Health record rights in Pennsylvania: what state law adds
In Pennsylvania, as of October 3, 2026, we found no law on health data held outside HIPAA; copy rights go no further than HIPAA; you can opt out of the health information exchange; no specific rule for genetic records is in force, while reproductive health, mental health and HIV records each have one; you can sue only in a narrow case; breach notices must cover medical and health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Keyword searches of the session laws returned no results for these terms. HB 78, a consumer data privacy bill, passed the House in 2025. Its last action was Senate second consideration on June 25, 2026. It is not law.
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
No. A law is in force, but it adds nothing to HIPAA's terms.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No state deadline under 30 days and no free copy case found. The state sets per-page caps and a $19 base flat fee for benefit claims, not a free copy. Caps do not count. Not beyond the federal floor.
Fee rule: 42 Pa.C.S. 6155(b)(1): patient fee may not exceed the amounts in 6152(a)(2)(i).
Fee rule: 42 Pa.C.S. 6152(a)(2)(i) base amounts: "$20.62 for searching for and retrieving the records, $1.39 per page for the first 20 pages, $1.03 per page for pages 21 through 60 and 34¢ per page for pages 61 and thereafter", adjusted yearly by CPI.
Fee rule: 42 Pa.C.S. 6152.1(a)(1): "a flat fee of $19" plus postage for records supporting a Social Security or needs-based benefit claim or appeal, adjusted yearly.
Fee rule: 55 Pa.B. 8441 (effective Jan. 1, 2026): pages 1-20 $2, pages 21-60 $1.48, pages 61 on $0.52, microfilm $2.95, search and retrieval $29.61 not chargeable for own record, benefit-claim flat fee $37.52.
Fee rule: 28 Pa. Code 115.29 (hospitals): charges "shall be reasonably related to the cost of making the copy".
Goes beyond the federal floor: no.
Rights of patients: rights to records generally. 42 Pa.C.S. § 6155(b)(1)
In force · effective · read October 3, 2026 · source(palegis.us)
A health care provider or facility shall not charge a patient or his designee, including his attorney, a fee in excess of the amounts set forth in section 6152(a)(2)(i) (relating to subpoena of records).
Who it binds, in our words: "A health care provider or facility"
Subpoena of records: fee amounts. 42 Pa.C.S. § 6152(a)(2)(i)
In force · effective · read October 3, 2026 · source(palegis.us)
The payment shall be $20.62 for searching for and retrieving the records, $1.39 per page for the first 20 pages, $1.03 per page for pages 21 through 60 and 34¢ per page for pages 61 and thereafter for paper copies or reproductions on electronic media
Who it binds, in our words: "the health care provider or facility or a designated agent"
Limit on charges for benefit claims. 42 Pa.C.S. § 6152.1(a)(1)
In force · effective · read October 3, 2026 · source(palegis.us)
a health care provider or facility shall not charge more than a flat fee of $19 for the expense of reproducing medical charts or records, plus the actual cost of postage, shipping or delivery
Who it binds, in our words: Requests "for the purpose of supporting a claim or appeal under any provision of the Social Security Act" or a needs-based benefit program
Department of Health notice: Amendments to Charges for Medical Records. 55 Pa.B. 8441 (Pa.B. Doc. No. 25-1680)
In force · effective · read October 3, 2026 · source(pacodeandbulletin.gov)
Search and retrieval of records (cannot be charged if requestor is requesting their own personal health record)
Who it binds, in our words: "a health care facility or health care provider"
In force · effective · read October 3, 2026 · source(pacodeandbulletin.gov)
The patient or the patient’s next of kin may be charged for the cost of reproducing the copies; however, the charges shall be reasonably related to the cost of making the copy.
Who it binds, in our words: Hospitals licensed under the Health Care Facilities Act
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Records are exchanged unless the patient signs an opt-out form. DHS publishes the form. Section 1407-C(a)(2) keeps other laws needing added consent. Whether HIV records need consent for P3N exchange was not resolved.
Set by state law.
Designated exchange: Pennsylvania Patient & Provider Network (P3N), run by the Department of Human Services eHealth Partnership Program.
Human Services Code, consent and confidentiality of health information: opt-out registry. Human Services Code (Act of June 13, 1967, P.L.31, No.21) § 1407-C(c)(1), added by Act 76 of 2016
In force · effective · read October 3, 2026 · source(palegis.us)
In order to decline participation in the health information exchange, a patient must sign and date a form declining participation.
Who it binds, in our words: The Statewide health information exchange established under Article XIV-C
Human Services Code: published consent form and notice. Human Services Code § 1407-C(b)
In force · effective · read October 3, 2026 · source(palegis.us)
The department shall publish a consent form including notice of a patient's ability to decline to allow exchange of the patient's electronic health information in the health information exchange.
Who it binds, in our words: Department of Human Services
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The rule covers abortion reports filed with the Department of Health. Disclosure to law enforcement needs a court order. No statute on reproductive data sent to other states was found. Subsection (e) was last amended by Act 31 of 1988.
Abortion Control Act: reporting, confidentiality of reports. 18 Pa.C.S. § 3214(e)(2)
In force · effective · read October 3, 2026 · source(palegis.us)
shall remain confidential, except that disclosure may be made to law enforcement officials upon an order of a court of common pleas after application showing good cause therefor.
Who it binds, in our words: Reports filed with the Department of Health under subsections (a) and (h)
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Act 32 of 2022 added an exception for HIPAA covered entities and business associates acting under 45 CFR Part 164 Subpart E. Privileged communications still need written consent.
Mental Health Procedures Act: confidentiality of records. Mental Health Procedures Act § 111(a) (Act 143 of 1976; 50 P.S. § 7111)
In force · effective · read October 3, 2026 · source(palegis.us)
All documents concerning persons in treatment shall be kept confidential and, without the person's written consent, may not be released or their contents disclosed to anyone except:
Who it binds, in our words: Documents concerning persons in treatment under the act
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure is limited to listed persons or a written consent meeting section 7(c). Section 8 limits court orders for access.
Confidentiality of HIV-Related Information Act: confidentiality of records. Act 148 of 1990, § 7(a) (35 P.S. § 7607)
In force · effective · read October 3, 2026 · source(palegis.us)
No person or employee, or agent of such person, who obtains confidential HIV-related information in the course of providing any health or social service or pursuant to a release of confidential HIV-related information under subsection (c) may disclose or be compelled to disclose the information
Who it binds, in our words: Any person who obtains confidential HIV-related information while providing a health or social service
Second check by a separate agent: confirmed.
Genetic records
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Search results showed DNA database, paternity testing, genetic counselor licensing and insurance references to federal GINA. No state rule on confidentiality of genetic test records was found.
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The only right to sue found covers HIV-related information, one narrow category. The breach act gives the Attorney General exclusive enforcement. No general right to sue over medical records was found.
Damages a court may award: None. Compensatory damages; attorney fees and costs for section 6 violations by a source patient's physician.
Confidentiality of HIV-Related Information Act: civil cause of action. Act 148 of 1990, § 10 (35 P.S. § 7610)
In force · effective · read October 3, 2026 · source(palegis.us)
Any person aggrieved by a violation of this act shall have a cause of action against the person who committed such violation and may recover compensatory damages.
Who it binds, in our words: Violations of the HIV-Related Information Act
Breach of Personal Information Notification Act: civil relief. Act 94 of 2005, § 8 (73 P.S. § 2308)
In force · effective · read October 3, 2026 · source(palegis.us)
The Office of Attorney General shall have exclusive authority to bring an action under the Unfair Trade Practices and Consumer Protection Law for a violation of this act.
Who it binds, in our words: Violations of the breach notification act
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both elements are in the definition. Medical information counts only when held by a State agency or State agency contractor. Health insurance information has no such limit. Medical information added by Act 151 of 2022.
Deadline to tell people: without unreasonable delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Breach of Personal Information Notification Act: definition of personal information. Act 94 of 2005, § 2 (73 P.S. § 2302), as amended by Act 33 of 2024
In force · effective · read October 3, 2026 · source(palegis.us)
(iv) Medical information in the possession of a State agency or State agency contractor. (v) Health insurance information.
Who it binds, in our words: "An entity that maintains, stores or manages computerized data that includes personal information"
Notice to Attorney General. Act 94 of 2005, § 3(c.1) (73 P.S. § 2303)
In force · effective · read October 3, 2026 · source(palegis.us)
When notice of the breach of the security of the system under this section must be given to more than 500 affected individuals in this Commonwealth, notice shall be made concurrently to the Office of Attorney General.
Who it binds, in our words: Breaches affecting more than 500 Pennsylvania residents; entities under 40 Pa.C.S. Ch. 45 are exempt
In force · effective · read October 3, 2026 · source(palegis.us)
Except as provided in section 4 or in order to take any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system, the notice shall be made without unreasonable delay.
Who it binds, in our words: Entities holding computerized personal information of Pennsylvania residents
Entities subject to HIPAA. Act 94 of 2005, § 5.3 (73 P.S. § 2305.3)
In force · effective · read October 3, 2026 · source(palegis.us)
Any covered entity or business associate that is subject to and in compliance with the privacy and security standards for the protection of electronic personal health information established under the Health Insurance Portability and Accountability Act of 1996
Who it binds, in our words: HIPAA covered entities and business associates
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The 20 session-law hits cover schools, crimes, 911 and transcripts. None covers health care. HB 1925 passed the House on Sept. 30, 2026 and is not law. Insurance Department Notice 2024-04 is guidance only.
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
7.2%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
91.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
87.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
8.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$73,170 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.4%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
10.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
11.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
13.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
