Privacy Law Library

Uniform Health Care Information Act (providers not subject to HIPAA)

MT UHCIA

Health

Montana's Uniform Health Care Information Act protects patient health information held by providers not covered by HIPAA, limiting disclosure without written patient authorization and giving patients rights to see, copy and correct their records. A 2025 amendment extends its confidentiality rules to mental health and substance-use apps and websites.

Where
Montana
Citation
Mont. Code Ann. 50-16-501 to 50-16-553
Status
In force
In force since
1987-10-01
Last amended
2025-10-01
Enforced by
Attorney General or county attorney (civil, 50-16-552); private plaintiffs (50-16-553)
People can sue
Yes
Penalties
Aggrieved persons recover pecuniary losses plus up to $5,000 for willful or grossly negligent violations, and attorney fees, within 3 years (50-16-553). Obtaining health information by bribery, theft or misrepresentation, or presenting a false authorization, is a misdemeanor up to $10,000 and 1 year (50-16-551).
Applies to
  • Health care providers that are not subject to HIPAA privacy rules (50-16-505)
  • Since HB 397 (Ch. 273, L. 2025), mental health digital services (apps and websites that collect mental health or substance use information, market themselves as facilitating such services, and use the data to facilitate diagnosis or treatment) are subject to the part's disclosure and confidentiality rules (50-16-546)

What a privacy notice must say

  • Post a notice of information practices in the facility and provide a copy to patients on request.Mont. Code Ann. 50-16-512 · Only if: Provider operates a health care facility and keeps patient records

Rights it gives people

  • Patients may examine and copy their records and request correction or amendment.Mont. Code Ann. 50-16-541, 50-16-543

Practices it requires

  • Do not disclose patient health care information without written authorization except as permitted by statute, and keep a 3-year record of those who received or examined the information.Mont. Code Ann. 50-16-525, 50-16-526
  • Mental health digital services must follow the part's disclosure and confidentiality provisions when handling health care information.Mont. Code Ann. 50-16-546(1), (3) · Only if: App or website meets the mental health digital service definition · From 2025-10-01

Security duties

  • Maintain reasonable safeguards for the security of all health care information.Mont. Code Ann. 50-16-511

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Effective dates inferred from history notes (En. Ch. 632, L. 1987; 50-16-546 En. Ch. 273, L. 2025) and the default October 1 rule; HB 397 text has no effective-date section. | Text of 50-16-529/530 exceptions and 50-16-541 timelines not summarised.

Research reference, not legal advice.