Louisiana Medical Records Statute: Access, Fees, and Penalties

Louisiana medical records law gives every patient a written right to copies of their own records, sets a 15-day deadline for providers to hand them over, caps the copying fees, and pairs state rules under Louisiana Revised Statutes 40:1165.1 with the federal HIPAA Privacy Rule. Together, those two layers control who can see your records, what you pay for them, and what happens when a provider gets it wrong.

How to Request Your Records

Under RS 40:1165.1, any patient can ask for a copy of the medical information a provider holds, including anything the provider sent to an insurer, a government agency, or a third party. The request has to be in writing and carry a signed authorization.¹

Once the provider receives that written request, it has 15 days to produce the records. Miss the deadline, and you can go to court for a subpoena or order compelling production, with the provider on the hook for your reasonable attorney fees and expenses in getting that order. If the provider still refuses after certified mail or commercial courier notice of the violation, a $500 civil penalty per violation kicks in, plus attorney fees and costs at the court’s discretion. That $500 goes to you, not the state.²

A separate statute, RS 13:3715.1, controls how records are obtained by subpoena or court order during litigation. If you are a party to the lawsuit, the requesting side must file an affidavit confirming the records belong to a party and that you (or your attorney) got notice by mail at least seven days before the subpoena issued.³

What Providers Can Charge

Louisiana caps copying fees, and the ceiling depends on whether the records are on paper or already digital.

Paper Records

For records kept solely on paper, the maximum per-page charges run:

First 25 pages: $1.00 per page
Pages 26 through 350: $0.50 per page
Pages beyond 350: $0.25 per page

Hospitals, nursing homes, and other providers can add a handling charge of up to $25.00 and the actual cost of postage.²

Digital Records

When the records already exist in digital format and you ask for digital copies, the per-page rate still applies, but total charges cannot exceed $100 plus actual postage. If some records are paper and some are digital, the $100 cap covers only the digital portion. Digital imaging like X-rays stored electronically is capped at $200 plus actual postage.²

Federal rules cut the fee further in one common situation. The ONC’s Cures Act Final Rule requires that patients be able to reach all of their electronic health information through smartphone apps and patient portals at no cost, using standardized APIs. Providers using certified electronic health record systems cannot charge you for viewing or downloading your own data through those channels, even where Louisiana’s fee schedule would allow a charge.⁴

Records for a Minor or a Deceased Patient

Minors

HIPAA generally treats a parent as a minor child’s personal representative, which gives the parent the right to access and request the child’s records. Louisiana’s statute matches this by letting a “patient or his legal representative” obtain copies with signed authorization, and it defines legal representative to include guardians and people acting under a valid healthcare power of attorney.¹

Parental access is not absolute. HIPAA restricts it when a minor is permitted by state law to consent to treatment on their own, when a court or someone other than the parent authorized the care, or when a provider reasonably believes parental access could endanger the child, such as in suspected abuse or neglect.

Deceased Patients

RS 40:1165.1 spells out who can pull a decedent’s records: the executor of the will, the estate administrator, the surviving spouse, and the parents or children of the deceased. Any of them can obtain a complete copy by providing a signed authorization. After a claim is made, insurance companies and their counsel gain access, and once suit is filed, defense counsel or any named defendant can request the records.²

Attorneys can also obtain a deceased patient’s records through the litigation subpoena procedure in RS 13:3715.1 or by court order.³

Mental Health and Substance Use Records Are Different

These records carry protections beyond what applies to a standard chart, and the difference matters if you are trying to obtain them or trying to keep them contained.

Under federal law, psychotherapy notes (a therapist’s personal session notes kept separate from the rest of the record) generally cannot be disclosed without your specific written authorization. The exceptions are narrow: training programs for mental health practitioners, health oversight activities involving the note’s author, and situations where the provider needs the notes to defend against a legal action you brought.⁵

Substance use disorder treatment records get the strongest federal protection, under 42 CFR Part 2. They can only be used or disclosed as that regulation specifically permits, and they generally cannot be used in any civil, criminal, administrative, or legislative proceeding. Written consent must identify the specific patient, the recipients, the purpose, and the information to be shared. A single blanket consent can cover treatment, payment, and healthcare operations, but it has to meet strict formatting rules.⁶

In practice, a provider treating you for a substance use disorder cannot just forward those records to your primary care doctor without following the Part 2 consent process.

When Providers Can Share Records Without Your Consent

HIPAA and Louisiana law both carve out situations where a provider may or must disclose information without asking you first.

Public Health

HIPAA permits disclosure, without authorization, to public health authorities receiving reports to prevent or control disease, track injuries, or conduct investigations. Providers can also share information with the FDA regarding the safety or effectiveness of regulated products.⁷

Mandatory Reporting to Law Enforcement

Louisiana requires medical professionals to report gunshot wounds. Under RS 14:403.5, anyone who treats a gunshot wound must give oral notice to the parish sheriff or the local police chief before the patient is released, and must note the report on the emergency record.⁸

Court Orders and Subpoenas

A covered entity may disclose protected health information in response to a court order, but only the specific information the order authorizes. For a subpoena or discovery request without a court order, the provider can release records only if the requesting party shows that the patient was given notice and a chance to object, or that a qualified protective order has been requested or agreed upon.⁹

RS 13:3715.1 layers on the state requirement: subpoenas for litigation records need an affidavit confirming the records belong to a party and that the patient received seven days’ notice. For records of non-parties, a written patient authorization or a court order is required.³

The Right to Correct a Record

HIPAA gives you the right to ask a covered entity to amend protected health information it keeps in a designated record set if you think it’s wrong. The provider can deny the request only in limited circumstances, such as when it determines the information is already accurate and complete.¹⁰

Penalties When Providers Violate the Rules

Louisiana’s $500 Penalty for Ignoring a Request

The state penalty is targeted at stonewalling. If a provider blows the 15-day deadline and still refuses after you send certified mail or commercial courier notice of the violation, RS 40:1165.1 imposes a $500 civil penalty per violation, payable to you, plus attorney fees and costs at the court’s discretion.²

A provider who releases records through the procedures in RS 40:1165.1, RS 13:3715.1, or the Code of Evidence is protected from civil or criminal liability for that disclosure, as long as it has not received notice that the patient has taken legal action to block the release.³

HIPAA Civil Penalties

HIPAA’s civil penalties run in four tiers based on culpability. The base statutory ranges:

No knowledge of the violation: $100 to $50,000 per violation
Reasonable cause (not willful neglect): $1,000 to $50,000 per violation
Willful neglect, corrected within 30 days: $10,000 to $50,000 per violation
Willful neglect, not corrected: $50,000 per violation

These figures are adjusted upward each year for inflation, so the amounts actually enforced are higher than the base numbers. Each tier also has an annual cap for identical violations in a calendar year. HHS cannot impose civil penalties (except for willful neglect) if the violation is corrected within 30 days of discovery.

HIPAA Criminal Penalties

Criminal prosecution is reserved for people who knowingly obtain or disclose individually identifiable health information in violation of HIPAA:

Basic violation: up to $50,000 in fines and up to one year in prison
False pretenses: up to $100,000 in fines and up to five years in prison
Intent to sell, transfer, or use information for commercial advantage, personal gain, or malicious harm: up to $250,000 in fines and up to ten years in prison

¹¹

If Your Records Are Breached

Louisiana’s Database Security Breach Notification Law (RS 51:3071 et seq.) requires businesses and agencies to notify affected people and the Attorney General within 60 days of discovering a breach of personal information. If the entity needs more time to determine the scope, stop further exposure, or restore system integrity, it must give the Attorney General written reasons for the delay within that same 60-day window. The Attorney General may grant a reasonable extension.¹²

HIPAA adds its own breach notification requirements for health information. Covered entities must notify affected individuals, HHS, and in some cases the media, when unsecured protected health information is compromised. Breaches affecting 500 or more people require notification within 60 days; smaller breaches can be reported annually. A healthcare data breach in Louisiana can trigger both regimes at once.

How Long Records Have to Be Kept

Louisiana sets minimum retention periods that vary by provider and record type. Physicians and dentists must keep medical and dental records for at least six years from the date of last treatment. Hospitals must retain records for at least ten years from the discharge date. Diagnostic imaging such as X-rays must be kept for at least three years from the last treatment date (physicians) or discharge date (hospitals).

Those are floors. Ongoing litigation, government audits, or records of minor patients can extend retention well past the minimum, because minors often cannot bring certain claims until after they reach the age of majority.

1
Justia. Louisiana Code RS 40:1165.1 – Healthcare Information; Records
2
Louisiana State Legislature. Louisiana Code RS 40:1165.1 – Healthcare Information; Records
3
Justia. Louisiana Code RS 13:3715.1 – Medical or Hospital Records of a Patient
4
HealthIT.gov. ONC’s Cures Act Final Rule
5
Louisiana Department of Health. Policy 19 – Uses and Disclosures of Client or Participant Information – HIPAA
6
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
7
U.S. Department of Health and Human Services. Disclosures for Public Health Activities
8
Louisiana State Legislature. Louisiana Code RS 14:403.5 – Gunshot Wounds; Mandatory Reporting
9
eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
10
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
11
GovInfo. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
12
Justia. Louisiana Code RS 51:3074 – Protection of Personal Information