AL None N/A AK None N/A AZ None N/A AR None N/A CA Health and Safety Code 1280.15 Civil Code 56.101 Civil Code 56.13 Civil Code 56.17 Civil Code 56.20 Requires clinics and health facilities to report any unlawful or unauthorized access, use or disclosure of a patient s medical information to the affected patient and the state within five business days of the clinic or facility s detection of the breach. Makes providers, health plans, pharmaceutical companies and contractors liable for negligently creating, maintaining, preserving, storing, abandoning, destroying or disposing of medical information. Prohibits an authorized recipient of Protected Health Information (PHI) from further disclosing that information without a new authorization. Provides for possible civil and criminal penalties for a health care service plan s negligent or willful disclosure of genetic test results without written authorization. Requires employers who receive medical information to establish procedures to protect the information, including training of employees and agents and security systems that restrict access to files containing medical information. CO CRSA 18-4-412 Makes obtaining a medical record or medical information with the intent to appropriate the information, steal it, disclose it to an unauthorized person or make an unauthorized copy a Class 6 felony. CT CGSA 38a-983 Requires insurance companies, agents and support organizations to provide an accounting of all disclosures of PHI over the past two years and a summary of how to request correction, amendment or deletion of PHI within 30 days of a written request. CGSA 38a-984 CGSA 38a-988a Requires insurance companies, agents and support organizations to, within 30 days of a written request to correct, amend or delete PHI, either make the requested change or allow the individual to submit a statement specifying what he or she believes is the correct, relevant or fair information. The insurance company, agent or support organization must then provide notice of the modification or the individual s statement to any person who may have received or furnished the disputed PHI within the previous two years. Provides a private cause of action against a person who discloses PHI for marketing purposes without authorization. AOA DIVISION OF STATE GOVERNMENT AFFAIRS AUGUST 2012
CGSA 38a-993 CGSA 38a-999 CGSA 38a-999a DE 16 Del. C. 1232/1212 Provides for civil penalties for the negligent or intentional violation of the Connecticut Insurance Information and Privacy Protection Act. Requires insurance companies, agents, and support organizations to develop policies, standards and procedures to protect PHI, including appropriate training of employees. Prohibits intentionally disclosing PHI with malicious intent to damage an individual s reputation or character. Violators are subject to fines or imprisonment. A person who has received PHI from the state may not disclose the information to another person without the patient s authorization, except as authorized by law. FL FSA 456.057(11) Requires employees of record owners to be trained in confidentiality and security policies, standards and procedures. GA Ga. Code Ann. 31-33-2 Ga. Code Ann. 31-33-5 Ga. Code Ann. 31-7-285 Requires a request for medical records to be accompanied by a HIPAA authorization and a signed written authorization that states that the person requesting the records is authorized to have access to the records. Any provider is justified in relying upon this written authorization. Any provider who releases PHI in good faith and pursuant to the state s requirements is immune from civil and criminal liability. Provides that an individual whose health information is reported to the state s Health Care Data System but does not identify the person by name or address has no cause of action against a person, entity or provider who reported the information without malice or willful intent to injure. HI None N/A ID None N/A IL 210 ILCS 85/6.17 A hospital staff member, agent or employee who willfully or wantonly discloses hospital or medical information, except as provided by this statute, is guilty of a Class A misdemeanor. 215 ILCS 5/1009 Requires insurance companies, agents and support organizations to provide the names of the individuals or organizations who received personal information over the prior two years, within 30 business days of a written request. 410 ILCS 305/13 Provides a private right of action against a person who negligently, intentionally or recklessly discloses the identity of the subject of an AIDS/HIV test or the results of such a test in a manner that permits identification of the subject of the test. 410 ILCS 513/40 Provides a private right of action against a person who unlawfully discloses a patient s genetic information. 740 ILCS 110/15 Provides a private right of action against a person who unlawfully discloses information concerning a patient s mental health or developmental disability. IN IC 16-41-8-1 Provides that a person who is responsible for recording, reporting or
IC 16-39-5-3 maintaining communicable disease information and recklessly, knowingly or intentionally discloses or fails to keep this information confidential commits a Class A misdemeanor. Provides that a person who fails to protect the identity of an individual whose information is reported as part of a public health project commits a Class C infraction. IA ICA 141A.11 Provides for possible civil and criminal penalties and a private right of action against a person who unlawfully discloses information concerning AIDS/HIV testing. KS KSA 59-2979 Makes the willful unlawful disclosure of mental health records a Class C misdemeanor. KY None N/A LA LSA-RS 22:1023 Provides a cause of action against any person who negligently collects, stores or analyzes a DNA sample or discloses genetic information without informed written consent. ME 5 MRSA 19203-D Requires providers and others with access to records containing HIV status to have a written policy with disciplinary procedures for violation of the confidentiality policy. 22 MRSA 1711-C Provides for civil penalties and a private cause of action against an individual who unlawfully discloses health care information. MD MD Code, Insurance 4-403 MD Code, Insurance 14-138 Provides a private cause of action against an insurer that knowingly and unlawfully discloses an insured s medical information or claims records. Provides a private cause of action against a nonprofit insurer that knowingly and unlawfully discloses an insured s medical information or claims records. MA MGLA 175I 8 Requires insurance companies, agents and support organizations to provide the names of the individuals or organizations who received personal information over the prior two years, within 30 business days of a written request. MI MCLA 333.26265 Provides patients and authorized patient representatives the right to examine or obtain the patient s medical records. Also requires health care providers and facilities to respond within 30 days, or 60 days if records are stored off-site. MCLA 333.26271 Exempts third party payers, insurers and self-funded plans from the Medical Records Access Act. MN MSA 144.292 Requires providers to give a patient complete and current information concerning the patient s diagnosis, treatment and prognosis in terms and language that the patient can reasonably be expected to understand. MSA 144.293 Requires providers to document in a patient s health record when they release the records as authorized by law, but without the patient s consent. Also permits a provider or group purchaser to release patient information to a record locator service, unless the patient chose to be excluded from the service.
MSA 144.298 MS Miss. Code Ann. 41-119-11 Provides a cause of action for compensatory damages, costs and reasonable attorney fees against a person who negligently or intentionally violates the Minnesota Health Records Act in connection with a request for or release of a health record, forges or materially alters another person s consent form without their consent, or obtains another person s consent form or records under false pretenses. Also provides the same against a health information exchange or record locator service that negligently or intentionally fails to give a patient the option of opting out of the record locator service or fails to remove the patient s information from the record service if the patient opts out. Exempts the Mississippi Health Information Network (MS-HIN) from the requirement to provide patients with their personal medical information or records. MO VAMS 191.227 Requires providers to provide a patient or authorized representative with a copy of the patient s medical record, if doing so is consistent with the patient s condition and sound therapeutic treatment. VAMS 191.656 VAMS 334.097 VAMS 375.1309 Provides a cause of action against a person who unlawfully discloses information regarding a patient s HIV test. Requires physicians to maintain a complete patient record for each patient. Permits records to be stored electronically only if they are capable of being printed for review by the state board. Permits the Director of Insurance, Financial Institutions and Professional Registration to issue an executive order or file a civil suit to prevent the unlawful disclosure of genetic information. MT MCA 50-16-541 Requires a provider to respond to a patient s written request to copy or examine health information within 10 days. Also requires the provider to provide an explanation of any code or abbreviation used in the information upon request. MCA 50-16-543 MCA 50-16-551 through 50-16-553 NE Neb. Rev. St. 71-8403 Requires a provider to respond to a patient s written request to amend a health care record within 10 days. Provide for criminal penalties, civil enforcement and a private right of action for violations of the Uniform Health Care Information Act. Requires a provider to respond to a written request to examine records within 10 days and respond to a request for a copy of records within 30 days. NV NRS 629.061 Requires a provider to make records available for inspection within five working days, or 10 working days if the records are stored in another state. NRS 630.405 NRS 439.590 NRS 439.591 Makes a physician s willful violation of NRS 629.061 a misdemeanor. Makes the unauthorized access of an electronic health record or a health exchange a misdemeanor. Also provides an action for damages that result from the unauthorized access. Requires a patient to provide informed consent before having his or her health care records included or transmitted in a health
NH NH Rev. Stat. 332- I:1 NH Rev. Stat. 332- I:2 NH Rev. Stat. 332- I:3 NH Rev. Stat. 332- I:4 information exchange. Also requires a patient to be notified of a breach of confidentiality of records or an exchange in the manner prescribed by the Director of the Department of Health and Human Services. Prohibits the release or use of patient identifiable medical information for sales or marketing purposes without written authorization. Grants a patient the right to obtain a report with information on all health care providers that had access to the patient s electronic medical record over the previous three years. Requires health information organizations to maintain an audit log. Also provides that a patient must be given the option of opting out of sharing information in the health insurance exchange. Requires providers and business associates to obtain an authorization to use protected health information for marketing. Also prohibits health information from being disclosed in an unsecure method of communication. NJ NJSA 17:23A-8 Requires an insurance institution, agent or support organization to respond to an individual s written request to access his or her recorded personal information within 30 business days. NJSA 17:23A-9 NJSA 17:23A-13 NM NMSA 1978 24-14B-6 NY NMSA 1978 24-14B-7 NMSA 1978 14-6-3 Public Health Law, 18 Requires an insurance institution, agent or support organization to respond to a written request to correct, amend or delete personal information within 30 business days. If a change is made or a statement of disputed information is filed, any person who is identified by the individual requesting the change who may have received the information within the past two years must be notified. Requires an insurance institution, agent or support organization to give individuals the opportunity to indicate they do not want their personal information disclosed for marketing purposes. Requires a health information exchange to provide an audit log containing information about the disclosure of the person s health information. Also requires record locator services and health information exchanges to allow individuals to exclude their information within 30 days of a written request. Provides that a record locator service, health information exchange, health care institution or provider that complies with an individual s request to exclude information is not liable for harm caused by the exclusion. Requires a provider to provide a patient or former patient who is applying for SSDI benefits or appealing a denial of SSDI benefits with a copy of his or her medical records within 30 days of the receipt of the request. Also permits the Department of Health to fine a provider $100 for a violation of this section. Requires a provider to allow a patient or a qualified individual to inspect a patient s information within 10 days of a written request
and permits a provider to notify the subject of such a request who is 12 years of age or older, and deny the request if the subject objects to the disclosure. Also permits a qualified person to challenge the accuracy of patient information and insert a statement into the challenged information. NC NCGSA 122C-52 Makes the unlawful disclosure of confidential mental health information a Class 3 misdemeanor punishable by a fine of up to $500. NCGSA 58-39-25, NCGSA 58-39-26 NCGSA 58-39-45 NCGSA 58-39-50 Requires insurance institutions and agents to provide applicants and policyholders with written or electronic notice of their privacy policies. Requires an insurance institution, agent or support organization to respond to a written request for access to recorded personal information within 30 days. Requires an insurance institution, agent or support organization to respond to a request to correct, amend or delete recorded personal information within 30 days. Also requires notice of a change or statement of disagreement to be sent to any person designated by the individual who may have received the information over the past two years. ND NDCC 23-01.3-09 Makes the knowingly unlawful disclosure of protected health information a Class A misdemeanor. NDCC 26.1-36-12.4 Prohibits an insurance company or HMO from issuing or renewing a policy or health service contract unless it adopts and maintains procedures to ensure that all identifiable information maintained by the insurer is adequately protected and remains confidential in compliance with federal and state laws and professional ethical standards. OH RC 1751.521 Requires an insurance company to provide a copy of an enrollee s signed release to a health care facility or provider that requests it in response to the insurer s request for medical information about the enrollee. RC 3701.74 OK 76 Okl. St. Ann. 19, 20 Permits a patient, patient s representative or other person authorized to request a patient s medical record to bring a civil action to enforce the patient s right of access to the record if a provider fails to provide access to or a copy of the patient s medical record within a reasonable time. Grants patients the right to obtain access to their medical records. Makes a provider s refusal to furnish the required records or information a misdemeanor. OR ORS 192.537 Requires a person authorized to obtain, retain or use an individual s genetic information or DNA sample to maintain the confidentiality of the information or sample and protect it from unauthorized disclosure or misuse. ORS 192.539 Prohibits the compelled disclosure of the identity of the subject of a
genetic test or a blood relative of the subject, except under certain circumstances. ORS 192.541 Provides a private right of action to an individual or their blood relative, representative or estate for violation of the state s genetic privacy laws. ORS 192.543 Makes the unlawful acquisition, retention or disclosure of genetic information a Class A misdemeanor. ORS 746.640 Requires an insurer, producer or support organization to provide an individual with access to their recorded personal information within 30 business days of a written request. ORS 746.645 Requires an insurer, producer or support organization to respond to a written request to correct, amend or delete recorded personal information within 30 business days. Also requires notice of a change or a statement of disagreement to be sent to designated persons who may have received the information within the prior two years. PA 35 PS 7607 Prohibits the disclosure of confidential HIV-related information, except under certain circumstances and prohibits the unauthorized subsequent disclosure of such information. Also requires institutional health care providers with access to HIV-related information to establish written procedures for the confidentiality and disclosure of RI Gen. Laws 1956 5-37.3-4 Gen. Laws 1956 5-37.7-7 Gen. Laws 1956 5-37.7-13 SC Code 1976 38-77- 370 Code 1976 44-115- 130 the records. Provides a cause of action for actual and punitive damages, as well as criminal penalties, for the unauthorized release or transfer of confidential health care information. Also requires third parties that receive confidential health care information to establish specific security procedures. Prohibits the sale of patient data in a health information exchange, except as authorized in writing by the patient participant authorization form. Provides a cause of action for actual and exemplary damages, as well as criminal penalties, for the violation of Chapter 37.7. Requires an insurance support organization to provide an individual with information from their recorded personal information in the manner the organization prefers within 30 business days of a written request. Requires a physician to publish notice of intent to sell medical records at least three times in the 90 days preceding the sale. Notice must advise patients that they may retrieve their records if they do not want their records included in the sale. SD None N/A TN TCA 50-1-306 Prohibits employers from selling an employee s identifiable medical information without the patient s consent. Violation of this section is a Class C misdemeanor. TCA 56-7-124 Prohibits insurers and hospitals from selling a patient s identifiable health information without the patient s consent.
TX TCA 63-1-117 TCA 63-2-101 TCA 68-11-1503 Health & Safety Code 181.001 Health & Safety Code 181.101 Health & Safety Code 181.102 Health & Safety Code 181.154 Requires a provider to make patient records available for inspection and copying by the Department of Health. Requires a provider to provide a copy or summary of a patient s medical records within 10 working days of a written request to do so. Requires a provider to have a policy to protect a patient s information and dignity, including the use of de-identified data. Also prohibits the sale of a patient s name, address and other identifying information for any purpose. Defines covered entity to include any person who assembles, collects, analyzes, uses, evaluates, stores, transmits, possesses or stores PHI, including employees, agents and contractors who do so. Requires covered entities to train employees on state and federal PHI law. Requires health care providers who use electronic health records to provide a patient s records in electronic form within 15 days of a written request. Requires a covered entity to provide notice to an individual whose PHI is subject to electronic disclosure. The covered entity may satisfy this requirement by posting a general notice on its website. UT UCA 62A-15-643 Makes the knowing or intentional and unauthorized disclosure of information regarding involuntary commitment a Class B misdemeanor. VT None N/A VA 32.1-127.1:03 32.1-127.1:05 38.2-608 38.2-609 Requires a health care entity to respond to a request for copies of or electronic access to health records within 15 days. Requires government entities that are not HIPAA covered entities or business associates to notify the Commissioner of Health, the Office of the Attorney General, the subject of the medical information and any affected resident in the event of a breach or suspected breach of medical information. Also requires the entity that maintains electronic health data that the entity does not own or license to notify the owner or licensee of the information. Requires an insurance company, agent or support organization to provide the names of the individuals or organizations that their personal information was disclosed to over the previous two years within 30 business days of a written request. Requires insurance companies, agents, and support organizations to, within 30 days of a written request to correct, amend or delete PHI, either make the requested change or allow the individual to submit a statement specifying what he or she believes is the correct, relevant or fair information. The insurance company, agent or support organization must then provide notice of the modification or the individual s statement to any person who may have received or furnished the disputed PHI within the previous two years. Requires an insurer to obtain written authorization before disclosing
38.2-613 genetic information. 38.2-613 Provides a private cause of action against an insurance institution, agent or support organization that violates 38.2-608, 38.2-609, or 38.2-613. WA RCWA 70.02.080 Requires a health care provider to respond to a written request for a copy of a patient s records within 15 working days. WV W.Va. Code 16-3C- 3 Prohibits secondary disclosure of the results of an HIV-related test without authorization. W.Va. Code 33-25A-26 Provides criminal and civil penalties for the unauthorized disclosure of medical information by a health maintenance organization. W.Va. Code 33-25D-25 Provides criminal and civil penalties for the unauthorized disclosure of medical information by a prepaid limited health service organization. WI WSA 146.84 Provides civil and criminal penalties and a private cause of action for WSA 610.70 the unlawful disclosure of confidential health records. Requires an insurer that complies with a request to correct, amend or delete any recorded medical information in the insurer s possession to provide notice of this change to any person who may have received the information within the prior two years and is identified by the individual, any insurance support organization that provided the insurer with the information that was changed, and any insurance support organization that the insurer has systematically provided personal medical information to over the preceding seven years. WY WS 1977 35-2-611 Requires a hospital to respond to a patient s request to examine or copy health records within 10 days.