Health record rights in West Virginia: what state law adds
In West Virginia, as of October 3, 2026, we found no law on health data held outside HIPAA; you get a free copy of your record in some cases; you can opt out of the health information exchange; no specific rule for genetic records is in force, while reproductive health, mental health and HIV records each have one; you can sue only in a narrow case; breach notices need not cover medical or health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No comprehensive privacy law or consumer health data law found. HB 5123 (2026 Consumer Data Protection Act) last action: referred to House committee on 02/03/26. It was not enacted.
How we searched (October 3, 2026): the official code search for consumer data protection act, consumer health data, sensitive data consent, personal data privacy, "health data", "sensitive data". Agency pages checked: ago.wv.gov.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Deadline is 30 days, equal to HIPAA, so it does not count. The free copy for an indigent Social Security claim or appeal goes beyond HIPAA and 45 CFR 171.302. One element in force.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Free copy: One free set of copies per provider for an indigent person when the records support a Social Security Act claim or appeal (W. Va. Code 16-29-2(f), (g))
Fee rule: Patient or personal representative: no more than a fee consistent with HIPAA, plus applicable taxes (16-29-2(a))
Fee rule: Other requesters: search and handling fee up to $20, 40 cents per paper page, plus postage and taxes (16-29-2(b)(1))
Fee rule: Electronic copies for other requesters: up to 20 cents per page, capped at $150 inclusive of all fees (16-29-2(b)(2))
Fee rule: Certification by affidavit: $10 (16-29-2(c))
Goes beyond the federal floor: yes.
Reasonable expenses to be reimbursed (free copy for Social Security claims). W. Va. Code 16-29-2(f)
In force · effective · read October 3, 2026 · source(code.wvlegislature.gov)
a provider shall not impose a charge on an indigent person or his or her authorized representative if the medical records are necessary for the purpose of supporting a claim or appeal under any provisions of the Social Security Act
Who it binds, in our words: A provider; indigent person as defined in 16-29-2(f)(1)-(2); "limited to one set of copies per provider"
Reasonable expenses to be reimbursed (patient fee rule). W. Va. Code 16-29-2(a)
In force · effective · read October 3, 2026 · source(code.wvlegislature.gov)
A provider may charge a patient or the patient’s personal representative no more than a fee consistent with HIPAA
Who it binds, in our words: A provider; patient or personal representative
Copies of health care records to be furnished to patients. W. Va. Code 16-29-1(a)
In force · effective · read October 3, 2026 · source(code.wvlegislature.gov)
within no more than thirty days from the receipt of the request, furnish a copy
Who it binds, in our words: A health care provider so licensed, certified or registered under the laws of this state
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute 16-29G-8 allows disclosure by authorization or best interest and sets no opt-in. WVHIN policy is opt-out. Health.wv.gov says WVHIN serves as the state's HIE. Effective date is the page's last modified date. Sensitive flag rests on federal Part 2.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: West Virginia Health Information Network (WVHIN).
Some sensitive records need your consent even where routine records do not.
WVHIN For Patients page (opt-out policy). WVHIN patient FAQ and opt-out form
In force · effective · read October 3, 2026 · source(wvhin.org, reached from health.wv.gov)
Yes, patients can choose not to make their data available in WVHIN. This is called opting-out.
Who it binds, in our words: Patients whose providers participate in WVHIN; opt-out form at connect.wvhin.org/optoutform
WVHIN For Patients page (substance use treatment records). WVHIN patient FAQ
In force · effective · read October 3, 2026 · source(wvhin.org, reached from health.wv.gov)
Federal rules say that an addiction treatment provider needs your consent before they share information about your addiction treatment.
Who it binds, in our words: Addiction treatment provider records exchanged through WVHIN
West Virginia Health Information Network; privacy; protection of information. W. Va. Code 16-29G-8(a)
In force · effective · read October 3, 2026 · source(code.wvlegislature.gov)
The Health Care Authority shall ensure that patient specific protected health information be disclosed only in accordance with the patient's authorization or best interest to those having a need to know
Who it binds, in our words: The West Virginia Health Information Network
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The rule covers abortion reports held by vital registration. Reports must omit personal identifiers. No separate rule for provider-held reproductive records was found.
Reports of abortions. W. Va. Code 16-5-22(a)(9)(B)
In force · effective · read October 3, 2026 · source(code.wvlegislature.gov)
Individual records may only be released for research purposes as approved by the state Registrar and may be released in a format designed to further protect the confidentiality of the woman as the state Registrar deems necessary.
Who it binds, in our words: Abortion reports filed with the section of vital registration
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Chapter 27 Article 3 lists the cases where treatment information may be disclosed, including court orders.
Definition of confidential information; disclosure. W. Va. Code 27-3-1(b)
In force · effective · read October 3, 2026 · source(code.wvlegislature.gov)
Confidential information shall not be disclosed, except: (1) In a proceeding under §27-5-4 of this code to disclose the results of an involuntary examination made pursuant to §27-5-2, §27-5-3, or §27-5-4
Who it binds, in our words: Communications and information obtained in the course of treatment or evaluation of any client or patient (Chapter 27)
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure is allowed only to listed persons, including anyone holding a specific release signed by the test subject.
Confidentiality of records; permitted disclosure. W. Va. Code 16-3C-3(a)
In force · effective · read October 3, 2026 · source(code.wvlegislature.gov)
No person may disclose or be compelled to disclose the identity of any person upon whom an HIV-related test is performed, or the results of such a test in a manner which permits identification of the subject of the test
Who it binds, in our words: Any person; HIV-related test identity and results
Second check by a separate agent: confirmed.
Genetic records
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Genetic privacy bills were introduced in 2009, 2023, 2024, 2025 and 2026. HB 5034 (2026) last action: referred to House Health and Human Resources 02/02/26. No enacted genetic record rule found.
How we searched (October 3, 2026): the official code search for genetic information, genetic test results confidential, genetic privacy, genetic data. Agency pages checked: ago.wv.gov.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Private right limited to HIV test records (16-3C-5). The Article 29 enforcement right covers access to copies, not unlawful disclosure. Breach law enforcement is by the Attorney General only (46A-2A-104).
Damages a court may award: HIV test law: liquidated damages of $1,000 (reckless) or $10,000 (intentional or malicious), or actual damages if greater, plus attorney fees (16-3C-5)
Remedies and penalties (HIV-related testing). W. Va. Code 16-3C-5(a)
In force · effective · read October 3, 2026 · source(code.wvlegislature.gov)
Any person aggrieved by a violation of this article has right of action in the circuit court and may recover for the violation
Who it binds, in our words: Violations of Article 3C (AIDS-related medical testing and records confidentiality)
Copies of health care records to be furnished to patients (enforcement). W. Va. Code 16-29-1(c)
In force · effective · read October 3, 2026 · source(code.wvlegislature.gov)
The provisions of this article may be enforced by a patient, personal representative, authorized agent or authorized representative.
Who it binds, in our words: Access to copies under Article 29 only
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Personal information covers SSN, license and financial account numbers only. No AG notice; notice to consumer reporting agencies over 1,000 persons. HIPAA is not named; a general primary-regulator compliance clause exists.
Deadline to tell people: without unreasonable delay.
No duty found to tell the attorney general or a regulator.
Definitions (personal information). W. Va. Code 46A-2A-101(6)
In force · effective · read October 3, 2026 · source(code.wvlegislature.gov)
when the data elements are neither encrypted nor redacted: (A) Social security number; (B) Driver's license number or state identification card number issued in lieu of a driver's license; or (C) Financial account number
Who it binds, in our words: Individuals and entities that own or license computerized data that includes personal information
Notice of breach of security of computerized personal information. W. Va. Code 46A-2A-102(a)
In force · effective · read October 3, 2026 · source(code.wvlegislature.gov)
the notice shall be made without unreasonable delay
Who it binds, in our words: An individual or entity that owns or licenses computerized data that includes personal information
Procedures deemed in compliance with security breach notice requirements. W. Va. Code 46A-2A-103(c)
In force · effective · read October 3, 2026 · source(code.wvlegislature.gov)
An entity that complies with the notification requirements or procedures pursuant to the rules, regulation, procedures or guidelines established by the entity's primary or functional regulator shall be in compliance with this article.
Who it binds, in our words: Any entity with a primary or functional regulator
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HB 4770 (2026) on AI in mental health care: last action referred to House Finance 02/03/26. Enrolled HB 4965 (2026) prior authorization law has no AI terms.
How we searched (October 3, 2026): the official code search for artificial intelligence health care, artificial intelligence prior authorization, artificial intelligence mental health, algorithm utilization review, "artificial intelligence", "automated decision", algorithm. Agency pages checked: wvinsurance.gov, ago.wv.gov.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
7.3%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
88.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
82.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
11.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$55,217 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.6%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
8.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
2.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
14.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
