · effective · read October 3, 2026 · source(oklegislature.gov)
shall also provide notice to the Attorney General of such breach without unreasonable delay but in no event more than sixty (60) days after providing notice to impacted residents of this state as required by this section.
Who it binds, in our words: Breaches affecting 500 or more Oklahoma residents (1,000 for credit bureaus).
Notice procedures deemed in compliance. 24 O.S. Section 164(B)(2)
In force · effective · read October 3, 2026 · source(oklegislature.gov)
An entity that complies with the notification requirements prescribed by the Oklahoma Hospital Cybersecurity Protection Act of 2023 or the Health Insurance Portability and Accountability Act of 1996 (HIPAA); and
Who it binds, in our words: Deemed compliant only if the entity also gives the Attorney General notice under Section 163(E).
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
One of the three rules is in force. A licensed clinician decides, not AI alone.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Only element found: an optometrist must read and interpret data from remote eye assessment tools, defined to include AI devices. Narrow scope. No AI disclosure or human review rule for coverage found in Titles 36, 59 or 63.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: not found.
Requirements for assessment mechanisms (remote eye assessments). 59 O.S. Section 646.2(B)
In force · effective · read October 3, 2026 · source(oklegislature.gov)
An Oklahoma-licensed optometrist shall: 1. Read and interpret the diagnostic information and data, including any photographs and scans, gathered by the assessment mechanism;
Who it binds, in our words: Eye assessments and eyewear prescriptions only. Section 646.2(E) says it shall not apply beyond ocular health and eye care.
Definitions, assessment mechanism. 59 O.S. Section 646.1(1)
In force · effective · read October 3, 2026 · source(oklegislature.gov)
includes artificial intelligence devices and any equipment, electronic or nonelectronic, that is used to perform an eye assessment;
Who it binds, in our words: Definition of "assessment mechanism" for 59 O.S. 646.1 to 646.4.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
14.4%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
93.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
85.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
13.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$61,364 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.7%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
5.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
10.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
