Health record rights in Connecticut: what state law adds
In Connecticut, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a free copy of your record in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices must cover medical and health insurance information; and no rule we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The United States score in the world index rates only federal law and national systems, so these state profiles do not change it.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Are there rules for AI used in your care?No. A law is in force, but it has none of the three rules. Also signed, not yet in force: AI companions and minors: limit on offering mental health services (January 1, 2027). Same answer in 6 of the 50 states, counting this one.
No other state gives the same five answers as Connecticut (on health data outside HIPAA, health information exchange, right to sue, breach notice and AI in care).
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Since July 1, 2026 the CTDPA covers any person that processes sensitive data, and requires consent to process it. Consumer health data is sensitive data. 42-526 requires consent to sell, not a separate signed authorization.
Connecticut Data Privacy Act, controllers' duties: consent to process sensitive data. Conn. Gen. Stat. 42-520(a)(1)(D), as amended by P.A. 26-64, s. 14
In force · effective · read October 3, 2026 · source(cga.ct.gov)
(D) not process sensitive data concerning a consumer unless such processing is reasonably necessary in relation to the purposes for which such sensitive data are processed and without obtaining the consumer's consent
Who it binds, in our words: (2) control or process consumers' sensitive data, excluding personal data controlled or processed solely for the purposes of completing a payment transaction
Connecticut Data Privacy Act, applicability threshold. Conn. Gen. Stat. 42-516, as amended by P.A. 25-113, s. 6
In force · effective · read October 3, 2026 · source(cga.ct.gov)
(2) control or process consumers' sensitive data, excluding personal data controlled or processed solely for the purposes of completing a payment transaction
Who it binds, in our words: (1) Conduct business in this state, or produce products or services that are targeted to residents of this state, and during the preceding calendar year controlled or processed the personal data of not fewer than thirty-five thousand consumers
Definition of sensitive data, which includes consumer health data. Conn. Gen. Stat. 42-515, as amended by P.A. 26-64, s. 12
In force · effective · read October 3, 2026 · source(cga.ct.gov)
means personal data that includes (A) data revealing (i) racial or ethnic origin, (ii) religious beliefs, (iii) a mental or physical health condition, diagnosis, disability or treatment, (iv) sex life, sexual orientation or status as nonbinary or transgender, or (v) citizenship or immigration status, (B) consumer health data
Who it binds, in our words: Controllers within Conn. Gen. Stat. 42-516.
Consumer health data privacy: consent before sale, geofencing limit. Conn. Gen. Stat. 42-526(a)(1)(D)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
(D) sell, or offer to sell, consumer health data without first obtaining the consumer's consent.
Who it binds, in our words: no person shall
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy for Social Security and veterans' benefits claims goes beyond HIPAA and the information blocking fees exception. Deadline is 30 days, not shorter. Undated history entries use the October 1 default in Conn. Gen. Stat. 2-32.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Free copy: Record needed to support a claim or appeal under the Social Security Act, with documentation (providers, 20-7c(d); licensed institutions, 19a-490b(b))
Free copy: Record needed to support a claim or appeal for veterans' benefits under Title 38 USC or chapter 506, with documentation (same sections)
Free copy: Licensed institutions may not deny records for inability to pay; an affidavit is presumptive evidence (19a-490b(d))
Fee rule: 20-7c(d): No provider shall charge more than sixty-five cents per page, including any research fees, handling fees or related costs, and the cost of first class postage; x-ray copies at cost of materials.
Fee rule: 19a-490b(a): No such institution shall charge more than sixty-five cents per page, including any research fees, clerical fees, handling fees or related costs, and the cost of first class postage.
Fee rule: 20-7c(d): a provider returning records a patient brought, or a successor provider returning records, may not charge the patient for copying costs.
Goes beyond the federal floor: yes.
Access to medical records: free copy for Social Security or veterans' benefits claim. Conn. Gen. Stat. 20-7c(d)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
provided no such charge shall be made for furnishing a health record or part thereof to a patient, a patient's attorney or authorized representative if the record or part thereof is necessary for the purpose of supporting a claim or appeal under any provision of the Social Security Act
Who it binds, in our words: a provider
Access to medical records: deadline. Conn. Gen. Stat. 20-7c(d)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
A provider shall furnish a health record requested pursuant to this section within thirty days of the request.
Who it binds, in our words: A provider
Furnishing of health records by licensed institutions: free copy for benefits claims and deadline. Conn. Gen. Stat. 19a-490b(b)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
No institution licensed pursuant to this chapter shall charge for furnishing a health record or part thereof to a patient, his attorney or conservator if the record or part thereof is necessary for the purpose of supporting a claim or appeal under any provision of the Social Security Act
Who it binds, in our words: institution licensed pursuant to this chapter
Furnishing of health records by licensed institutions: per-page fee cap. Conn. Gen. Stat. 19a-490b(a)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
No such institution shall charge more than sixty-five cents per page, including any research fees, clerical fees, handling fees or related costs, and the cost of first class postage, if applicable, for furnishing or providing access to a health record pursuant to this subsection
Who it binds, in our words: an institution licensed pursuant to this chapter
Furnishing of health records by licensed institutions: inability to pay. Conn. Gen. Stat. 19a-490b(d)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
No institution may deny a person the records available under subsection (a) of this section because of the person's inability to pay the required fees.
Who it binds, in our words: institution licensed pursuant to this chapter
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute sets no routine consent rule (17b-59e(d) only excuses sharing where other law requires consent), so the value comes from Connie policy. The dated OHS pages (June 9, 2024) name Connie as the designated statewide HIE and point to the opt-out form. P.A. 26-68, s. 79 moved HIE authority from OHS to OPM on July 1, 2026; the act keeps OHS orders in force under OPM, and no OPM page on Connie was found. Connie says it does not collect federally protected (42 CFR Part 2) substance use data; that is a federal rule, and no state consent step for a sensitive category was established, so stricterForSensitive is left null.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: Connie.
Office of Health Strategy knowledge base, How to opt out of Connie. OHS knowledge base article dated June 09, 2024
In force · effective · read October 5, 2026 · source(portal.ct.gov)
Individuals who do not want their data shared with their health care providers through Connie can complete the Connie opt-out form
Who it binds, in our words: Everyone whose data is in Connie; the page links the online opt-out form at connect.conniect.org/OptoutForm.
Office of Health Strategy knowledge base, About Connie. OHS knowledge base article dated June 09, 2024
In force · effective · read October 5, 2026 · source(portal.ct.gov)
Connecticut's designated statewide health information exchange (HIE)
Who it binds, in our words: Names Connie as the designated statewide HIE under Conn. Gen. Stat. 17b-59d.
Electronic health record systems; connection to the State-wide Health Information Exchange. Conn. Gen. Stat. 17b-59e(d)
In force · current version date not confirmed · read October 5, 2026 · source(cga.ct.gov)
affirmative consent from the patient is legally required and such consent has not been obtained
Who it binds, in our words: Health care providers required to connect to the exchange; the statute sets no routine consent rule and only excuses sharing where other law forbids it or requires consent.
Connie, Opt Out page. Connie patient opt-out page
In force · current version date not confirmed · read October 5, 2026 · source(conniect.org, reached from portal.ct.gov)
Once you opt-out, your health information will be deleted from Connie within 5 business days.
Who it binds, in our words: Patients; page undated. Public health reporting and prescription monitoring data continue after opt-out.
Connie, Patient FAQs, Opt Out. Connie patient FAQ
In force · current version date not confirmed · read October 5, 2026 · source(conniect.org, reached from portal.ct.gov)
If a patient opts out, they are opted out of every aspect of data sharing that is not otherwise required by law.
Who it binds, in our words: Patients; page undated. Same page says state law does not allow opting out of the prescription monitoring program.
Public Act 26-68, Office of Policy and Management as successor to the Office of Health Strategy for the State-wide Health Information Exchange. P.A. 26-68 (2026 SB 1), successor-agency section; s. 79 amending Conn. Gen. Stat. 17b-59d
In force · effective · read October 5, 2026 · source(cga.ct.gov)
shall continue in force and effect as an order, decision, agreed settlement or regulation of the Office of Policy and Management until amended, repealed or superseded pursuant to law
Who it binds, in our words: OHS orders and decisions on the State-wide Health Information Exchange carry over to OPM from July 1, 2026; the act sets no consent rule.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure in civil, probate, legislative or administrative proceedings needs the patient's explicit written consent, subject to listed exceptions.
Disclosure of reproductive or gender-affirming health care information in proceedings. Conn. Gen. Stat. 52-146w(a)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
in any civil action or any proceeding preliminary thereto or in any probate, legislative or administrative proceeding, no covered entity or business associate, as defined in 45 CFR 160.103, shall disclose (1) any communication made to such covered entity or business associate
Who it binds, in our words: covered entity or business associate, as defined in 45 CFR 160.103
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure needs the patient's consent, except as listed in 52-146f to 52-146i.
Psychiatric and psychological communications and records: consent to disclose. Conn. Gen. Stat. 52-146e(a)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
no individual shall disclose or transmit any communication or record thereof, or the substance or any part or resume thereof, that identifies a person or patient to any individual, corporation or governmental agency without the consent of the person or patient or his or her authorized representative.
Who it binds, in our words: Communications and records as defined in 52-146d.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Disclosure is limited to the listed recipients. Chapter 368x was not in the 2026 Supplement.
Limitations on disclosure of HIV-related information. Conn. Gen. Stat. 19a-583(a)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
No person who obtains confidential HIV-related information may disclose or be compelled to disclose such information, except to the following:
Who it binds, in our words: Any person who obtains confidential HIV-related information.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
P.A. 26-64 also bars disclosure of test results to others without express consent and bars disclosure to employers and insurers. 38a-833 covers listed non-health insurance lines.
Direct-to-consumer genetic testing companies: separate express consent to disclose genetic data. P.A. 26-64, s. 19(a)(5)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
(5) In addition to the express consent required under subdivision (4) of this subsection, separately obtain a consumer's express consent to (A) disclose or transfer the consumer's genetic data to any person other than a vendor or service provider for the company
Who it binds, in our words: any person doing business in this state who, in the ordinary course of such business, (i) offers genetic testing directly to a consumer, or (ii) collects, uses or analyzes genetic data that a consumer has provided to such person
Insurers: nonconsensual use of direct-to-consumer genetic test information. Conn. Gen. Stat. 38a-833(1)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
request, require, purchase or use information obtained from an entity providing direct-to-consumer genetic testing without the informed written consent of the individual who has been tested
Who it binds, in our words: No insurer, health care center or fraternal benefit society doing business in this state
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Suits are available only for psychiatric records and HIV information. The CTDPA, consumer health data, genetic testing and breach laws are enforced by the Attorney General only.
Damages a court may award: None set. 52-146j(b) and 19a-590 allow civil damages for injury; no fixed amount.
Psychiatric communications and records: civil damages. Conn. Gen. Stat. 52-146j(b)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Any individual aggrieved by a violation of any provision of sections 52-146d to 52-146i, inclusive, may prove a cause of action for civil damages.
Who it binds, in our words: Violations of 52-146d to 52-146i (psychiatric and psychological communications and records).
HIV-related information: private cause of action. Conn. Gen. Stat. 19a-590
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Any person, except as otherwise provided in this chapter, who wilfully violates any provision of this chapter shall be liable in a private cause of action for injuries suffered as a result of such violation.
Who it binds, in our words: Wilful violations of chapter 368x (HIV-related information).
CTDPA and consumer health data: no private right of action. Conn. Gen. Stat. 42-525(d)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Nothing in sections 42-515 to 42-524, inclusive, or section 42-526, shall be construed as providing the basis for, or be subject to, a private right of action for violations of said sections or any other law.
Who it binds, in our words: Sections 42-515 to 42-524 and 42-526.
Direct-to-consumer genetic testing: no private right of action. P.A. 26-64, s. 19(b)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Any violation of subsection (a) of this section shall be deemed an unfair or deceptive trade practice under subsection (a) of section 42-110b of the general statutes and shall be enforced solely by the Attorney General.
Who it binds, in our words: Direct-to-consumer genetic testing companies.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both medical information and health insurance identifiers are in the definition. HIPAA-compliant entities are deemed compliant but must also notify the Attorney General. Section 36a-701b is not in the 2026 Supplement.
Deadline to tell people: without unreasonable delay but not later than sixty days after discovery.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Breach of security: definition of personal information. Conn. Gen. Stat. 36a-701b(a)(2)(A)(vii)-(viii)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
(vii) medical information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; (viii) health insurance policy number or subscriber identification number, or any unique identifier used by a health insurer to identify the individual
Who it binds, in our words: Any person who owns, licenses or maintains computerized data that includes personal information
Breach of security: notice deadline. Conn. Gen. Stat. 36a-701b(b)(1)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Such notice shall be made without unreasonable delay but not later than sixty days after the discovery of such breach, unless a shorter time is required under federal law
Who it binds, in our words: Any person who owns, licenses or maintains computerized data that includes personal information
Breach of security: notice to Attorney General. Conn. Gen. Stat. 36a-701b(b)(2)(A)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
shall, not later than the time when notice is provided to the resident, also provide notice of the breach of security to the Attorney General
Who it binds, in our words: The person who owns, licenses or maintains computerized data that includes personal information
Breach of security: HIPAA and HITECH compliance deemed compliance. Conn. Gen. Stat. 36a-701b(h)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Any person that is subject to and in compliance with the privacy and security standards under the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act
Who it binds, in our words: Persons subject to HIPAA and HITECH, who must still notify the Attorney General.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No. A law is in force, but it has none of the three rules.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
CTDPA lets a person question a profiling decision on health care services, but requires no human review, clinician role or AI disclosure. P.A. 26-15 companion rules take effect 2027-01-01.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: not found.
You can reach a human, or have a human review the decision: not found.
CTDPA: rights after profiling in furtherance of an automated decision. Conn. Gen. Stat. 42-518(a)(6), as amended by P.A. 26-64, s. 13
In force · effective · read October 3, 2026 · source(cga.ct.gov)
if the consumer's personal data were processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly significant effect concerning the consumer, and if feasible, (A) question the result of such profiling
Who it binds, in our words: Controllers within Conn. Gen. Stat. 42-516.
CTDPA: decisions covered include health care services. Conn. Gen. Stat. 42-515, as amended by P.A. 26-64, s. 12
In force · effective · read October 3, 2026 · source(cga.ct.gov)
means any decision made by the controller, or on behalf of the controller, that results in the provision or denial by the controller of any financial or lending service, any housing, any insurance, any education enrollment or opportunity, any criminal justice, any employment opportunity or any health care service.
Who it binds, in our words: Controllers within Conn. Gen. Stat. 42-516.
AI companions and minors: limit on offering mental health services. P.A. 26-15, s. 6(a)(1)(B)
Signed, not yet in force · effective · read October 3, 2026 · source(cga.ct.gov)
(B) Offering mental health services to such user, unless (i) such artificial intelligence companion is designed to deliver mental health services to users
Who it binds, in our words: operator of an artificial intelligence companion, where the operator knows, or has reason to believe, that the user is younger than eighteen years of age
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine. Each strip shows the 50 states as gray dots and this state as the dark dot, low on the left, high on the right; the numbers under it are the lowest and highest of the 50 states.
Figure
Value
Among the 50 states
Source and period
People under 65 without health insuranceHealth care access and quality
7.0%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
94.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
90.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
7.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$90,213 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.3%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
8.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
22.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. In force The state offers a way to ask registered data brokers to delete your data.
Data broker registration with Department of Consumer Protection. P.A. 26-64, s. 2(a)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
no data broker shall sell or license brokered personal data in this state on or after January 1, 2027, unless the data broker is actively registered with the Department of Consumer Protection
Who it binds, in our words: data broker
Accessible deletion mechanism program. P.A. 26-64, s. 5(a)(1)
In force · effective · read October 3, 2026 · source(cga.ct.gov)
Not later than July 1, 2028, the Commissioner of Consumer Protection shall establish an accessible deletion mechanism program.
Who it binds, in our words: registered data brokers and data service providers
Who to contact in Connecticut
Start with your provider. If you are refused or get no answer, there are two federal offices. Our contacts page lists them, with what we found for Connecticut. Not legal advice. See Connecticut on our contacts page.
Questions people ask
Short answers from the research on this page. Not legal advice.
Can I get a copy of my health record in Connecticut?
Yes. HIPAA, the federal law, gives you that right in all 50 states and DC. The provider has 30 days, plus one 30-day extension, and may charge a cost-based fee. As of October 3, 2026, Connecticut law adds more: you get a free copy of your record in some cases. Source: Conn. Gen. Stat. 20-7c(d), read October 3, 2026. The full answer.
Can I opt out of the health information exchange in Connecticut?
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Our own words are CC BY 4.0; quoted law and source titles stay with their owners.
