Health record rights in South Dakota: what state law adds
In South Dakota, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; copy rights go no further than HIPAA; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; we found no law on a right to sue; breach notices must cover medical and health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No comprehensive consumer privacy law found. Level rests on a one-class law: direct-to-consumer genetic testing companies need express consent to collect, disclose or use genetic data. Effective July 1, 2026 under SDCL 2-14-16.
"Level" is the step on our rulebook's scale for this question. 0 means nothing beyond HIPAA. Higher means the law gives you more here.
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
Obtain the consumer's express consent to collect, disclose, or use the consumer's genetic data
Who it binds, in our words: "Direct-to-consumer genetic testing company," an entity that:(a) Offers genetic testing products or services directly to consumers (SDCL 37-24-59); does not apply to "Protected health information collected by a covered entity or business associate" (SDCL 37-24-64)
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
Protected health information collected by a covered entity or business associate, as those terms are defined in 45 C.F.R. § 160.103 (November 25, 2025);
Who it binds, in our words: Exclusions from SDCL 37-24-60 to 37-24-63, including HIPAA PHI, clinical samples, higher education, forensic labs, research and licensed hospitals.
Sharing of genetic information prohibited--Health carrier, life insurer, long-term care insurer. SDCL 58-1-25.1 (SL 2021, ch 209, § 3)
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
Any company providing genetic testing directly to a consumer is prohibited from sharing any genetic test, genetic information, or other personally identifiable information of a consumer with any health carrier, life insurer, or long-term care insurer without written consent from the consumer.
Who it binds, in our words: Any company providing genetic testing directly to a consumer; limited to sharing with health carriers, life insurers and long-term care insurers.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
No. A law is in force, but it adds nothing to HIPAA's terms.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No deadline and no free copy case in SDCL 36-2-16.1 to 36-2-16.8. The only free item is patient portal access, which does not count under Ruling D-1. Per-page caps are recorded as facts only.
Fee rule: Paper copy: "the fee may not exceed ten dollars for the first ten pages and thirty-three cents for each additional page" (SDCL 36-2-16.4)
Fee rule: Electronic copy: "the fee may not exceed twenty-five cents per page" (SDCL 36-2-16.4)
Fee rule: Imaging: printed copy "may not exceed ten dollars"; on disc or other media "may not exceed fifteen dollars" (SDCL 36-2-16.4)
Fee rule: Postage: "may also impose a charge to cover the cost of postage or shipping, together with any applicable tax" (SDCL 36-2-16.4)
Fee rule: Search fee for designee or third-party requests: "The search fee may not exceed eighteen dollars." (SDCL 36-2-16.5)
Fee rule: Certification: "The certification fee may not exceed ten dollars." (SDCL 36-2-16.6)
Fee rule: Portal: "A health care provider may not charge a patient a fee for access to the patient’s electronic health information through a patient portal." (SDCL 36-2-16.3)
Goes beyond the federal floor: no.
Medical record--Provision upon request. SDCL 36-2-16.2 (SL 2023, ch 134, § 2)
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
Upon receiving a written request or an authorization for release of a medical record, signed by a patient, a health care provider or medical records company shall provide a copy of the patient’s medical record, if available, to the patient
Who it binds, in our words: "Health care provider," any licensed health care facility or any person licensed, certified, or otherwise authorized or permitted by law to provide health care (SDCL 36-2-16.1); also medical records companies.
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
For a paper copy of a medical record not specified below, the fee may not exceed ten dollars for the first ten pages and thirty-three cents for each additional page;
Who it binds, in our words: A health care provider or a medical records company.
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
A health care provider may not charge a patient a fee for access to the patient’s electronic health information through a patient portal.
Who it binds, in our words: A health care provider.
Medical record--Search fee--Designees or third parties. SDCL 36-2-16.5 (SL 2023, ch 134, § 5)
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
The search fee may not exceed eighteen dollars.
Who it binds, in our words: Copies sent to a patient's designee or to a third party under the patient's authorization.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No HIE consent statute found. The policy page is undated; effectiveDate is the date it was read as current. A published opt-out form exists. No sensitive-category rule found on the FAQ page.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: South Dakota Health Link (a South Dakota Department of Health program).
South Dakota Health Link patient FAQs, Point of Care Exchange opt-out. South Dakota Health Link patient FAQ (HIE policy)
In force · effective · read October 3, 2026 · source(sdhealthlink.org, reached from doh.sd.gov)
When your providers join the Point of Care Exchange, a limited set of information from your electronic patient chart will automatically be included. If you prefer not to participate in Point of Care Exchange, you MUST opt out.
Who it binds, in our words: Patients of providers that join the Point of Care Exchange of South Dakota Health Link.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Abortion reports may not name the patient. Information collected for them is privileged under 19-19-503(b), with an exception for proceedings under 22-22-1. Effective dates use the July 1 default in SDCL 2-14-16.
Department to ensure anonymity--Confidentiality of communication. SDCL 34-23A-44 (SL 1998, ch 209, § 11; SL 2004, ch 234, § 5)
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
No report made under §§ 34-23A-34 to 34-23A-45, inclusive, may include the name of any female having an abortion.
Who it binds, in our words: Abortion reports made under SDCL 34-23A-34 to 34-23A-45 and information collected to complete them.
Release of confidential information as misdemeanor. SDCL 34-23A-59.2 (SL 2012, ch 186, § 9)
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
Any person who knowingly and intentionally releases any information obtained during any consultations resulting from §§ 34-23A-53 to 34-23A-61, inclusive, under circumstances not in accord with the confidentiality provisions required by §§ 34-23A-53 to 34-23A-61, inclusive, is guilty of a Class 2 misdemeanor.
Who it binds, in our words: Information from pre-abortion consultations under SDCL 34-23A-53 to 34-23A-61.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure outside the holder requires consent of the holder and the person, or a listed exception in SDCL 27A-12-25 to 27A-12-32. Last amended by SL 1993, ch 213.
Confidentiality of information acquired in course of providing mental health services. SDCL 27A-12-26
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
Information in the record of a person, and other information acquired in the course of providing mental health services to a person, shall be kept confidential and are not open to public inspection.
Who it binds, in our words: Centers, the department, mental health programs and inpatient facilities holding mental health records.
Individual records required--Contents--Confidentiality. SDCL 27A-12-25
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
The material in the record shall be confidential in accordance with the provisions of this title.
Who it binds, in our words: Each person receiving mental health services or detained under Title 27A.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HIV test results reported to the Department of Health are confidential and inadmissible, with listed exceptions that name HIV results. Court-ordered HIV test results are confidential under chapter 23A-35B.
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
To the extent necessary to comply with a proper judicial order requiring release of human immunodeficiency virus test results and related information to a prosecutor for an investigation of a violation of § 22-18-31; and
Who it binds, in our words: Communicable disease reports to the Department of Health under SDCL 34-22-12, which "No report may be released, shared with any agency or institution, or made public, upon subpoena, search warrant, discovery proceedings, or otherwise."
Confidentiality of test results. SDCL 23A-35B-11 (SL 2012, ch 134, § 4)
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
Except as provided in § 23A-35B-12, the results of the test shall remain confidential.
Who it binds, in our words: Court-ordered HIV tests of persons convicted of prostitution or solicitation (SDCL 23A-35B-8).
Confidentiality--Test results unavailable to establish guilt or innocence. SDCL 23A-35B-5 (SL 2010, ch 132, § 3)
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
All persons involved in carrying out the provisions of this chapter shall act in a manner that will protect the confidentiality of the victim, the source individual, and the defendant or juvenile, including sealing relevant court records.
Who it binds, in our words: Blood-borne pathogen testing, including HIV, of defendants, juveniles and source individuals under chapter 23A-35B.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Three provisions govern genetic data disclosure: consent per transfer for consumer genetic testing companies (2026), written consent before sharing with insurers (2022), and consent content rules for predictive tests (2001).
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
Separate express consent, which must include the name of the person receiving the information, for each transfer or disclosure of the consumer's genetic data or biological sample to any person other than the company's vendors and service providers;
Who it binds, in our words: Direct-to-consumer genetic testing companies (SDCL 37-24-59), with exclusions in SDCL 37-24-64.
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
A listing of who will have access to the sample taken from the person tested in order to conduct the predictive genetic test and the information obtained from the predictive genetic test, and the person's right to confidential treatment of the sample and the information.
Who it binds, in our words: Any person who orders or performs a predictive genetic test.
Sharing of genetic information prohibited--Health carrier, life insurer, long-term care insurer. SDCL 58-1-25.1 (SL 2021, ch 209, § 3)
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
Any company providing genetic testing directly to a consumer is prohibited from sharing any genetic test, genetic information, or other personally identifiable information of a consumer with any health carrier, life insurer, or long-term care insurer without written consent from the consumer.
Who it binds, in our words: Any company providing genetic testing directly to a consumer.
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Breach law: AG prosecutes failures as deceptive acts and seeks civil penalties (22-40-25). Genetic data law: AG civil penalty only (37-24-63). Neither declares a violation unlawful under 37-24-6, so 37-24-31 suits do not attach.
Damages a court may award: none found
How we searched (October 3, 2026): the official code search for medical record civil action, health information damages, genetic data civil penalty, breach of system security action, 37-24-31, confidentiality mental health action. Agency pages checked: consumer.sd.gov.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Health information under 45 CFR 160.103 counts as both medical and health insurance information.
Deadline to tell people: not later than sixty days from the discovery or notification of the breach.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Definition of terms in §§ 22-40-19 to 22-40-26. SDCL 22-40-19(4)(d) (SL 2018, ch 135, § 1)
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
Health information as defined in 45 CFR 160.103; or
Who it binds, in our words: "Information holder," any person or business that conducts business in this state, and that owns or licenses computerized personal or protected information of residents of this state;
Notice of breach of system security--Exception. SDCL 22-40-20 (SL 2018, ch 135, § 2)
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
Any information holder that experiences a breach of system security under this section shall disclose to the attorney general by mail or electronic mail any breach of system security that exceeds two hundred fifty residents of this state.
Who it binds, in our words: Information holders; AG notice when a breach exceeds 250 residents.
Notice of breach of system security in accordance with federal law. SDCL 22-40-26 (SL 2018, ch 135, § 8)
In force · effective · read October 3, 2026 · source(sdlegislature.gov)
is deemed to be in compliance with this chapter if the information holder notifies affected South Dakota residents in accordance with the provisions of the applicable federal law or regulation.
Who it binds, in our words: Information holders regulated by federal law, including HIPAA, that maintain federal breach procedures.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
2026 SB 169 on health carrier AI determinations was withdrawn at the prime sponsor's request on 2026-02-17, per the legislature's action log. No AI health care statute found in force.
How we searched (October 3, 2026): the official code search for artificial intelligence, artificial intelligence health carrier, utilization review artificial intelligence, chatbot disclosure. Agency pages checked: dlr.sd.gov, sdlegislature.gov.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
9.9%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
92.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
86.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
8.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$69,457 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
2.2%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
5.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
6.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
