Medical privacy in Arizona runs on two tracks at once. The federal Health Insurance Portability and Accountability Act, better known as HIPAA, sets a nationwide floor for how your health information must be handled, and Arizona HIPAA laws build on that floor in several places: faster record delivery, free copies when you need them for ongoing care, tighter rules around behavioral health, and a shorter breach notification clock. Where the two conflict, providers have to follow whichever rule gives you more protection or more access.
How HIPAA and Arizona Law Fit Together
HIPAA’s Privacy Rule governs how covered entities, meaning most healthcare providers, health plans, and healthcare clearinghouses, use and share your protected health information.1HHS.gov. Summary of the HIPAA Privacy Rule It gives you the right to see your records, request corrections, get an accounting of disclosures, and receive a plain-language notice of how your information is used. A separate Security Rule requires administrative, technical, and physical safeguards for electronic health information.
HIPAA was written as a floor, not a ceiling. When an Arizona statute gives you more privacy or more access to your own records than the federal rule does, the Arizona rule controls.2HHS.gov. Preemption of State Law This is the “more stringent” standard, and it matters in practice because several Arizona statutes clear that bar.
Getting Your Medical Records in Arizona
Under A.R.S. § 12-2293, you or your healthcare decision maker can request your medical records and payment records in writing, and the provider must then make those records available.3Arizona Legislature. Arizona Revised Statutes 12-2293
This is where Arizona law outpaces HIPAA. Federal rules give a covered entity up to 30 calendar days to respond, with a possible 30-day extension.4HHS.gov. Right to Access and Research Arizona does not give providers that kind of runway. The statute requires prompt availability, and a healthcare professional who fails or refuses to make patient records promptly available commits unprofessional conduct under A.R.S. § 32-2933, which can trigger discipline from the relevant licensing board.5Arizona Legislature. Arizona Revised Statutes 32-2933
When Copies Must Be Free
Arizona bars providers from charging you for copies of your medical records when you need them for continuing healthcare, and the same no-charge rule applies when another provider requests the records to continue treating you.6Arizona Legislature. Arizona Revised Statutes 12-2295 Outside those situations, a provider may charge a reasonable fee. The statute does not set a per-page cap, so “reasonable” is judged case by case. If you are switching doctors or seeing a specialist and the records travel with you, a charge for those copies violates state law.
Electronic Copies
If your records are kept electronically and you request an electronic copy, the provider must deliver them in the format you ask for, so long as their system can readily produce it. If that specific format is not readily producible, you and the provider should agree on an alternative electronic format. A paper copy is only a fallback if you decline every electronic format the provider can produce.7HHS.gov. Individuals’ Right under HIPAA to Access their Health Information
Access After a Patient’s Death
HIPAA protects a deceased person’s health information for 50 years after the date of death. During that window, the decedent’s personal representative, typically the executor or administrator of the estate, can exercise HIPAA rights, including access and authorizing disclosures.8HHS.gov. Health Information of Deceased Individuals After 50 years, the information is no longer protected health information.
Fixing Errors in Your Records
If something in your file is wrong or incomplete, HIPAA gives you the right to request an amendment. Submit the request in writing and explain why the entry is inaccurate. The covered entity has 60 days to act, with one possible 30-day extension if they notify you of the delay in writing.9eCFR. 45 CFR 164.526
A provider can deny the request on specific grounds: the information is accurate and complete, it was created by someone else, it is not part of the designated record set, or it is not information you would be allowed to inspect. A denial has to come in writing, explain the basis, and tell you how to file a written statement of disagreement. That disagreement then rides along with the record, so anyone reading the entry later sees your objection next to it.
Seeing Who Got Your Information
You can ask a covered entity for a written list of disclosures of your PHI made outside of routine treatment, payment, and healthcare operations. The accounting covers the six years before your request and lists the date, recipient, a description of what was shared, and the purpose.10eCFR. 45 CFR 164.528 It’s a useful tool when you suspect your information went somewhere it shouldn’t have.
Behavioral Health, Substance Use, and Minors
Arizona treats behavioral health records more strictly than general medical records. Under A.R.S. § 36-509, a health care entity must keep behavioral health records confidential and may release them only in specific situations: to providers involved in care, to people the patient has authorized, under court order, for approved research, or when there is an imminent threat to safety.11Arizona Legislature. Arizona Revised Statutes 36-509 A general medical authorization does not automatically cover behavioral health information. If you want psychiatric or counseling records released, the authorization needs to say so specifically.
Substance Use Disorder Records
Federal regulations at 42 CFR Part 2 add an extra layer for substance use disorder treatment records held by federally assisted programs. SUD records generally cannot be used or disclosed in any civil, criminal, administrative, or legislative proceeding without the patient’s consent or a court order.12eCFR. 42 CFR Part 2 A program cannot even confirm that someone is a patient at a publicly identified SUD facility without written consent or a court order.
Recent changes aligned parts of Part 2 with HIPAA. A patient can now sign a single consent covering future uses and disclosures for treatment, payment, and healthcare operations, and HIPAA-covered entities receiving records under that consent may redisclose them under HIPAA rules.13HHS.gov. Fact Sheet – 42 CFR Part 2 Final Rule Consent for use of SUD records in legal proceedings still has to be obtained separately, and SUD counseling notes need their own written consent for any use or disclosure.
Minors
Arizona requires written or oral consent from a parent or legal guardian before anyone performs mental health screening in a nonclinical setting or provides mental health treatment to a minor. The only exception is a genuine emergency where screening or treatment is needed to prevent serious injury or save the child’s life. Violating this requirement is a class 1 misdemeanor.14Arizona Legislature. Arizona Revised Statutes 36-2272
Parents generally access a minor’s records as the child’s healthcare decision maker. That access is not absolute. Under A.R.S. § 12-2293, a provider may deny a parent access when disclosure is reasonably likely to cause substantial harm to the patient or another person, or when it may endanger the patient’s life or physical safety.3Arizona Legislature. Arizona Revised Statutes 12-2293
Arizona also lets minors consent to certain sensitive treatment on their own. A minor who may have contracted a sexually transmitted disease can consent to diagnosis and treatment, and that consent cannot be voided based on age.15Arizona Legislature. Arizona Revised Statutes 44-132.01 Minors aged 12 and older may also consent to treatment related to dangerous drugs or narcotics. When a minor lawfully consents without parental involvement, the confidentiality of those records follows, and parents may not have automatic access to them.
When Providers Can Share Without Your Consent
Some disclosures happen without your authorization because state law requires them. Providers must report confirmed or suspected communicable diseases to the local health agency within deadlines set by the Arizona Administrative Code, with especially tight timeframes for urgent conditions.16Legal Information Institute. Arizona Administrative Code R9-6-202 Healthcare professionals are also mandatory reporters for suspected child abuse, neglect, or denial of necessary medical care, and must report immediately to the Department of Child Safety or a peace officer.17Arizona Legislature. Arizona Revised Statutes 13-3620 A parallel duty applies to suspected abuse, neglect, or exploitation of vulnerable adults.18Arizona Legislature. Arizona Revised Statutes 46-454
If Your Records Are Breached
Breach notification runs on two parallel tracks in Arizona, and healthcare entities typically have to satisfy both.
Under HIPAA’s Breach Notification Rule, a covered entity must notify each affected individual in writing within 60 days of discovering a breach of unsecured PHI. The notice must describe what happened, what information was involved, what you can do to protect yourself, and what the entity is doing in response.19HHS.gov. Breach Notification Rule Breaches affecting 500 or more individuals must be reported to HHS within the same 60-day window; smaller breaches can be reported annually, within 60 days after the end of the calendar year.20HHS.gov. Submitting Notice of a Breach to the Secretary
Arizona’s own statute, A.R.S. § 18-552, applies to any person or business that owns, maintains, or licenses unencrypted computerized personal information. Once an investigation confirms a security breach, the entity has 45 days to notify affected individuals. If more than 1,000 people are affected, the entity also has to notify the three largest nationwide consumer reporting agencies, the Arizona Attorney General, and the Director of the Arizona Department of Homeland Security.21Arizona Legislature. Arizona Revised Statutes 18-552 Law enforcement can request a delay if notification would compromise a criminal investigation, but the 45-day clock restarts once that concern passes. Because Arizona’s deadline is shorter than HIPAA’s, meeting the state window typically satisfies both.
Filing a Complaint
If you believe a provider or health plan has violated your HIPAA rights, you can file a written complaint with the U.S. Department of Health and Human Services Office for Civil Rights within 180 days of when you knew the violation occurred. OCR can extend that deadline for good cause. Complaints go through the OCR Complaint Portal, by email to OCRComplaint@hhs.gov, or by mail, and must identify the entity involved and describe what happened.22HHS.gov. How to File a Civil Rights Complaint
HIPAA violations carry civil monetary penalties that scale with the entity’s level of fault, from a minimum tier for violations the entity did not know about and could not reasonably have known about, up to willful neglect that goes uncorrected, where penalties range from $73,011 to $2,190,294 per violation and up to $2,190,294 per calendar year.23Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
For Arizona-specific issues, such as a provider’s refusal to release records promptly or an unauthorized release of behavioral health information, you can also complain to the relevant state licensing board. Failing to make records promptly available is unprofessional conduct under Arizona law and can lead to discipline against the provider’s license.5Arizona Legislature. Arizona Revised Statutes 32-2933