Health record rights in Alabama: what state law adds
In Alabama, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a free copy of your record in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you cannot sue under these laws; breach notices must cover medical and health insurance information; and one of the three rules we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The United States score in the world index rates only federal law and national systems, so these state profiles do not change it.
The seven answers
Do apps and wearables need your OK before sharing health data?Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in). Also signed, not yet in force: Alabama Personal Data Protection Act: consent for sensitive data (May 1, 2027). Same answer in 26 of the 50 states, counting this one.
Can you sue if your records are misused?No. Only the attorney general or a regulator can enforce these laws. Also signed, not yet in force: Alabama Personal Data Protection Act: enforcement (May 1, 2027). Same answer in 5 of the 50 states, counting this one.
Are there rules for AI used in your care?One of the three rules is in force. A licensed clinician decides, not AI alone. Same answer in 12 of the 50 states, counting this one.
No other state gives the same five answers as Alabama (on health data outside HIPAA, health information exchange, right to sue, breach notice and AI in care).
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Act 2024-384 requires express consent from direct-to-consumer genetic testing companies, one class of non-HIPAA holder. Act 2026-552 requires consent for sensitive data, including health conditions, from May 1, 2027. Act 2026-552 § 12 sets that date.
Alabama Genetic Data Privacy Act: consumer consent requirements. Ala. Code § 8-43-3(a)(3) (Act 2024-384, § 3)
A genetic testing company shall obtain the consumer’s express consent every time the company does any of the following:
Who it binds, in our words: Any person, other than a health care provider, who directly solicits a biological sample from a consumer for analysis in order to provide products or services to the consumer
Alabama Genetic Data Privacy Act: exclusion of HIPAA entities. Ala. Code § 8-43-5(1) (Act 2024-384, § 5)
A covered entity or business associate as those terms are defined in 45 C.F.R. Parts 160 and 164.
Who it binds, in our words: Lists entities to which the chapter does not apply.
Alabama Personal Data Protection Act: consent for sensitive data. Ala. Code § 8-44-7(b)(2) (Act 2026-552, § 7)
Signed, not yet in force · effective · read October 3, 2026 · source(alison.legislature.state.al.us, reached from alison.legislature.state.al.us)
Process sensitive data concerning a consumer other than a known child without obtaining that consumer’s consent
Who it binds, in our words: Control or process the personal data of more than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No state deadline found. Free case is narrow: records transfer when a physician leaves a group, cost on the practice or physician. HIPAA permits a fee for such copies, so this goes beyond the federal floor. Per-page cap is a fact only.
Free copy: When a physician leaves a group practice and the group notifies patients, the group bears the cost of reproducing or transferring records; if the departing physician notifies, the physician bears it (Ala. Admin. Code r. 540-X-9-.10).
Fee rule: Ala. Code § 12-21-6.1(b)(2): "shall not be more than one dollar ($1) for each page of the first 25 pages, not more than 50 cents ($.50) for each page in excess of 25 pages, and a search fee of five dollars ($5)." Mailing at actual cost; X-rays at actual cost. Binds any medical provider or entity that maintains medical records.
Fee rule: Ala. Admin. Code r. 540-X-9-.10(b): "The cost of reproduction shall not exceed what is authorized under state and federal law." Binds physicians.
Goes beyond the federal floor: yes.
Joint Rules of the State Board of Medical Examiners and Medical Licensure Commission for Medical Records Management. Ala. Admin. Code r. 540-X-9-.10
In force · effective · read October 3, 2026 · source(admincode.legislature.state.al.us)
Absent a contractual provision to the contrary, when the group or medical practice undertakes to notify patients of the physician's departure, the group shall bear the cost of notifying patients and reproducing or transferring medical records.
Who it binds, in our words: Physicians and physician group practices licensed in Alabama; applies when a physician departs a group.
Reproduction and Delivery of Medical Records. Ala. Code § 12-21-6.1 (Act 94-609)
shall not be more than one dollar ($1) for each page of the first 25 pages, not more than 50 cents ($.50) for each page in excess of 25 pages, and a search fee of five dollars ($5).
Who it binds, in our words: Any medical provider or company or other legal entity that maintains medical records.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No Alabama statute on HIE consent was found (earlier code search). One Health Record, run by the Alabama Medicaid Agency, publishes an opt-out policy (Policy 006, effective 1 October 2023) and a patient opt-out form. The live exchange site returns a DataDome captcha, so the stored copies are raw Wayback Machine captures of the official files from 14 May 2026. The policy manual defers to law for sensitive information and sets no added consent step of its own.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: Alabama One Health Record (statewide HIE administered by the Alabama Medicaid Agency).
Alabama Health Information Exchange Policy Manual, AHIE Policy 006, Individual Participation and Choice (Opt-Out Procedures). AHIE Policy Manual (revised August 2023), Policy 006
In force · effective · read October 5, 2026 · source(onehealthrecord.alabama.gov, reached from medicaid.alabama.gov)
the Participant shall provide Individuals the option to choose not to participate in the electronic sharing of his or her protected health information through One Health Record
Who it binds, in our words: All participants in One Health Record. Same manual: exchange for permitted purposes needs no authorization, and data is available unless the person has opted out. Manual states One Health Record is administered and managed by the Alabama Medicaid Agency. Live file sits behind a captcha; stored bytes are the Wayback Machine raw capture of 2026-05-14.
Alabama One Health Record Patient Opt-Out Info and Request to Opt-Out/Reverse Opt-Out form. One Health Record patient opt-out form, v2 07/15/21
In force · effective · read October 5, 2026 · source(onehealthrecord.alabama.gov, reached from medicaid.alabama.gov)
Your choice to opt-out of the health information exchange will not affect your ability to access medical care.
Who it binds, in our words: Patients of providers participating in One Health Record; the signed form goes to a participating provider. Effective date taken from the form version string v2.071521. Stored bytes are the Wayback Machine raw capture of 2026-05-14 (live site captcha).
Alabama One Health Record FAQs, What if patients do not want their information shared?. One Health Record FAQ page
In force · current version date not confirmed · read October 5, 2026 · source(onehealthrecord.alabama.gov, reached from medicaid.alabama.gov)
Opt-Out assistance is also available through our Service Desk at 844-746-3540.
Who it binds, in our words: Patients; page undated. Stored bytes are the Wayback Machine raw capture of 2026-05-14 (live site captcha).
Alabama Medicaid Agency, Accessing Your Health Information. Alabama Medicaid Agency patient access page
In force · current version date not confirmed · read October 5, 2026 · source(medicaid.alabama.gov)
Alabama Medicaid offers the Alabama One Health Record App
Who it binds, in our words: State agency page that names One Health Record and links to it as "One Health Record - HIE"; used for the exchange name, not the consent rule.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Rule covers state vital statistics reports of induced termination of pregnancy, not provider records generally. Listed exceptions allow release to prosecutors and by court order. Act 2012-363 took effect on approval.
Reports of Induced Termination of Pregnancy. Ala. Code § 22-9A-13(b)(5) (Act 2012-363)
Individual induced termination of pregnancy reports shall be maintained in strict confidence by the Office of Vital Statistics, shall not be available for public inspection, and shall not be made available except:
Who it binds, in our words: Reports filed with the Office of Vital Statistics; exceptions include the Attorney General or a district attorney in a criminal investigation.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Effective dates are the Governor's approval dates on the Secretary of State act pages (Act 95-744, Act 97-387). Act images were not online to confirm any later date.
Mental Health Consumers' Rights. Ala. Code § 22-56-4(b)(6) (Act 95-744)
The right to confidentiality of all information in the consumer’s mental health, medical, and financial records.
Who it binds, in our words: Consumers of mental health services.
Confidential Relations Between Licensed Psychologists, Licensed Psychiatrists, or Licensed Psychological Technicians and Their Clients. Ala. Code § 34-26-2 (Act 97-387)
are placed upon the same basis as those provided by law between attorney and client
Who it binds, in our words: Licensed psychologists, licensed psychiatrists, and licensed psychological technicians and their clients.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Effective dates are the Governor's approval dates on the Secretary of State act pages (Act 91-120, Act 87-574). Act images were not online to confirm any later date.
Confidentiality (HIV test results). Ala. Code § 22-11A-54 (Act 91-120)
A health care or other testing facility shall maintain confidentiality regarding medical test results with respect to the HIV infection or a specific sickness or medical condition derived from such infection and shall disclose results only to those individuals designated by this article or otherwise as authorized by law.
Who it binds, in our words: Health care or other testing facilities.
Medical Records of Persons Infected with Sexually Transmitted Diseases Confidential; Penalty for Release. Ala. Code § 22-11A-22 (Act 87-574)
Individual medical records may be released on the written consent of the patient.
Who it binds, in our words: Information, reports and medical records on sexually transmitted diseases designated by the State Board of Health.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The listed acts are disclosure to health, life, disability or long-term care insurers and to employers. The act excludes HIPAA covered entities and business associates.
Alabama Genetic Data Privacy Act: disclosure to insurers and employers. Ala. Code § 8-43-3(c) (Act 2024-384, § 3)
A genetic testing company may not do any of the following without a consumer’s express written consent:
Who it binds, in our words: Any person, other than a health care provider, who directly solicits a biological sample from a consumer for analysis in order to provide products or services to the consumer
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
No. Only the attorney general or a regulator can enforce these laws.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Breach act bars a private action under § 8-19-10. Genetic act and the 2027 privacy act are enforced by the Attorney General only. No health records statute found that lets a person sue.
Damages a court may award: none
Data Breach Notification Act: violations. Ala. Code § 8-38-9(a)(1) (Act 2018-396, § 9)
may enforce this chapter by a civil action in circuit court to enjoin any practice or conduct in violation of this chapter or to recover a civil penalty of up to three thousand dollars ($3,000) for each violation.
Who it binds, in our words: Consumer Interest Division of the Office of the Attorney General.
Alabama Personal Data Protection Act: enforcement. Ala. Code § 8-44-11(a) (Act 2026-552, § 11)
Signed, not yet in force · effective · read October 3, 2026 · source(alison.legislature.state.al.us, reached from alison.legislature.state.al.us)
The Attorney General may enforce violations of this chapter.
Who it binds, in our words: Controllers and processors meeting the § 8-44-3 thresholds.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Act 2018-396 § 13 sets effect on the first day of the third month after approval (approved March 28, 2018), so June 1, 2018. Both medical and health insurance information are in the definition.
Deadline to tell people: 45 days.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Data Breach Notification Act: definitions (medical information). Ala. Code § 8-38-2(6)a.4. (Act 2018-396, § 2)
Any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
Who it binds, in our words: Covered entities: any person or business or government entity that acquires or uses sensitive personally identifying information.
Data Breach Notification Act: definitions (health insurance information). Ala. Code § 8-38-2(6)a.5. (Act 2018-396, § 2)
An individual’s health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual.
Who it binds, in our words: Covered entities under the breach chapter.
Notice of Security Breach: Individuals Affected. Ala. Code § 8-38-5(b) (Act 2018-396, § 5)
If the number of individuals a covered entity is required to notify under Section 8-38-5 exceeds 1,000, the entity shall provide written notice of the breach to the Attorney General as expeditiously as possible and without unreasonable delay.
Who it binds, in our words: Breaches requiring notice to more than 1,000 individuals.
Exemptions: Federal. Ala. Code § 8-38-11 (Act 2018-396, § 11)
is exempt from this chapter as long as the entity does all of the following:
Who it binds, in our words: Entities subject to federal breach notification rules that keep procedures, notify individuals under those rules, and copy the Attorney General when over 1,000 are notified.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
One of the three rules is in force. A licensed clinician decides, not AI alone.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Act 2026-589 § 2 sets October 1, 2026. Policy-level disclosure is not notice to the person, so disclosure is not counted. No human review right for the enrollee found.
"Level" is the step on our rulebook's scale for this question. 0 means nothing beyond HIPAA. Higher means the law gives you more here.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): Ala. Code § 27-1-17.2(b)(2)a. (annual certification): "The artificial intelligence does not rely on a group dataset to make determinations."
Limitations on Use of Artificial Intelligence by Health Benefit Plan Providers; Enforcement. Ala. Code § 27-1-17.2(b)(3) (Act 2026-589, § 1)
a determination to deny, delay, or modify a request for prior authorization based on medical necessity shall always be made by a licensed physician or other health care professional who is competent to evaluate any recommendation or conclusion of artificial intelligence
Who it binds, in our words: Health benefit plan providers, including insurers, HMOs, and utilization review contractors, for prior authorization under health benefit plans.
Limitations on Use of Artificial Intelligence by Health Benefit Plan Providers: disclosure in policies. Ala. Code § 27-1-17.2(c)(1) (Act 2026-589, § 1)
Make prominent written disclosures regarding its use of artificial intelligence in utilization review in its policies and procedures.
Who it binds, in our words: Health benefit plan providers.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine. Each strip shows the 50 states as gray dots and this state as the dark dot, low on the left, high on the right; the numbers under it are the lowest and highest of the 50 states.
Figure
Value
Among the 50 states
Source and period
People under 65 without health insuranceHealth care access and quality
10.0%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
91.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
83.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
14.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$59,609 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
2.7%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
5.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
5.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Who to contact in Alabama
Start with your provider. If you are refused or get no answer, there are two federal offices. Our contacts page lists them, with what we found for Alabama. Not legal advice. See Alabama on our contacts page.
Questions people ask
Short answers from the research on this page. Not legal advice.
Can I get a copy of my health record in Alabama?
Yes. HIPAA, the federal law, gives you that right in all 50 states and DC. The provider has 30 days, plus one 30-day extension, and may charge a cost-based fee. As of October 3, 2026, Alabama law adds more: you get a free copy of your record in some cases. Source: Ala. Admin. Code r. 540-X-9-.10, read October 3, 2026. The full answer.
Can I opt out of the health information exchange in Alabama?
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Our own words are CC BY 4.0; quoted law and source titles stay with their owners.
