HIPAA Laws in Nevada: Consent, Breaches, and Penalties

HIPAA laws in Nevada work on two levels: the federal HIPAA Privacy and Security Rules set the floor, and a group of Nevada statutes layer stricter protections on top. Where the state rule gives patients more protection than HIPAA does, providers and businesses have to follow the stricter one.¹ Nevada also reaches further than HIPAA in three ways that matter to patients: it covers more types of providers, it treats several categories of records as especially sensitive, and in 2024 it added a consumer health data law that applies to businesses HIPAA never touched.

Who Has to Follow Nevada’s Medical Privacy Rules

Federal HIPAA mostly applies to health plans, clearinghouses, and providers who send claims electronically. Nevada’s definition of a “provider of health care” under NRS 629.031 is much wider. It includes physicians, dentists, nurses, pharmacists, optometrists, psychologists, social workers, chiropractors, podiatrists, athletic trainers, alcohol and drug counselors, music therapists, and many other licensed professionals. If someone holds a Nevada health care license or certification, they almost certainly fall under the state’s privacy rules even if they never file an electronic insurance claim.²

Facilities are covered too. NRS 629.026 pulls in hospitals, psychiatric hospitals, ambulatory surgical centers, and similar licensed entities by cross-reference, and a medical facility that employs covered providers is itself treated as a provider under the statute.² Vendors who handle data on behalf of a Nevada provider carry obligations as well. NRS 603A.210 requires that any contract involving a Nevada resident’s personal information include a provision binding the recipient to reasonable security measures, so a billing company or cloud host cannot sidestep the rules by pointing out that it isn’t a licensed clinician.³

Records That Need Special Consent

Several categories of health information in Nevada are protected more strictly than ordinary medical records. A general medical release form is often not enough to cover them.

Genetic Information

NRS 629.171 makes it unlawful to disclose a person’s identity as the subject of a genetic test, or to release genetic information in a way that could identify them, without informed written consent.⁴ The consent form must follow a format prescribed by the State Board of Health and explain the confidentiality rules that apply to genetic data.⁵ The rule applies to anyone who holds genetic information, not only to health care providers.

Communicable Disease Records

NRS 441A.220 says personal information about someone diagnosed with or exposed to a communicable disease cannot be released “under any circumstances, including pursuant to any subpoena, search warrant or discovery proceeding,” subject to a short list of exceptions covering de-identified statistics, prosecutions under the chapter, abuse reporting, and disclosures to emergency responders when the Board of Health has flagged a disease as occupationally relevant.⁶ NRS 441A.230 separately bars anyone from publicly identifying a person investigated for a communicable disease without consent.⁷

Mental Health Records

Clinical records held by mental health facilities, private psychiatric institutions, and qualified mental health professionals are not public records. Under NRS 433A.360, release requires the consumer’s specific written authorization, and the statute names who may receive the records: physicians, advanced practice registered nurses, attorneys, and social agencies, each “as specifically authorized in writing by the consumer.”⁸ A court order can also compel release, and narrow disclosures are allowed for statistical research, insurance claims, and protection-and-advocacy agencies. A blanket release that doesn’t name the mental health provider and the information to be shared is usually not enough.

Substance Use Disorder Records

Federal 42 CFR Part 2 adds its own protections for records created by a federally assisted substance use disorder treatment program. A 2024 final rule brought Part 2 closer to HIPAA by allowing patients to sign a single consent covering future treatment, payment, and health care operations disclosures.⁹ Even with that change, these records still cannot be used in civil, criminal, administrative, or legislative proceedings against the patient without a specific court order, and Nevada law may add stricter rules on top.

The 2024 Consumer Health Data Privacy Act

Nevada’s Consumer Health Data Privacy Act, originally SB 370 and codified at NRS 603A.400 through 603A.550, filled a gap HIPAA leaves open: health-related data collected by businesses that are not providers or health plans.

“Consumer health data” is defined broadly. It covers information a business uses to identify someone’s past, present, or future health status, including diagnoses, medications, reproductive health care, gender-affirming care, and behavioral interventions. Precise geolocation data counts when a business uses it to show someone tried to access health care services, and data a company infers through algorithms or machine learning also qualifies if it relates to health status.¹⁰

A “regulated entity” under NRS 603A.465 is any person or business operating in Nevada, or targeting Nevada consumers, that determines how consumer health data gets processed, shared, or sold. That reaches wellness apps, fitness trackers, period-tracking software, medical device companies, and even retailers that track health-related purchases. Entities already subject to HIPAA are exempt at the entity level, so a hospital does not have to double-comply for the same data.¹⁰

The law requires affirmative consent before a regulated entity collects, shares, or sells your health data. If the business later wants to use the data for a purpose that wasn’t in its original notice, it has to get fresh consent. Third-party processors must operate under contracts that limit their use of the data, and a processor that acts outside those limits is directly liable.¹⁰

Your Right to See and Copy Your Records

NRS 629.061 gives you the right to inspect your medical records in person or request copies. You can also authorize a representative, such as an attorney or a family member, to request them for you with written authorization.¹¹

Copy fees are capped at 60 cents per page for photocopies. X-rays and similar imaging follow a “reasonable cost” standard rather than a fixed cap. No administrative fee or additional service fee of any kind may be added on top of the per-page cost and actual postage, and if records are delivered electronically the fee must reflect only the actual cost of the media.¹¹

One nuance about timing: the statute’s 30-day deadline for furnishing records applies specifically to requests supporting a claim or appeal under the Social Security Act or a federal or state financial needs-based benefit program, and the first copy for those requests must be free. The statute does not set a specific calendar deadline for general record requests, though providers are still expected to respond within a reasonable time.¹¹

How Long Records Are Kept

Under NRS 629.051, custodians of health care records must retain patient records for at least five years. Records may be kept in any recognized format, including microfilm, computer disc, or optical disc, as long as the format does not impair their usability. Records belonging to anyone under 23 cannot be destroyed at all; destruction becomes possible only once the person turns 23 and the five-year period has also passed. Providers must post a sign at each location and give new patients a written notice explaining that records may eventually be destroyed once retention ends.¹²

What Happens After a Data Breach

NRS 603A.220 requires any data collector that owns or licenses computerized personal information to notify affected Nevada residents after discovering a breach, “without unreasonable delay.” The rule triggers when unencrypted personal information has been, or is reasonably believed to have been, acquired by an unauthorized person.¹³

If a breach affects more than 1,000 people at once, the data collector must also notify nationwide consumer reporting agencies about the timing and content of the breach notice. Notification can go by written letter, by email if the consumer previously consented to electronic communication, or by substitute notice combining email, website posting, and statewide media when the cost of direct notice would be very high or the affected class is very large.¹³ Nevada’s statute does not require notification to the state Attorney General for general data breaches under this section, which differs from HIPAA’s breach rule requiring reports to HHS for breaches affecting 500 or more individuals.

Penalties for Violations

Federal HIPAA is enforced by the U.S. Department of Health and Human Services through its Office for Civil Rights, with tiered civil penalties keyed to the level of culpability and adjusted annually for inflation.

On the state side, violations of the Consumer Health Data Privacy Act are treated as deceptive trade practices, and the Nevada Attorney General can seek injunctive relief and civil penalties.¹⁰ The Act does not create a private right of action, so individual consumers cannot sue a business directly under it; enforcement runs through the Attorney General’s office. For providers who violate the record access or retention rules under Chapter 629, the State Board of Health and the relevant licensing boards can impose corrective action or administrative penalties, including discipline against a provider’s professional license.

How to File a Medical Privacy Complaint

If you believe a HIPAA-covered entity violated your privacy rights, you can file a complaint with the federal Office for Civil Rights. The complaint must be filed within 180 days of when you discovered the violation, though OCR may extend that deadline for good cause.¹⁴ Complaints can be filed online through the OCR complaint portal, by mail, or by email.

For a Nevada-specific issue, the path depends on the type of violation. Complaints about consumer health data practices under the Consumer Health Data Privacy Act go to the Nevada Attorney General, which holds exclusive enforcement authority. Complaints about a licensed provider’s handling of records go to that provider’s state licensing board, or to the relevant compliance office for a local health district matter. There is no single statutory deadline for these state-level complaints, but filing promptly helps preserve evidence.

1
U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule
2
Nevada Legislature. Nevada Revised Statutes Chapter 629 – Healing Arts Generally
3
Nevada Legislature. Nevada Revised Statutes 603A.210 – Security Measures
4
Nevada Legislature. Nevada Code 629.171 – Disclosure of Identity Genetic Information of Person Without Consent Unlawful; Exceptions
5
Nevada Legislature. Nevada Revised Statutes 629.181 – Procedure
6
Nevada Legislature. Nevada Revised Statutes Chapter 441A – Infectious Diseases; Reporting Concerning Communicable Diseases, Overdoses and Attempted Suicides
7
Nevada Legislature. Nevada Code 441A.230 – Disclosure of Personal Information Prohibited Without Consent
8
Nevada Legislature. Nevada Code 433A.360 – Clinical Records: Contents; Confidentiality
9
eCFR. Confidentiality of Substance Use Disorder Patient Records
10
Nevada Legislature. Nevada Revised Statutes Chapter 603A – Security and Privacy of Personal Information
11
Nevada Legislature. Nevada Code 629.061 – Inspection; Copies and Related Charges; Use in Public Hearing; Immunity of Certain Persons From Civil Action for Disclosure
12
Nevada Legislature. Nevada Code 629.051 – Retention of Records
13
Nevada Legislature. Nevada Code 603A.220 – Disclosure of Breach of Security of System Data; Methods of Disclosure; Applicability
14
U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint