Health record rights in Vermont: what state law adds
In Vermont, as of October 3, 2026, a law on health data held outside HIPAA is signed but not yet in force (it takes effect January 1, 2028); you get a free copy of your record in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices must cover medical and health insurance information; and one of the three rules we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Must you be told if health data leaks in a breach?Yes. The breach notice law covers both medical information and health insurance information. Also signed, not yet in force: Act 138 (2026), Sec. 1, amending 9 V.S.A. chapter 62 (January 1, 2027). Same answer in 21 of the 50 states, counting this one.
Are there rules for AI used in your care?One of the three rules is in force. A licensed clinician decides, not AI alone. Same answer in 12 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Signed, not yet in force Not yet. A law is signed and takes effect January 1, 2028. Until then, none is in force.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Act 145 of 2026 requires consent for sensitive data, including health data, and consent to sell consumer health data. Sec. 4 says the act takes effect January 1, 2028. No in-force consent rule found, so level 0 for now.
"Level" is the step on our rulebook's scale for this question. 0 means nothing beyond HIPAA. Higher means the law gives you more here.
Vermont Data Privacy and Online Surveillance Act; duties of controllers (sensitive data). 2026 Acts and Resolves No. 145, Sec. 1 (9 V.S.A. § 2415e(a)(4)(A))
Signed, not yet in force · effective · read October 3, 2026 · source(legislature.vermont.gov, reached from legislature.vermont.gov)
not process the sensitive data unless the consumer has provided consent and unless the processing is reasonably necessary in relation to the purposes for which the sensitive data are collected
Who it binds, in our words: controlled or processed the personal data of not fewer than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction (also 3,000 consumers for sensitive data or sales; 9 V.S.A. § 2415b(a))
Consumer health data privacy. 2026 Acts and Resolves No. 145, Sec. 1 (9 V.S.A. § 2415k(4))
Signed, not yet in force · effective · read October 3, 2026 · source(legislature.vermont.gov, reached from legislature.vermont.gov)
sell, or offer to sell, consumer health data without first obtaining the consumer’s consent.
Who it binds, in our words: apply to a person that conducts business in this State or a person that produces products or services that are targeted to residents of this State. (9 V.S.A. § 2415b(b), no volume threshold)
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy for Social Security and needs-based benefit claims goes beyond HIPAA and Part 171. No day deadline found; 26 V.S.A. § 1354(a)(10) says only promptly. The $5 or $0.50 per page fee is a fact, not counted.
Free copy: Copies requested to support a claim or appeal under the Social Security Act
Free copy: Copies requested for any other federal or State needs-based benefit or program
Fee rule: A custodian may impose a charge that is no more than a flat $5.00 fee or no more than $0.50 per page, whichever is greater (18 V.S.A. § 9419(a))
Fee rule: A custodian may charge an individual a fee, reasonably related to the associated costs, for providing copies of X-rays, films, models, disks, tapes, or other health care record information maintained in other formats (18 V.S.A. § 9419(b))
Goes beyond the federal floor: yes.
Charges for access to medical records. 18 V.S.A. § 9419(a)
In force · effective · read October 3, 2026 · source(legislature.vermont.gov)
A custodian shall not charge for providing copies of any health care record requested to support a claim or an appeal under any provision of the Social Security Act or for any other federal or State needs-based benefit or program.
Who it binds, in our words: “Custodian” means any person who maintains health care information for any lawful purpose, including a health care provider, a health care facility, or a health insurer.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute makes the exchange opt-out. VITL publishes opt-out by form or hotline. VHIE protocols add 42 C.F.R. Part 2 protections for substance use disorder records; that rule is federal, not a state statute.
Set by state law.
Designated exchange: Vermont Information Technology Leaders (VITL), operator of the Vermont Health Information Exchange.
Some sensitive records need your consent even where routine records do not.
Health Information Technology Plan. 18 V.S.A. § 9351(a)(3)(B)
In force · effective · read October 3, 2026 · source(legislature.vermont.gov)
to the extent permitted under federal law unless the patient has affirmatively elected not to have the patient’s electronic health information shared in that manner.
Who it binds, in our words: each patient’s electronic health information that is contained in the Vermont Health Information Exchange
Vermont Information Technology Leaders; designation. 18 V.S.A. § 9352(c)(1)
In force · effective · read October 3, 2026 · source(legislature.vermont.gov)
VITL shall be designated in the Health Information Technology Plan to operate the exclusive statewide health information exchange network for this State.
Who it binds, in our words: Vermont Health Information Exchange
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Bars disclosure of records related to legally protected health care activity to out-of-state government bodies or for use in proceedings, unless the patient authorizes or listed exceptions apply.
Disclosure of protected health information prohibited. 18 V.S.A. § 1881(c)(1)
In force · effective · read October 3, 2026 · source(legislature.vermont.gov)
a covered entity or business associate shall not disclose protected health information that is identifiable or susceptible to reidentification and is related to a legally protected health care activity:
Who it binds, in our words: Covered entities and business associates as defined in 45 C.F.R. § 160.103
Legally protected health care activity; definitions. 1 V.S.A. § 150(c)
In force · effective · read October 3, 2026 · source(legislature.vermont.gov)
“Reproductive health care services” means all supplies, care, and services of a medical,
Who it binds, in our words: Defines the reproductive health care services that fall within legally protected health care activity
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure is allowed with the individual's written consent, to carry out Part 8, by court direction, or for listed reporting. Violation carries a fine up to $2,000 or one year imprisonment.
Disclosure of information (mental health). 18 V.S.A. § 7103(a)
In force · effective · read October 3, 2026 · source(legislature.vermont.gov)
together with clinical information relating to such persons shall be kept confidential and shall not be disclosed by any person except insofar:
Who it binds, in our words: Records identifying a patient or individual whose hospitalization or care has been sought or provided under Part 8 of Title 18 (mental health)
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Covers public health agency records on HIV or AIDS. Subsection (d) bars disclosure or discovery in any civil, criminal or administrative proceeding.
Reports to Commissioner of Health; HIV and AIDS public health records. 18 V.S.A. § 1001(b)
In force · effective · read October 3, 2026 · source(legislature.vermont.gov)
shall be confidential and only disclosed following notice to and written authorization from the individual subject of the public health record or the individual’s legal representative.
Who it binds, in our words: Public health records developed or acquired by State or local public health agencies that relate to HIV or AIDS
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure of genetic test results needs written authorization. Subsection (d) requires written authorization and informed consent before testing.
Genetic testing; limitations. 18 V.S.A. § 9332(e)
In force · effective · read October 3, 2026 · source(legislature.vermont.gov)
any results of genetic testing or the fact that an individual has requested genetic services or undergone genetic testing shall be disclosed only pursuant to a written authorization executed by the individual tested or by a person authorized by law to act for the individual.
Who it binds, in our words: Any person, except the testing purposes listed in subsection (b)
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Suits limited to genetic testing and confidential public health records such as HIV. 18 V.S.A. § 1881 has no private right. Act 145 of 2026, Sec. 2, states an intent to give no private right under the new privacy act.
Damages a court may award: Genetic testing: civil damages including punitive damages, costs and attorney's fees (18 V.S.A. § 9335(b)). HIV or other public health records: actual damages; civil penalty $10,000 to $25,000 for willful disclosure; up to $2,500 paid to the subject for negligent disclosure (18 V.S.A. § 1001(e)).
Genetic testing; remedies. 18 V.S.A. § 9335(b)
In force · effective · read October 3, 2026 · source(legislature.vermont.gov)
Any person aggrieved by a violation of this chapter may bring an action for civil damages, including punitive damages, equitable relief, including restraint of prohibited acts, restitution of wages or other benefits, and reinstatement, costs, and reasonable attorney’s fees, and other appropriate relief.
Who it binds, in our words: Violations of 18 V.S.A. chapter 217 (genetic testing)
Confidential public health records; liability. 18 V.S.A. § 1001(e)(4)
In force · effective · read October 3, 2026 · source(legislature.vermont.gov)
Commits any act described in subdivision (1), (2), or (3) of this subsection shall be liable to the subject for all actual damages, including damages for any economic, bodily, or psychological harm that is a proximate result of the act.
Who it binds, in our words: Disclosure of confidential public health records, including HIV test results
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both medical and health insurance data are in the definition. The Attorney General or Department of Financial Regulation must get a preliminary notice within 14 business days.
Deadline to tell people: Most expedient time possible and without unreasonable delay, but not later than 45 days after discovery or notification.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
In force · effective · read October 3, 2026 · source(legislature.vermont.gov)
health records or records of a wellness program or similar program of health promotion or disease prevention; (II) a health care professional’s medical diagnosis or treatment of the consumer; or (III) a health insurance policy number.
Who it binds, in our words: Data collectors that own or license computerized personally identifiable information
Notice of security breaches. 9 V.S.A. § 2435(b), (e)
In force · effective · read October 3, 2026 · source(legislature.vermont.gov)
shall be made in the most expedient time possible and without unreasonable delay, but not later than 45 days after the discovery or notification,
Who it binds, in our words: Data collectors; a HIPAA-regulated data collector is deemed compliant for breaches limited to the health data in § 2430(10)(A)(vii) if it notifies under HIPAA
Act 138 (2026), Sec. 1, amending 9 V.S.A. chapter 62. 2026 Vt. Acts No. 138, Sec. 1 (9 V.S.A. 2430(13)(A)(vii))
Signed, not yet in force · effective · read October 3, 2026 · source(legislature.vermont.gov)
health records or records of a wellness program or similar program of health promotion or disease prevention
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
One of the three rules is in force. A licensed clinician decides, not AI alone.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Act 156 took effect on passage, signed June 17, 2026. It covers mental health services only. Act 101 of 2026 orders only a study on AI in utilization review. No disclosure or human recourse rule found.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): A corporation or entity shall not provide, advertise, or otherwise offer mental health services, including through the use of artificial intelligence, to the public unless the mental health services are: (1) provided by a mental health professional; or (18 V.S.A. § 7115(b), Act 156 of 2026)
Prohibited uses of artificial intelligence (mental health services). 2026 Acts and Resolves No. 156, Sec. 3 (18 V.S.A. § 7115(d))
In force · effective · read October 3, 2026 · source(legislature.vermont.gov)
from utilizing artificial intelligence tools that are compliant with the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, provided that the mental health professional reviews and approves any mental health services.
Who it binds, in our words: Mental health services and mental health professionals as defined in 18 V.S.A. § 7115(a)
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
5.1%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
93.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
86.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
5.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$74,014 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
2.7%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
6.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
5.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
14.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. In force It offers no state way to ask brokers to delete your data.
Data broker annual registration. 9 V.S.A. § 2446(a)
In force · effective · read October 3, 2026 · source(legislature.vermont.gov)
Annually, on or before January 31 following a year in which a person meets the definition of data broker as provided in section 2430 of this title, a data broker shall: (1) register with the Secretary of State;
Who it binds, in our words: Data brokers as defined in 9 V.S.A. § 2430
Data broker registration amendments. 2026 Acts and Resolves No. 138, Sec. 1 (9 V.S.A. chapter 62)
Signed, not yet in force · effective · read October 3, 2026 · source(legislature.vermont.gov)
if the data broker permits deletion, allows a consumer to request that a data broker delete the brokered personal information of the consumer;
Who it binds, in our words: Registered data brokers; Sec. 2 orders only a study of a single deletion mechanism
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
