The 50-State Healthcare Compliance Atlas.

Alabama was the last U.S.

Data Breach Notification Act of 2018

Alaska has no state-specific medical-information privacy statute beyond HIPAA, and no health-data-only breach rule.

Information Protection Act

Arizona broadened its breach statute in 2018 to add medical information, health insurance identifiers, biometric data, and online credentials.

Data Breach Notification Statute

Arkansas's Personal Information Protection Act adds 'medical information' to the categories triggering breach notification but does not impose health-information-specific privacy rules beyond HIPAA.

Information Protection Act

California is the most demanding state for healthcare data.

of Medical Information Act · Medical Information Breach Notice

Colorado pairs one of the strictest general breach-notification windows in the country (30 days) with the Colorado Privacy Act, which classifies health data as sensitive consumer data requiring opt-in consent — but only for data outside HIPAA's PHI scope.

Data Breach Notification Statute · Privacy Act

Connecticut's healthcare overlay sits in two places: a 60-day breach window aligned with HIPAA's federal clock plus AG notice, and the Connecticut Data Privacy Act, which covers consumer-health data falling outside HIPAA.

Data Breach Notification Statute · Data Privacy Act

Delaware modernized its breach statute in 2018 to add medical history and health insurance identifiers and to impose a 60-day notice clock.

Computer Security Breaches Statute

Florida's FIPA is one of the most aggressive breach statutes in the country, with a 30-day notice clock (with a 15-day discretionary extension on good cause shown to the AG).

Information Protection Act · Ownership and Control of Patient Records Statute

Georgia has no comprehensive state-specific medical-information privacy statute beyond HIPAA.

Personal Identity Protection Act

Hawaii has no state-specific medical-information privacy statute beyond HIPAA.

Security Breach of Personal Information

Idaho has no state-specific medical-information privacy statute beyond HIPAA.

Identity Theft Statute

Illinois has two statutes that put healthcare-adjacent practices in the country's most litigated privacy environment: BIPA for biometrics (fingerprint timeclocks, facial-recognition check-in, voiceprint authentication) and GIPA for genetic information.

Information Privacy Act · Information Privacy Act

Indiana has no comprehensive state-specific medical-information privacy statute beyond HIPAA.

Disclosure of Security Breach Statute

Iowa has no state-specific medical-information privacy statute beyond HIPAA.

Personal Information Security Breach Protection

Kansas has no state-specific medical-information privacy statute beyond HIPAA.

Consumer Information Security Breach Notification

Kentucky has no state-specific medical-information privacy statute beyond HIPAA.

Personal Information Security and Breach Investigation Statute

Louisiana has no state-specific medical-information privacy statute beyond HIPAA but does impose a firm 60-day individual notice window plus a 10-day post-individual-notice clock for AG notice.

Database Security Breach Notification Law

Maine pairs a 30-day breach notice clock — one of the shortest in the country — with required regulator and consumer reporting agency notice.

Notice of Risk to Personal Data Act

Maryland is one of the handful of states that maintain a free-standing healthcare confidentiality statute alongside HIPAA — the Maryland Confidentiality of Medical Records Act creates a private right of action that HIPAA itself does not.

Confidentiality of Medical Records Act · Personal Information Protection Act

Massachusetts is the state most often cited as having gone furthest on prescriptive cybersecurity rules.

for the Protection of Personal Information of Residents of the Commonwealth · Data Breach Notification Statute

Michigan has no state-specific medical-information privacy statute beyond HIPAA.

Identity Theft Protection Act

Minnesota's Health Records Act runs alongside HIPAA and in some scenarios — particularly release-of-records consent — is stricter than the federal Privacy Rule.

Health Records Act · Breach Notification Statute

Mississippi has no state-specific medical-information privacy statute beyond HIPAA.

Breach Notification Statute

Missouri has no comprehensive state-specific medical-information privacy statute beyond HIPAA.

Personal Information Breach Notification Statute

Montana has no comprehensive state-specific medical-information privacy statute beyond HIPAA.

Impediment of Identity Theft Statute

Nebraska has no state-specific medical-information privacy statute beyond HIPAA.

Financial Data Protection and Consumer Notification of Data Security Breach Act

Nevada's SB 370 (often referenced in early press coverage as SB 538) is a Washington MHMDA-style law that captures consumer health data sitting outside HIPAA's PHI scope — wellness app data, fitness data, certain employer health programs.

Security and Privacy of Personal Information · Consumer Health Data Privacy Law

New Hampshire has no state-specific medical-information privacy statute beyond HIPAA.

Hampshire Right to Privacy / Notice of Security Breach

New Jersey has no comprehensive state-specific medical-information privacy statute beyond HIPAA but does have an unusual procedural quirk: breach notice to the New Jersey State Police is required before individual notice.

Jersey Identity Theft Prevention Act

New Mexico has no comprehensive state-specific medical-information privacy statute beyond HIPAA but does impose a 45-day breach notice clock — one of the shorter ones in the country.

Mexico Data Breach Notification Act

New York's overlay is two related but separate obligations.

York Information Security Breach and Notification Act · Hacks and Improve Electronic Data Security

North Carolina has no state-specific medical-information privacy statute beyond HIPAA.

Carolina Identity Theft Protection Act

North Dakota has no state-specific medical-information privacy statute beyond HIPAA.

Dakota Notice of Security Breach

Ohio is one of the few states to use a carrot-and-stick approach.

Breach of Security Statute · Data Protection Act

Oklahoma has no state-specific medical-information privacy statute beyond HIPAA.

Security Breach Notification Act

Oregon has no state-specific medical-information privacy statute beyond HIPAA but does impose a 45-day breach notice clock with a 250-resident AG notice threshold.

Consumer Information Protection Act

Pennsylvania amended its breach statute in 2023 to add medical information and health insurance identifiers to the personal-information definition, plus AG notice and credit-monitoring obligations.

Breach of Personal Information Notification Act

Rhode Island's Identity Theft Protection Act imposes a 45-day breach notice clock plus a risk-based reasonable-security duty that operates as a standing obligation independent of any incident.

Island Identity Theft Protection Act of 2015

South Carolina has no state-specific medical-information privacy statute beyond HIPAA.

Carolina Breach Notification Statute

South Dakota has no state-specific medical-information privacy statute beyond what HIPAA preempts.

Dakota Breach of Information Disclosure

Tennessee imposes a 45-day breach notice clock generally, but explicitly defers to HIPAA's 60-day window for covered entities — making it one of the cleaner state-federal interlocks.

Identity Theft Deterrence Act / Breach Notification

Texas HB 300 broadens HIPAA in three notable ways: a wider definition of covered entity that catches Texas businesses HIPAA itself would not, mandatory biennial training, and a stricter 15-business-day patient access window for electronic records.

Medical Records Privacy Act / HB 300 · Identity Theft Enforcement and Protection Act

Utah's posture for clinical providers is the HIPAA baseline plus the state's reasonable-security and breach-notice duties.

Protection of Personal Information Act · Consumer Privacy Act

Vermont pairs a 45-day individual notice clock with one of the shortest regulator-notice windows in the country: preliminary AG notice within 14 business days of discovery.

Security Breach Notice Act

Virginia was the second state in the country to pass a comprehensive consumer privacy law.

Breach of Personal Information Notification · Consumer Data Protection Act

Washington's MHMDA is the most aggressive consumer-health privacy regime in the country — opt-in consent for collection and sharing of any consumer health data outside HIPAA's scope, a geofencing prohibition around healthcare facilities, and a private right of action.

Data Breach Notification Statute · My Health My Data Act

West Virginia has no state-specific medical-information privacy statute beyond HIPAA.

Virginia Breach of Security of Consumer Information

Wisconsin's Patient Health Care Records statute runs alongside HIPAA and is stricter on release-of-records consent in some scenarios.

Patient Health Care Records · Notice of Unauthorized Acquisition of Personal Information

Wyoming has no state-specific medical-information privacy statute beyond HIPAA.

Breach of Security Notification