Health Records and Identifying Information Protection (abandoned records)
IN Abandoned Records
Health · Data security
When a health care provider or regulated professional abandons patient health records or other records containing personal information (including by treating them recklessly or negligently so strangers can reach them), the Attorney General may take, store, protect, and eventually destroy them. The AG notifies affected people and recovers costs from the provider.
- Where
- Indiana
- Citation
- Ind. Code ch. 4-6-14 (IC 4-6-14-1 to 4-6-14-15)
- Status
- In force
- Enforced by
- Indiana Attorney General
- People can sue
- No
- Penalties
- The Attorney General may seize abandoned records and sue the responsible provider to recover costs (IC 4-6-14-10.5); licensing boards impose a fee on disciplined providers to fund the program (IC 4-6-14-10).
- Applies to
- Health care providers and regulated professionals whose health records or records containing personal information (as defined in IC 24-4.9-2-10) are abandoned (IC 4-6-14-1 to 4-6-14-4)
Security duties
- Providers must not abandon health records or personal-information records by surrendering them or handling them recklessly or negligently so unauthorized people could access them; otherwise the Attorney General may take custody.IC 4-6-14-1, 4-6-14-5
Other duties
- Providers who abandon health records are liable for the Attorney General's costs of securing and handling them.IC 4-6-14-10.5
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: The original effective date of P.L.84-2010 was not confirmed.
Research reference, not legal advice.