Arizona HIPAA laws combine the federal Health Insurance Portability and Accountability Act with state statutes that, in several places, give patients stronger rights than federal law alone. HIPAA sets a nationwide floor for medical privacy. Arizona builds on that floor with faster record turnaround, free copies for continuing care, tighter behavioral health confidentiality, and a shorter breach notification deadline. When state law is more protective, providers in Arizona have to follow it.
The Federal HIPAA Floor
HIPAA’s Privacy Rule controls how covered entities use and share your protected health information. Covered entities include healthcare providers who transmit information electronically, health plans, and healthcare clearinghouses.1HHS.gov. Summary of the HIPAA Privacy Rule The rule gives you the right to see your records, request corrections, get a list of certain disclosures, and receive a written notice explaining how your information is used. HIPAA’s Security Rule adds administrative, technical, and physical safeguards for electronic PHI.
Every covered entity must give you a written Notice of Privacy Practices at your first visit. It explains, in plain language, how the entity uses your information, what your rights are, and how to file a complaint.2eCFR. 45 CFR 164.520 – Notice of Privacy Practices for Protected Health Information You can always ask for a paper copy, even if you got the notice electronically.
How Arizona Law Goes Further
HIPAA was written as a floor, not a ceiling. When an Arizona statute gives you more privacy protection or broader access to your own information, the state rule controls.3HHS.gov. Preemption of State Law That “more stringent” standard is what makes several Arizona provisions matter in day-to-day practice. Arizona providers have to track both sets of rules and comply with whichever favors you.
Getting Your Medical Records in Arizona
Under A.R.S. § 12-2293, you or your healthcare decision maker can request access to your medical records and payment records in writing. Once the provider receives that request, they must provide access or copies.4Arizona Legislature. Arizona Revised Statutes 12-2293 – Release of Medical Records and Payment Records to Patients and Health Care Decision Makers; Definition
This is where Arizona is notably tougher than HIPAA. Federal rules give a covered entity up to 30 calendar days to respond, with a possible 30-day extension.5HHS.gov. Right to Access and Research Arizona doesn’t give providers that kind of runway. Records have to be promptly available, and a healthcare professional who fails or refuses to make them promptly available commits unprofessional conduct under A.R.S. § 32-2933.6Arizona Legislature. Arizona Revised Statutes 32-2933 – Definition of Unprofessional Conduct That triggers possible discipline from the relevant licensing board, so providers have a real reason to move.
When Copies Must Be Free
Arizona prohibits providers from charging you for copies of your records when you need them for continuing healthcare. The same no-charge rule applies when another provider requests your records to continue treating you.7Arizona Legislature. Arizona Revised Statutes 12-2295 – Charges Outside those situations, the provider can charge a reasonable fee. Arizona doesn’t set a specific per-page cap by statute, so “reasonable” is judged case by case. If you’re transferring care to a new doctor and a provider tries to bill you for the records, that charge violates state law.
Electronic Copies
If your records are kept electronically and you ask for an electronic copy, the provider has to give you the records in the format you ask for, so long as the system can readily produce it. If that specific format isn’t readily producible, you and the provider should agree on another electronic format. A provider can only hand you paper instead of an electronic copy if you decline every electronic format they can produce.8HHS.gov. Individuals’ Right under HIPAA to Access their Health Information
Fixing Errors and Tracking Who Saw Your Records
If you find something wrong in your file, HIPAA gives you the right to request an amendment. Put the request in writing, explain why the information is wrong or incomplete, and send it to the provider or health plan. They have 60 days to act, with one possible 30-day extension if they notify you of the reason for the delay.9eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
A provider can deny an amendment on limited grounds, including that the information is accurate and complete or that it was created by a different entity. A denial has to be in writing, and you have the right to submit a written statement of disagreement that gets attached to the record going forward. So even if the entry stands, your objection travels with it.
You can also ask a covered entity for a written accounting of disclosures. This is a list of times they shared your PHI outside routine treatment, payment, and healthcare operations, covering the six years before your request. The accounting has to include the date, recipient, description of what was shared, and purpose.10eCFR. 45 CFR 164.528 – Accounting of Disclosures of Protected Health Information It’s a useful paper trail if you think your information was shared inappropriately.
Behavioral Health, Substance Use, and Minors
Arizona treats behavioral health records more strictly than general medical records. Under A.R.S. § 36-509, a healthcare entity has to keep behavioral health records confidential and may only disclose them under specific circumstances defined by state or federal law.11Arizona Legislature. Arizona Revised Statutes 36-509 – Confidential Records; Immunity; Definition Permitted disclosures include sharing with providers involved in the patient’s care, releases to people the patient has authorized, court orders, approved research, and situations involving an imminent threat to safety. A general medical authorization form won’t automatically cover psychiatric or behavioral health records. If that’s what you’re releasing, the authorization needs to say so specifically.
Substance Use Disorder Records
Federal regulations under 42 CFR Part 2 add another layer for substance use disorder treatment records from federally assisted programs. Those records generally can’t be used or disclosed in any civil, criminal, administrative, or legislative proceeding without patient consent or a court order.12eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records A program can’t even confirm a patient’s presence at a publicly identified SUD facility without written consent or a court order.
Recent changes under the CARES Act aligned Part 2 with HIPAA in some ways. A patient can now sign a single consent covering future uses and disclosures for treatment, payment, and healthcare operations, and HIPAA-covered entities receiving records under that consent may redisclose under HIPAA rules.13HHS.gov. Fact Sheet – 42 CFR Part 2 Final Rule Consent to use SUD records in legal proceedings still has to be obtained separately, and SUD counseling notes need their own separate written consent for any use or disclosure.
Minors
Arizona requires written or oral consent from a parent or legal guardian before anyone performs mental health screening in a nonclinical setting or provides mental health treatment to a minor. The only exception is a genuine emergency to prevent serious injury or save the child’s life. Violating this is a class 1 misdemeanor.14Arizona Legislature. Arizona Revised Statutes 36-2272 – Consent of Parent Required for Mental Health Screening or Treatment of Minors; Exception; Violation; Classification; Definition
Parents generally have the right to access a minor child’s records as the child’s healthcare decision maker, but that right isn’t absolute. Under A.R.S. § 12-2293, a provider may deny a parent access when disclosure is reasonably likely to cause substantial harm to the patient or another person, or when access may endanger the patient’s life or physical safety.4Arizona Legislature. Arizona Revised Statutes 12-2293 – Release of Medical Records and Payment Records to Patients and Health Care Decision Makers; Definition
Arizona also lets minors consent to some care on their own. A minor who may have contracted a sexually transmitted disease can consent to diagnosis and treatment, and that consent can’t be voided because of age.15Arizona Legislature. Arizona Revised Statutes 44-132.01 – Capacity of Minor to Obtain Treatment for Venereal Disease Without Consent of Parent Minors 12 and older can consent to treatment for dangerous drugs or narcotics. When a minor lawfully consents to care without parental knowledge, confidentiality follows, and parents may not have automatic access to those records.
When Providers Must Report Without Your Consent
Some disclosures happen without patient authorization because state law requires them. Providers have to report confirmed or suspected communicable diseases to the local health agency within timeframes set by the Arizona Administrative Code, with tight deadlines for urgent conditions.16Legal Information Institute. Arizona Administrative Code R9-6-202 – Reporting Requirements for a Health Care Provider Required to Report Physicians, nurses, psychologists, counselors, and other listed professionals are mandatory reporters of suspected child abuse, neglect, or denial of necessary medical care, with immediate reporting required to the Department of Child Safety or a peace officer.17Arizona Legislature. Arizona Revised Statutes 13-3620 – Duty to Report Abuse, Physical Injury, Neglect and Denial or Deprivation of Medical or Surgical Care or Nourishment of Minors A parallel duty applies to suspected abuse, neglect, or exploitation of vulnerable adults.18Arizona Legislature. Arizona Revised Statutes 46-454 – Duty to Report Abuse, Neglect and Exploitation of Vulnerable Adults These obligations override normal patient consent rules.
Data Breach Notification
If your PHI is exposed, both federal and Arizona law require notification, and they run on parallel tracks. Under HIPAA’s Breach Notification Rule, a covered entity has to notify each affected individual in writing within 60 days of discovering a breach of unsecured PHI. Breaches affecting 500 or more people also have to be reported to HHS within that 60-day window.19HHS.gov. Breach Notification Rule Smaller breaches can be reported to HHS annually, within 60 days after the end of the calendar year in which they were discovered.20HHS.gov. Submitting Notice of a Breach to the Secretary
Arizona’s statute, A.R.S. § 18-552, tightens that timeline. Any person or business that owns, maintains, or licenses unencrypted computerized personal information has to notify affected individuals within 45 days of confirming a security breach. If more than 1,000 individuals are affected, the entity must also notify the three largest nationwide consumer reporting agencies, the Arizona Attorney General, and the Director of the Arizona Department of Homeland Security.21Arizona Legislature. Arizona Revised Statutes 18-552 – Notification of Security System Breaches Law enforcement can request a delay if notification would compromise a criminal investigation. Because Arizona’s 45-day deadline is shorter than HIPAA’s 60 days, healthcare entities operating in the state generally have to meet the state clock to comply with both.
Filing a Complaint
If you think a provider or health plan violated your HIPAA rights, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. Complaints have to be filed in writing within 180 days of when you knew about the violation, though OCR can extend that for good cause. You can file online through the OCR Complaint Portal, by email to OCRComplaint@hhs.gov, or by mail. The complaint needs to identify the entity and describe what happened.22HHS.gov. How to File a Civil Rights Complaint
HIPAA penalties scale with fault. At the low end, an entity that didn’t know and couldn’t reasonably have known about a violation can be fined a few hundred dollars per incident. At the high end, willful neglect that goes uncorrected can run into the millions per year, with per-violation penalties reaching $2,190,294 in the current inflation-adjusted tiers.23Federal Register. Annual Civil Monetary Penalties Inflation Adjustment The gap between corrected and uncorrected willful neglect is intentional.
For Arizona-specific violations, such as a provider refusing to release records promptly or improperly disclosing behavioral health information, complaints can also go to the relevant state licensing board. Failing to release records promptly is unprofessional conduct under Arizona law and can lead to discipline against the provider’s license.6Arizona Legislature. Arizona Revised Statutes 32-2933 – Definition of Unprofessional Conduct If your issue involves a delay in getting records or a behavioral health disclosure, the state board is often the faster route.