Individual Right of Action for Medical Records Access: 50 State Comparison
The HIPAA regulations do not provide an individual right of action for violations of any of the HIPAA provisions; enforcement authority is reserved for the Secretary of HHS via the Enforcement Rule. Individuals may submit complaints about covered entities to the Secretary, but there is no explicit right to sue a covered entity for violating an individual's HIPAA-related rights. This map identifies the states that have provided an individual right of action when an entity inappropriately denies an individual access to his or her medical records, or does not comply with other provisions related to access rights (e.g., providing access within the prescribed time period). The map also identifies those states that do not provide a specific right of action related to access rights. Finally, the map identifies when a state creates a right of action for violations committed by non-HIPAA covered providers.
Note that a state may provide a broad statutory right of action for privacy-related violations that are not explicitly linked to a HIPAA provision, such as a right to sue for invasion of the right to privacy, or for infliction of emotional distress. In some of these states, a violation of a HIPAA right related to privacy or confidentiality could serve as a basis for a right of action under these broad statutes. We do not identify those broad rights of action here, as their application can only be determined on a case-by-case basis depending upon the circumstances.
[Last Updated: 04/03/2013]
Click on a state to see more information on Medical Records Collection, Retention, and Access in that state
- Provides a right of action
- Does not provide a right of action
- Provides a right of action applicable only to non-covered entities
Hide All
| State | State Right of Action Compared to HIPAA | Details |
|---|---|---|
| Alabama | Does not provide a right of action | |
| Alaska | Does not provide a right of action | |
| Arizona | Does not provide a right of action | |
| Arkansas | Does not provide a right of action | |
| California | Provides a right of action | Health & Safety Code §123120: Allows a patient to bring a private right of action against a health care provider who fails to allow the patient to inspect or recieve a copy of his or her medical records pursuant to Health & Safety Code §123110. |
| Colorado | Does not provide a right of action | |
| Connecticut | Does not provide a right of action | |
| Delaware | Provides a right of action | 24 Del. C. § 1761: Allows any aggrieved patient to bring a civil lawsuit for damages or a suit for injunctive relief against a provider who fails to provide access to a patient's medical record. |
| District of Columbia | Does not provide a right of action | |
| Florida | Does not provide a right of action | |
| Georgia | Does not provide a right of action | |
| Hawaii | Does not provide a right of action | |
| Idaho | Does not provide a right of action | |
| Illinois | Provides a right of action | 735 ILCS 5/8-2001: Allows patients to bring a court action to enforce the access and time requirements for patient access to medical records, and allows the patient to recover and expenses and attorney's fees from the denying party. |
| Indiana | Does not provide a right of action | |
| Iowa | Does not provide a right of action | |
| Kansas | Does not provide a right of action | |
| Kentucky | Does not provide a right of action | |
| Louisiana | Provides a right of action | LSA –R.S. 40:1299.96: Allows a patient to obtain a court order if access to a patient's medical record is not provided within 15 days from receipt of a patient's request, the patient submitted notice to the provider that access has not been provided according to the law, and the provider fails to furnish the medical records within 5 days of receiving the notice. The court may also order that the provider pay the patient's reasonable attorney's fees and costs. |
| Maine | Does not provide a right of action | |
| Maryland | Provides a right of action | MD Code, Health-General § 4-309: Allows a health care provider who fails to provide a patient his or her medical record upon written request after 21 working days from the request to be liable for actual damages. |
| Massachusetts | Provides a right of action | M.G.L.A. 111 §70E: Allows a patient of a health care facility (which includes: health care facilities, which include, hospitals, clinics, convalescent or nursing homes, rest homes for the aged licensed or regulated by the Department of Public Health, any private, county or municipal ward licensed or regulated by the Department of Mental Health or by the Department of Developmental Services) to bring a civil lawsuit against the facility if their rights under the law have been violated due to noncompliance with this section. This section includes as a patient's right, the right to inspect and copy one's medical records. |
| Michigan | Does not provide a right of action | |
| Minnesota | Does not provide a right of action | |
| Mississippi | Does not provide a right of action | |
| Missouri | Does not provide a right of action | |
| Montana | Provides a right of action applicable only to non-covered entities | Mont. Code Ann. § 50-16-553: An individual may bring an action for relief against a non-covered health care provider within 3 years of a violation of the individual's right to access his or her medical records. The court may order the provider to grant access, and the individual bringing the suit may recover monetary damages.
|
| Nebraska | Does not provide a right of action | |
| Nevada | Does not provide a right of action | |
| New Hampshire | Provides a right of action | N.H. Rev. Stat. Ann. § 151:30: If a health care facility violates an individual's right to access his or her medical records, the individual may seek equitable relief; the facility will be liable for monetary damages. |
| New Jersey | Does not provide a right of action | |
| New Mexico | Does not provide a right of action | |
| New York | Provides a right of action | N.Y. Pub. Health Law § 18: If a provider denies a patient access to his or her medical records, the patient may seek review of the denial. A court may order a provider to grant the patient access to the record. |
| North Carolina | Does not provide a right of action | |
| North Dakota | Does not provide a right of action | |
| Ohio | Does not provide a right of action | |
| Oklahoma | Does not provide a right of action | |
| Oregon | Does not provide a right of action | |
| Pennsylvania | Does not provide a right of action | |
| Rhode Island | Does not provide a right of action | |
| South Carolina | Does not provide a right of action | |
| South Dakota | Does not provide a right of action | |
| Tennessee | Provides a right of action | Tenn. Code Ann. § 68-11-311: If a hospital or its personnel willfully, recklessly, or wantonly violate an individual's right to access his or her medical records, the hospital will be liable for actual damages in a civil action. |
| Texas | Does not provide a right of action | |
| Utah | Does not provide a right of action | |
| Vermont | Does not provide a right of action | |
| Virginia | Does not provide a right of action | |
| Washington | Provides a right of action | Wash. Rev. Code § 70.02.170: An individual may bring an action against a health care provider who has not complied with the access requirements within two years from the individual discovering that his or her rights were violated; the court may order the provider to grant the individual access, and may award monetary damages. |
| West Virginia | Provides a right of action | W. Va. Code § 16-29-1: A patient may bring an action to enforce his or her right to access, and a health care provider who has violated this right must pay for the cost of the enforcement action. |
| Wisconsin | Provides a right of action | Wis. Stat. § 146.84: Any person who negligently violates a patient's right to access his or her medical records will be liable to the patient for monetary damages of up to $1,000. Any person who knowingly or willfully violates a patient's right to access such records will be liable to the patient for up to $25,000. A patient who's access right has been violated may also bring an action to enforce his or her rights. |
| Wyoming | Provides a right of action | Wyo. Stat. Ann. § 35-2-616: Any patient whose right to access his or her medical records has been violated may bring an action for relief within two years after the violation occurs. The court may order the entity to grant the patient access, and may grant the patient monetary damages. |
.png)