HIPAA & Medical Privacy by State (2026)

Alabama relies primarily on federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with limited additional state protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities in Alabama
• Alabama has confidentiality protections for HIV/AIDS records (Ala. Code § 22-11A-22)
• Mental health records have protections under Alabama law
• Patients have a right to access their records within 30 days under HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.

Alaska follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations with additional state privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Alaska
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days (with a possible 30-day extension)
• Alaska Stat. § 18.23 provides additional confidentiality protections for health care information
• Alaska's strong constitutional right to privacy (Art. I, § 22) may provide additional protections for health information

Arizona supplements federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with state-specific health privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities operating in Arizona
• Arizona has specific protections for mental health records under A.R.S. § 36-509 — disclosure of mental health records generally requires patient consent or a court order
• Arizona law provides confidentiality protections for HIV/AIDS test results under A.R.S. § 36-664
• Arizona's medical records access law (A.R.S. § 12-2293) gives patients the right to obtain copies of their medical records
• Healthcare providers must provide records within a reasonable time and may charge a reasonable fee for copies
• Arizona protects the confidentiality of substance abuse treatment records consistent with federal 42 C.F.R. Part 2

Arkansas follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Arkansas
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days (with a possible 30-day extension)
• Arkansas law provides additional protections for mental health records under the Mental Health Services Act
• Medical records must be retained for a minimum of 10 years under Arkansas regulations

Colorado supplements federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with comprehensive state health privacy protections, including the Colorado Privacy Act:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities operating in Colorado
• Colorado has additional protections for mental health records under CRS § 27-65-101 et seq. (mental health confidentiality)
• CO law provides specific confidentiality protections for HIV/AIDS test results (CRS § 25-4-1404) and substance abuse treatment records
• The Colorado Privacy Act (CRS § 6-1-1301 et seq., effective July 2023) provides broad consumer data privacy rights including health data
• Patients have a right to access their medical records — providers must respond within 30 days
• Colorado's data breach notification law (CRS § 6-1-716) requires notification within 30 days when health data is compromised — one of the shortest notification deadlines in the country
• Colorado has specific genetic information privacy protections (CRS § 10-3-1104.7)

Connecticut follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with strong additional state privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Connecticut
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• Connecticut law provides additional protections for HIV/AIDS records, mental health records, and genetic information
• Connecticut enacted a comprehensive data privacy law (CTDPA) that provides additional health data protections effective 2023

Delaware follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations with some additional state protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Delaware
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• Delaware's Health Information Privacy Act (Del. Code tit. 16, § 1201 et seq.) provides additional protections for genetic information and HIV/AIDS records
• Delaware enacted a Personal Data Privacy Act effective 2025 with additional health data protections

Florida has state-level health privacy laws that supplement HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.:

• Florida Constitution Art. I, § 23: Florida is one of the few states with an explicit constitutional right to privacy. This has been applied to protect medical information.
• Fla. Stat. § 456.057: Governs the ownership, custody, and disclosure of patient medical records. Patients have the right to access their records, and providers must maintain confidentiality.
• Mental health records: The Baker Act (Fla. Stat. § 394.4615) provides additional confidentiality protections for mental health records created during involuntary examination or treatment.
• HIV/AIDS confidentiality (Fla. Stat. § 381.004(3)): Provides specific confidentiality protections for HIV test results, requiring written informed consent before disclosure.

Hawaii follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations and has a unique employer healthcare mandate:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Hawaii
• You have the right to access and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• Hawaii's Prepaid Health Care Act (1974) requires employers to provide health insurance to employees working 20+ hours per week — the only state with such a mandate (predating the ACA)
• This means most Hawaii workers have employer-provided insurance, giving them greater access to healthcare and related privacy protections
• Hawaii has additional protections for HIV/AIDS-related health information (HRS § 325-101)

Idaho follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations for health information privacy:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Idaho
• You have the right to access and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• Idaho does not have extensive additional state health privacy laws beyond HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.
• Mental health records and substance abuse treatment records receive additional federal protections (42 CFR Part 2)
• Idaho law protects the confidentiality of HIV/AIDS test results (Idaho Code § 39-609)

Illinois has additional health privacy protections beyond federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.:

• Mental Health and Developmental Disabilities Confidentiality Act (740 ILCS 110): Provides heightened confidentiality protections for mental health records. Requires specific written consent for disclosure, with very narrow exceptions.
• Genetic Information Privacy Act (410 ILCS 513): Prohibits genetic discrimination in employment and insurance and provides strong confidentiality protections for genetic test results.
• AIDS Confidentiality Act (410 ILCS 305): Provides extra confidentiality protections for HIV/AIDS-related information, requiring specific written consent for disclosure.
• BIPA implications: The Biometric Information Privacy Act (740 ILCS 14) can apply to healthcare settings that collect biometric data (fingerprints, facial scans), providing an additional layer of privacy protection.

Indiana supplements federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with state health privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities operating in Indiana
• Indiana has additional protections for mental health records under IC § 16-39-2 et seq. (confidentiality of health records)
• IN law provides specific confidentiality protections for HIV test results (IC § 16-41-6)
• Indiana's Health Records Act (IC § 16-39) governs patient access to and confidentiality of medical records
• Patients have a right to access their medical records — providers must respond within 30 days
• Indiana law limits charges for medical record copies
• Indiana's data breach notification law (IC § 24-4.9) requires notification when health data is compromised

Iowa follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations with some additional state protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Iowa
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• Iowa has specific protections for mental health records (Iowa Code § 228) and substance abuse records
• Iowa requires that patients be notified of their privacy rights upon receiving health care services

Kansas follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Kansas
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• Kansas law provides additional protections for mental health records and substance abuse treatment records
• Medical records must be retained for a minimum of 10 years under Kansas regulations

Kentucky supplements HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with state health privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities in Kentucky
• Kentucky has confidentiality protections for HIV/AIDS records (KRS § 214.625)
• Mental health records have protections under KRS Chapter 210
• Patients have a right to access records within 30 days under HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.

Louisiana supplements HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with state health privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities in Louisiana
• Louisiana has a Medical Records Privacy Act (La. R.S. § 40:1165.1 et seq.) with additional patient protections
• HIV/AIDS records have heightened confidentiality under La. R.S. § 40:1099
• Mental health records have additional protections under the Mental Health Law

Maine follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations with additional state protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Maine
• You have the right to access and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• Maine provides additional protections through MaineCare (Maine Medicaid) for enrolled individuals
• Maine has strong mental health confidentiality protections (34-B M.R.S.A. § 1207)
• Maine law protects the confidentiality of HIV/AIDS test results and genetic information

Maryland supplements federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with comprehensive state health privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities operating in Maryland
• The Maryland Confidentiality of Medical Records Act (MD Code, Health-General § 4-301 et seq.) provides additional protections beyond HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.
• MD law provides specific confidentiality protections for mental health records, HIV/AIDS test results, and substance abuse treatment records
• Patients have a right to access their medical records — providers must respond within 21 working days (stricter than HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.'s 30 days)
• MD law limits the fees that providers can charge for medical record copies
• Maryland's data breach notification law (MD Code, Commercial Law § 14-3501 et seq.) requires notification when health data is compromised
• MD has specific protections for genetic information under the MD Genetic Information Nondiscrimination Act

Massachusetts supplements federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with strong state health privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities operating in Massachusetts
• MA has additional protections under MGL c. 111, § 70E (Patients' Bill of Rights) granting patients the right to confidential treatment of medical records
• MA law provides specific confidentiality protections for mental health records (MGL c. 123, § 36), HIV/AIDS status, and substance abuse treatment records
• Patients have a right to access and copy their medical records — providers must respond within 30 days
• MA law limits the cost of medical record copies
• MA has a comprehensive data breach notification law (MGL c. 93H) requiring notification when health data is compromised
• Insurance companies must comply with both HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. and MA-specific privacy requirements

Michigan supplements federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with state health privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities operating in Michigan
• Michigan has specific protections for mental health records under the Mental Health Code (MCL § 330.1748 et seq.) — these records have heightened confidentiality requirements
• HIV/AIDS test results have special protections under Michigan law (MCL § 333.5131)
• Substance abuse treatment records are protected under both federal 42 C.F.R. Part 2 and state law
• Patients have a right to access their medical records; providers must respond within 30 days
• Michigan allows patients to designate a personal representative for healthcare decisions and records access

Minnesota has some of the strongest health privacy protections in the nation under the Minnesota Health Records Act:

• The Minnesota Health Records Act (Minn. Stat. § 144.291 et seq.) provides protections beyond federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.
• Patients must provide specific written consent before health records can be released (stricter than HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.'s general authorization)
• Mental health records have heightened protections under Minn. Stat. § 148B
• Patients have a right to access their records within 30 days
• Minnesota law provides a private right of action for health privacy violations (unlike HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. which has no private right of action)

Mississippi follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Mississippi
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• Mississippi does not have comprehensive additional state health privacy laws beyond HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.
• Medical records must be retained by providers under professional licensing requirements

Missouri supplements federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with state health privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities operating in Missouri
• Missouri has additional protections for mental health records under RSMo § 630.140 (mental health records confidentiality)
• MO law provides specific confidentiality protections for HIV/AIDS test results (RSMo § 191.656)
• Substance abuse treatment records have additional protections under both state and federal law
• Patients have a right to access their medical records under both HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. and MO law
• Missouri law requires healthcare providers to release records within a reasonable time
• Missouri's data breach notification law (RSMo § 407.1500) requires notification when health data is compromised

Montana follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations and has uniquely strong constitutional privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Montana
• You have the right to access and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• Montana's constitutional right to individual privacy (Art. II, § 10) provides additional protections for health information beyond HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.
• Montana courts have interpreted this privacy right broadly to cover medical records and health data
• Montana law provides additional confidentiality protections for mental health records and substance abuse treatment

Nebraska follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations with some additional state protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities (healthcare providers, insurers, clearinghouses) in Nebraska
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days (with a possible 30-day extension)
• Nebraska law provides additional protections for mental health records and substance abuse treatment records
• The Nebraska Health Information Technology Act promotes secure electronic health information exchange

Nevada follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with strong additional state privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Nevada
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• Nevada has enacted comprehensive health data privacy laws — SB 370 (2019) requires data brokers to comply with consumer opt-out requests
• Nevada provides additional protections for genetic information and HIV/AIDS records

New Hampshire follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations with additional state protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in New Hampshire
• You have the right to access and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• New Hampshire has additional insurance protections — the NH Insurance Department regulates health insurance practices
• NH law provides additional confidentiality protections for mental health treatment records and HIV/AIDS information
• New Hampshire Medicaid (NH Healthy Families) provides additional privacy protections for enrolled individuals

New Jersey provides additional health privacy protections beyond federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.:

• NJ Patient's Bill of Rights (N.J.A.C. 8:43G-4.1): Guarantees patients the right to privacy and confidentiality of all medical records and communications. Applies to all licensed healthcare facilities in New Jersey.
• NJ Genetic Privacy Act (N.J.S.A. 10:5-43 to -49): Prohibits genetic information from being used for employment or insurance discrimination. Genetic test results have extra confidentiality protections beyond what HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. provides.
• NJ Identity Theft Prevention Act (N.J.S.A. 56:11-44): Requires notification of data breaches involving personal health information within a specific timeframe. Broader coverage than HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.'s breach notification rule.
• Mental health and substance abuse records: NJ has strong state-level protections for mental health records under N.J.S.A. 30:4-24.3 and aligns with federal 42 C.F.R. Part 2 protections for substance abuse treatment records.

New Mexico follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations with some additional state protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in New Mexico
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• New Mexico has additional protections for behavioral health records and substance abuse treatment records
• The Indian Health Service (significant in NM) follows both HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. and additional federal tribal health privacy rules

New York provides additional health privacy protections through several state laws:

• NY Public Health Law § 18: Gives patients the right to access their medical records within 10 days of a written request (faster than HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.'s 30-day window). Providers can charge no more than $0.75 per page.
• NY SHIELD Act (General Business Law § 899-aa): Expands data breach notification requirements to include health information. Healthcare entities must notify patients of breaches involving their health data, with stricter requirements than HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.'s breach notification rule.
• NY Mental Hygiene Law § 33.13: Provides extra confidentiality protections for mental health records. Mental health information has stricter disclosure rules than general medical records, requiring specific authorization for release.
• HIV/AIDS confidentiality: NY Public Health Law Article 27-F provides exceptionally strong protections for HIV-related information, requiring specific written consent for disclosure separate from general medical record authorizations.

North Carolina supplements federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with state health privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities (healthcare providers, insurers, clearinghouses) operating in NC
• NC has additional confidentiality protections for mental health records under N.C. Gen. Stat. § 122C-52 et seq.
• NC law provides specific protections for HIV/AIDS test results and substance abuse records
• Patients have a right to access their medical records under both HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. and NC law
• Healthcare providers must respond to records requests within 30 days under HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.
• NC law restricts disclosure of minors' health information related to certain treatments (mental health, substance abuse, STIs)

North Dakota follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations with some additional state protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in North Dakota
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• North Dakota has specific confidentiality protections for mental health, substance abuse, and genetic information records
• N.D. Cent. Code § 23-12 provides rules for the handling and disclosure of health information

Oklahoma supplements HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with limited state health privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities in Oklahoma
• Oklahoma has confidentiality protections for HIV/AIDS records (63 Okl. St. § 1-502.2)
• Mental health records have protections under Oklahoma Mental Health Law
• Patients have a right to access records within 30 days under HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.

Oregon supplements HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with state health privacy protections:

• Oregon has a comprehensive Genetic Privacy Act (ORS § 192.531 et seq.) — one of the strongest in the nation
• HIV/AIDS records have heightened confidentiality under ORS § 433.045
• Mental health records have additional protections under ORS Chapter 179
• Patients have a right to access records within 30 days
• Oregon provides a private right of action for health information privacy violations

Pennsylvania supplements HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with additional health privacy protections:

• PA Mental Health Procedures Act (50 P.S. § 7111): Provides heightened confidentiality for mental health records. Disclosure requires specific written consent, with limited exceptions for treatment emergencies.
• Drug and Alcohol Abuse Control Act (71 P.S. § 1690.108): Provides confidentiality protections for substance abuse treatment records, aligning with federal 42 C.F.R. Part 2.
• HIV/AIDS confidentiality (35 P.S. § 7601 et seq.): The Confidentiality of HIV-Related Information Act requires specific written consent for disclosure of HIV-related information, with criminal penalties for violations.
• Breach notification: PA's Breach of Personal Information Notification Act (73 P.S. § 2303) requires notification of breaches involving health information.

Rhode Island follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with additional state health privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Rhode Island
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• Rhode Island's Confidentiality of Health Care Communications and Information Act (R.I. Gen. Laws § 5-37.3) provides additional protections
• Rhode Island has specific protections for mental health, HIV/AIDS, and genetic information records

South Carolina supplements federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with limited state health privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities operating in SC
• SC has confidentiality protections for HIV/AIDS records (S.C. Code § 44-29-135)
• Mental health records have heightened confidentiality under the SC Mental Health Act
• Patients have a right to access their records within 30 days under HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.

South Dakota follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in South Dakota
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• South Dakota does not have comprehensive additional state health privacy laws beyond HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.
• Medical records retention requirements follow professional licensing standards

Tennessee supplements federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with state health privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities operating in Tennessee
• TN has additional protections for mental health records under TCA § 33-3-103 et seq. (confidentiality of mental health records)
• TN law provides specific confidentiality protections for HIV/AIDS test results (TCA § 68-10-113)
• Substance abuse treatment records have additional protections under both state and federal law
• Patients have the right to access their medical records under both HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. and TN law
• TN law requires healthcare providers to respond to records requests within 30 days
• Tennessee's data breach notification law (TCA § 47-18-2107) requires notification when health data is compromised

Utah follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with additional state privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Utah
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• Utah enacted the Utah Consumer Privacy Act (UCPA) effective December 2023, which includes provisions for health data
• Utah has specific protections for mental health and substance abuse records

Vermont follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with strong additional state privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Vermont
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• Vermont has enacted comprehensive health data privacy protections, including the Vermont Health Insurance Claims Database
• Vermont Act 53 (2019) provides additional consumer health data protections

Washington supplements federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with some of the strongest state health privacy protections in the nation:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities operating in Washington
• The Washington My Health My Data Act (2023) provides comprehensive health data privacy protections for data not covered by HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. — including data collected by apps, websites, and non-HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.-covered businesses
• Washington has specific protections for mental health records (RCW 71.05.390) with heightened consent requirements for disclosure
• HIV test results and substance abuse records have strict confidentiality protections
• Washington requires patient consent before sharing health information in many situations where HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. alone would not require consent
• Washington's Uniform Health Care Information Act (RCW 70.02) provides additional patient access and privacy rights

Wisconsin supplements federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. with state health privacy protections:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to covered entities operating in Wisconsin
• Wisconsin has additional protections for mental health records under Wis. Stat. § 51.30 (confidentiality of mental health treatment records)
• WI law provides specific confidentiality protections for HIV/AIDS test results (Wis. Stat. § 252.15) and substance abuse treatment records
• Wisconsin's Patient's Bill of Rights (Wis. Stat. § 51.61) provides comprehensive protections for individuals in mental health facilities
• Patients have a right to access their medical records — providers must respond within 30 days
• Wisconsin's data breach notification law (Wis. Stat. § 134.98) requires notification when personal information, including health data, is compromised

Wyoming follows federal HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. regulations:

• HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records. applies to all covered entities in Wyoming
• You have the right to access, inspect, and obtain copies of your medical records
• Providers must respond to records requests within 30 days
• Wyoming does not have comprehensive additional state health privacy laws beyond HIPAAThe federal Health Insurance Portability and Accountability Act. Its Privacy Rule limits how doctors, hospitals, and insurers can share your health information and gives you the right to see and correct your medical records.
• Wyoming's small population and rural healthcare system mean access and privacy concerns are closely intertwined