Indiana HIPAA laws combine the federal HIPAA Privacy, Security, and Breach Notification Rules with Indiana Code Title 16, which adds its own protections for medical records, mental health information, and communicable disease reporting. Providers, health plans, and their vendors have to follow both sets of rules, and enforcement comes from two directions: the U.S. Department of Health and Human Services Office for Civil Rights at the federal level, and the Indiana Attorney General at the state level.
Who Has to Follow These Rules
HIPAA applies to three types of organizations, called covered entities: healthcare providers that transmit any health information electronically, health plans, and healthcare clearinghouses. If your Indiana practice, hospital, pharmacy, or insurer touches protected health information in electronic form, the Privacy and Security Rules apply.
The obligations extend past the covered entity itself. Any outside person or company that handles protected health information on the entity’s behalf is a business associate. That covers billing companies, IT vendors running electronic health record systems, transcription services, third-party claims administrators, and attorneys or accountants whose work involves patient data.1HHS.gov. Business Associates Business associates are directly liable for HIPAA violations, including unauthorized disclosures, failure to meet Security Rule standards, and failure to report breaches.2HHS.gov. Direct Liability of Business Associates
On top of that, Indiana Code Title 16 requires providers to protect the confidentiality of health records, with its own state-level consequences for violations.3Indiana General Assembly. Indiana Code 16-39-5-3 – Providers Use of Records Confidentiality Violations
Your Rights Over Your Own Records
Getting Copies of Your Records
You have a legally enforceable right to inspect and get copies of your medical records held by any covered provider, and to direct the provider to send copies to a third party you designate.4HHS.gov. Individuals Right under HIPAA to Access their Health Information 45 CFR 164.524 Providers have 30 days to respond after receiving a request. They can take one 30-day extension, but only with a written explanation for the delay and a completion date.5eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
Indiana law limits what a provider can charge to copy records. The fees must be reasonable and are capped by statute under Indiana Code Title 16, Article 39. Check the current statute for the per-page and labor limits, since the legislature updates those numbers.
Correcting Something That’s Wrong
If your record contains an error or is incomplete, you can ask for an amendment. The provider must act within 60 days, with one 30-day extension available if they give you written notice explaining the delay.6eCFR. 45 CFR 164.526 – Amendment of Protected Health Information A provider can deny the request if the record was not created by them, if the information is already accurate, or if it isn’t part of the designated record set you have a right to access. When a request is denied, you can submit a written statement of disagreement that has to travel with the record from then on.
Controlling Who Sees Your Information
Outside of treatment, payment, and standard healthcare operations, most disclosures need your written authorization. Indiana Code 16-39-1-4 sets out what a valid authorization must include: the specific information to be released, the purpose of the release, and the identity of the recipient.7Indiana General Assembly. Indiana Code 16-39-1-4 – Patients Written Consent for Release of Records Contents A blanket “release everything to anyone” form doesn’t meet that standard. You can revoke an authorization at any time, though the revocation doesn’t undo disclosures already made in reliance on it.
What Providers Have to Do
Business Associate Agreements
Before sharing any protected health information with a vendor or contractor, a covered entity has to have a written Business Associate Agreement in place. Operating without one when a vendor is handling patient data is itself a HIPAA violation. A valid agreement has to spell out how the business associate can use and disclose the information, require compliance with the Security Rule for electronic records, obligate the associate to report any unauthorized use and any breach, bind subcontractors to the same restrictions, give the covered entity the ability to terminate for a material breach, and require return or destruction of the data when the contract ends.8HHS.gov. Sample Business Associate Agreement Provisions
Notice of Privacy Practices
Every covered provider with a direct treatment relationship has to give patients a Notice of Privacy Practices explaining how information is used, what rights patients have, and the provider’s obligations. It has to be in plain language and delivered no later than the first appointment, with a good-faith effort to get a signed acknowledgment. In emergencies, the notice can be provided as soon as reasonably practicable afterward.9eCFR. 45 CFR 164.520 – Notice of Privacy Practices for Protected Health Information Health plans provide the notice at enrollment and remind members every three years that it’s available.
The Minimum Necessary Standard
HIPAA limits how much information gets shared, not just whether it gets shared. Covered entities and business associates must make reasonable efforts to limit uses and disclosures to what’s needed for the specific purpose.10eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information A billing office processing a claim shouldn’t have access to a patient’s psychiatric history. The rule does not apply to disclosures for treatment, disclosures the patient has authorized, or information going to the patient.
Workforce Training and Sanctions
The Security Rule requires a security awareness and training program covering everyone in the workforce, including management. The Privacy Rule separately requires training on the entity’s privacy policies. New employees must be trained within a reasonable time after joining, and additional training is required whenever policies materially change.11HHS.gov. HIPAA Security Series 2 – Administrative Safeguards Training has to be documented. Covered entities also need a written sanction policy describing consequences for employees who violate privacy or security rules, scaled to the severity of the violation up to termination.
Marketing Uses
Using protected health information for marketing requires patient authorization, with two narrow exceptions: face-to-face communications and promotional gifts of nominal value.12HHS.gov. Marketing Handing a patient a brochure at an appointment is fine. Sharing a patient list with a telemarketer is not, unless the patient has authorized it in writing.
When Information Can Be Shared Without Your Permission
HIPAA permits disclosure without patient authorization in specific situations. In Indiana, the ones most likely to come up are public health reporting, law enforcement, and imminent safety threats.
Public Health Reporting
Indiana requires physicians, hospital administrators, and medical laboratory directors to report communicable diseases and other serious health conditions to local or state health officers.13Indiana General Assembly. Indiana Code 16-41-2-2 – Reporting of Required Information The state health department publishes the list of reportable diseases.14Indiana General Assembly. Indiana Code 16-41-2-1 – Rules Publication of List of Diseases These reports are legally required and fall within HIPAA’s public health exception.
Law Enforcement
HIPAA allows disclosure to law enforcement in response to court orders, subpoenas, and warrants, and to identify suspects, locate fugitives, or respond to a crime on the provider’s premises.15eCFR. 45 CFR 164.512
Serious Threats to Safety
If a provider reasonably believes someone faces a serious and imminent threat, HIPAA permits disclosure to anyone who can reasonably prevent or lessen the harm, including law enforcement.15eCFR. 45 CFR 164.512
Extra Protection for Mental Health and Substance Use Records
Mental health records in Indiana get additional protection under Indiana Code 16-39-2. They are confidential, and disclosure requires patient consent or a specific statutory exception. Disclosure to law enforcement is allowed when a committed patient escapes, when a facility superintendent determines that withholding information could result in bodily harm, or when a patient commits or threatens a crime on facility grounds or against staff.
Substance use disorder treatment records are covered by a separate federal rule, 42 CFR Part 2, that is stricter than HIPAA. A general medical release form is not enough to authorize disclosure of these records. The consent must meet specific requirements set out in the regulation, and a consent for use in legal proceedings cannot be combined with consent for any other purpose. Every disclosure made with consent must carry a notice prohibiting the recipient from using the information in civil, criminal, administrative, or legislative proceedings against the patient without separate authorization.16eCFR. Part 2 Confidentiality of Substance Use Disorder Patient Records Indiana providers offering this kind of treatment follow whichever rule is more protective, which in most cases is Part 2.
Breach Notification: State and Federal Tracks
Indiana’s Breach Statute
Indiana Code 24-4.9 requires any entity that experiences a breach involving personal information to notify affected individuals without unreasonable delay, by mail, phone, fax, or email. If more than 1,000 Indiana residents are affected, consumer reporting agencies must also be notified. The Indiana Attorney General enforces the statute and provides a notification form on its website.17Indiana Attorney General. Security Breach FAQs and Notification Form for Businesses
Indiana’s definition of personal information covers a Social Security number, or a name combined with data like a driver’s license number, financial account number, or credit card number with security code. That overlaps with HIPAA’s definition of protected health information but is not identical. A breach involving medical diagnoses alone, with no identifying data like a Social Security number, might trigger HIPAA’s notification rule without triggering the Indiana statute.
Federal HIPAA Breach Reporting
A covered entity that discovers a breach of unsecured protected health information affecting 500 or more individuals must notify the HHS Secretary within 60 calendar days of discovery. Smaller breaches can be logged and submitted annually. Affected individuals must be notified either way.18HHS.gov. Submitting Notice of a Breach to the Secretary A single incident can trigger both the federal and Indiana reporting tracks.
Penalties
Civil Penalties
The HHS Office for Civil Rights enforces HIPAA through a tiered penalty structure based on the violator’s level of culpability. As of the most recent inflation adjustment (2025 figures published January 2026):19Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
- No knowledge of the violation: $141 to $73,011 per violation, annual cap of $2,190,294 for identical violations.
- Reasonable cause, not willful neglect: $1,424 to $73,011 per violation, same $2,190,294 annual cap.
- Willful neglect, corrected within 30 days: $14,232 to $73,011 per violation, $2,190,294 annual cap.
- Willful neglect, not corrected: $73,011 to $2,190,294 per violation, $2,190,294 annual cap.
Settlements often come with a corrective action plan requiring an enterprise-wide risk analysis, revised policies, workforce retraining, and ongoing monitoring.
Criminal Penalties
Individuals who knowingly obtain or disclose protected health information without authorization face federal criminal charges, prosecuted by the U.S. Department of Justice. Penalties escalate with intent:20Office of the Law Revision Counsel. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
- Basic violation: up to $50,000 and one year in prison.
- Information obtained under false pretenses: up to $100,000 and five years in prison.
- Intent to sell, use for personal gain, or cause harm: up to $250,000 and ten years in prison.
Criminal cases usually target individuals rather than organizations. Employees snooping through a high-profile patient’s records or selling patient data are the typical scenarios.
Indiana Attorney General Enforcement
The Indiana Attorney General has dual authority. Under the HITECH Act, the office can bring civil actions in federal court on behalf of Indiana residents harmed by HIPAA Privacy and Security Rule violations, seeking damages or injunctive relief.21HHS.gov. State Attorneys General Separately, the office enforces Indiana’s data protection statutes, including breach notification under Indiana Code 24-4.9. The Consumer Protection Division accepts complaints from individuals who believe their health information has been mishandled.22Indiana Attorney General. File a Complaint – Consumer Protection Division A single incident can draw scrutiny from both the state Attorney General and federal OCR.
Can You Sue Over a Violation?
Not under HIPAA itself. The federal statute has no private right of action, so a patient can’t file suit citing HIPAA as the cause of action. Indiana law gives you other options. Patients can bring state tort claims like breach of confidentiality, invasion of privacy, or negligence. These rely on state common law and don’t require proving a HIPAA violation, though evidence that a provider fell short of HIPAA standards can support the case. Providers who disclose patient information beyond what Indiana Code 16-39-5-3 permits face potential liability under state privacy law and the confidentiality protections built into the health records statute itself.3Indiana General Assembly. Indiana Code 16-39-5-3 – Providers Use of Records Confidentiality Violations
If you think your records have been mishandled, you can file a complaint with the HHS Office for Civil Rights, file a complaint with the Indiana Attorney General’s Consumer Protection Division, or consult a private attorney about a state-law claim. Those routes aren’t mutually exclusive.