Privacy Law Library

Health Records (patient access, confidentiality, and retention)

IN Health Records

Health

Indiana's health records article gives patients a right to copies of their records and sets confidentiality rules for mental health records. It requires written consents with specified content, limits providers' business use of records, and requires providers to keep records for seven years. Since July 1, 2025, providers may not charge for digital copies or interoperability access to electronic health records.

Where
Indiana
Citation
Ind. Code art. 16-39 (IC 16-39-0.1-1 to 16-39-11)
Status
In force
Last amended
2026-07-01
Enforced by
Indiana Department of Health (fines for access violations); professional licensing boards (retention); Department of Insurance (copy fee rules)
People can sue
Limited
Penalties
The state health department may fine a provider up to $5,000 for failing to give patients their records (IC 16-39-1-1(f)); failing to keep records 7 years is grounds for licensing discipline (IC 16-39-7-1(c)). Private remedies are not expressly created in the provisions reviewed.
Applies to
  • Health care providers holding patient health records (IC 16-39-1-1); mental health records are governed by IC 16-39-2 through 16-39-4
  • Communicable disease records are governed by IC 16-41-8, and substance use disorder records by 42 CFR Part 2 (IC 16-39-1-1(b))

Rights it gives people

  • On written request, give patients (or their designee) copies of their health records within 30 days, with one 30-day extension if the patient is told why in writing.IC 16-39-1-1(c)-(e)

Practices it requires

  • A patient's written consent to release records must name the parties, purpose, and information, be signed and dated, state that it can be revoked, and give an expiration.IC 16-39-1-4
  • Mental health records are confidential and may be disclosed only with patient consent or as the article allows.IC 16-39-2-3
  • Providers may use records without authorization for legitimate business purposes, such as claims, collections, quality assurance, and research, but must protect confidentiality and disclose identity only when essential.IC 16-39-5-3(c)-(d)
  • Do not charge for a digital copy or interoperability-platform access to an electronic health record; paper copy fees are capped by Department of Insurance rules.IC 16-39-9-2 · From 2025-07-01

Other duties

  • Listed providers must keep original health records for at least seven years.IC 16-39-7-1(b)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Original effective date of the recodified article (P.L.2-1993) not confirmed; left null. | Whether patients have a private cause of action for wrongful disclosure under Indiana common law was not researched.

Research reference, not legal advice.