Maine Medical Records Laws: Access, Fees, and Confidentiality

Maine’s medical records laws give you the right to get copies of your hospital and healthcare provider records, cap what you can be charged, set deadlines for a response, and protect your health information from unauthorized disclosure. The rules sit in three parts of Title 22: Section 1711 for hospital records, Section 1711-B for records held by other practitioners, and Section 1711-C for confidentiality. HIPAA and, for addiction treatment, 42 CFR Part 2 add federal protections on top.

Requesting Your Hospital Records

To get copies of records from a Maine hospital, submit a written request. The statute does not require you to include your date of birth or a description of the records, but adding identifying details will speed things up.¹

Section 1711 doesn’t set its own deadline. It ties response time to HIPAA under 45 CFR 164.524, which gives the hospital 30 days to act on your request.² The hospital can take one 30-day extension if it explains the delay in writing. Hospitals not subject to HIPAA must respond within a “reasonable time.”¹

A hospital may withhold records if releasing them would be detrimental to your health, but this exception is narrow and rarely used. A blanket refusal without justification isn’t allowed.

Requesting Records From Other Providers

Records held by physicians, dentists, therapists, and other non-hospital practitioners are governed by Section 1711-B. You submit a written authorization, and the provider must release copies of your treatment records or a narrative summary containing the relevant information.³

The 30-day HIPAA clock applies here too. Providers may leave out personal notes unrelated to your treatment or information tied to an FDA-regulated clinical trial. If a practitioner believes releasing records directly to you would harm your health, the practitioner must still release them to your authorized representative when you give written authorization.³

A practitioner who willfully violates these access rules faces a civil penalty of up to $25 per day the records aren’t released, capped at $100 total.³ The dollar amount is small. It still gives you a legal handle when a provider stalls.

What You Can Be Charged

Maine caps hospital charges for paper copies at $5 for the first page and $0.45 per additional page, with a $250 ceiling for the full record. Hospitals may require payment before fulfilling the request.⁴

If the record exists electronically and you ask for an electronic copy, the hospital must provide one when reasonably possible. The charge covers actual staff time, supplies, and postage. Retrieval fees, technology costs, and data storage infrastructure charges are not allowed. The total for electronic copies cannot exceed $150.⁴

Section 1711-B has no fee schedule for non-hospital providers. HIPAA’s general standard applies: fees must be reasonable and cost-based.

Who Else Can Access Your Records

Section 1711-B lists who can request records if you can’t or choose to delegate:

Adults 18 and older, requesting their own records, if mentally competent.
A parent, legal guardian, or guardian ad litem, for a minor patient.
A person named in your durable healthcare power of attorney, while that document is in effect.
An agent, guardian, or surrogate authorized under Maine’s Uniform Health Care Decisions Act.
A lay caregiver you designate under Section 1711-G.

For hospital records under Section 1711, an authorized representative must present written authorization from you.³

Minors Who Consented to Their Own Care

Maine allows minors to consent to treatment for substance use disorders and emotional or psychological problems without a parent’s involvement. Minors who are living independently, married, emancipated, or in the military may consent to all medical, dental, and mental health services on their own.⁵

When a minor lawfully consents to care, that minor gets the same confidentiality protection as an adult. A parent does not automatically gain access to those records. A provider may notify a parent, but the minor’s privacy is the default.⁵ Parents are often surprised by this. If your teenager sought treatment on their own for substance use or emotional problems, you may not be able to see those records without the minor’s agreement.

Records of a Deceased Patient

Under HIPAA, a deceased patient’s health information stays protected for 50 years after death. An executor, administrator, or other person with legal authority over the estate is treated as the personal representative and can access records relevant to that role.⁶

Section 1711-C also lists family members who may authorize disclosure when the patient or authorized representative cannot. In order of priority: spouse, parent, adult child or grandchild or sibling, certain extended family members, and finally any adult who demonstrated special concern for the patient and knew their personal values. A provider may decline release to someone on this list if disclosure wouldn’t be in the patient’s best interest, particularly where there are indicators of abuse.⁷

Fixing Errors in Your Record

HIPAA gives you the right to request an amendment when you believe information in your record is inaccurate or incomplete. The provider must respond within 60 days and can take a single 30-day extension with written notice.⁸

A provider can deny the request for a limited set of reasons: it didn’t create the record, the record isn’t part of the designated record set, or the information is accurate and complete as written. If denied, you can submit a written statement of disagreement that becomes part of your permanent file. The provider may attach a rebuttal, but both your statement and the original amendment request must travel with your record in future disclosures.⁸ A wrong diagnosis code or an incorrect medication history can follow you for years and affect insurance coverage and later treatment. Filing the statement of disagreement at least flags the dispute for anyone reading the file later.

Confidentiality of Your Health Information

Section 1711-C generally prohibits providers and facilities from disclosing your health information without written authorization. A valid authorization must state the purpose of the disclosure, who can receive the information, what information is covered, and an expiration date or event. It must also inform you of your right to revoke it.⁷

Maine goes further than HIPAA on mental health records. Records held by psychiatrists, psychologists, licensed social workers, and counseling professionals require authorization for non-emergency disclosures outside the provider’s own practice, even for referrals to another provider.⁷ This surprises providers who assume a general treatment exception covers mental health referrals.

Revoking an Authorization

You can revoke an authorization at any time, in writing or orally. A written revocation must be signed and dated. If you revoke orally, the provider must record your name and the date. Once revoked, the provider must stop future disclosures, though anyone who already acted on the authorization before notice of the revocation is protected.⁷

Substance Use Disorder Records

Federal 42 CFR Part 2 adds a stricter layer for records from substance use disorder treatment programs. These records cannot be disclosed without your written consent or a court order, and they cannot be used in civil, criminal, administrative, or legislative proceedings against you unless you consent or a court specifically authorizes it. A court order allowing disclosure must be accompanied by a subpoena or similar mandate to compel it.⁹

A 2024 final rule aligned some Part 2 mechanics with HIPAA, including a single consent for treatment, payment, and healthcare operations. When Part 2 and HIPAA conflict, Part 2 controls. Covered entities must comply with the updated rule by February 16, 2026.⁹

When Records Can Be Disclosed Without Your Consent

Section 1711-C lists a long set of exceptions. The ones you’re most likely to encounter:

Treatment and care coordination. Providers within the same practice or organizational affiliate can share your records without authorization. Disclosures to outside providers for treatment generally don’t require consent either, with the mental health exception noted above.⁷
Public health reporting. Maine requires providers to report confirmed or suspected notifiable diseases and conditions to the Department of Health and Human Services, including communicable diseases, occupational diseases, and environmental health threats.¹⁰
Court orders and subpoenas. Only the information specifically requested should be shared. Substance use disorder records face the additional Part 2 restrictions above.
Preventing serious harm. HIPAA permits disclosures to avert a serious and imminent threat to health or safety. Maine’s public health statutes also allow reporting when someone poses a significant risk of exposing others to a notifiable disease.

Even when an exception applies, providers should disclose only the minimum information necessary. Oversharing beyond what a court order requests or a public health report requires can still be a violation.

Penalties for Unauthorized Disclosure

Maine Civil Penalties

Section 1711-C creates a private right of action. You can sue in Superior Court for an injunction and a civil penalty of up to $5,000 for an intentional violation. If the court finds violations frequent enough to amount to a general business practice, the penalty rises to $10,000 for individual practitioners and $50,000 for healthcare facilities.⁷

The statute of limitations is two years from when you discovered or should have discovered the disclosure. You can also pursue common-law claims like negligence, which Section 1711-C expressly preserves. The Maine Attorney General can bring an enforcement action when there’s reason to believe an intentional violation occurred.⁷

Federal HIPAA Penalties

HIPAA civil penalties are tiered by the violator’s level of fault:

No knowledge of the violation: $100 to $50,000 per violation, annual cap of $25,000 for repeat violations of the same provision.
Reasonable cause, not willful neglect: $1,000 to $50,000 per violation, annual cap of $100,000.
Willful neglect, corrected within 30 days: $10,000 to $50,000 per violation, annual cap of $250,000.
Willful neglect, not corrected within 30 days: $50,000 per violation, annual cap of $1.5 million.

The $1.5 million cap applies only to the most serious tier.¹¹

Criminal penalties apply to anyone who knowingly obtains or discloses protected health information in violation of HIPAA. They escalate with intent: up to $50,000 and one year in prison for a basic violation, up to $100,000 and five years for offenses involving false pretenses, and up to $250,000 and ten years when the information is used for commercial advantage, personal gain, or malicious harm.¹²

Where to File a Complaint

The Maine Board of Licensure in Medicine regulates physicians and physician assistants and accepts complaints from the public. If you believe a provider mishandled your records, a Board complaint is one option. The Board can deny or refuse to renew a license and impose other disciplinary sanctions for violations of professional standards.

Board discipline is only one piece of the enforcement picture. For confidentiality violations, Section 1711-C’s civil penalties and HIPAA’s federal enforcement usually carry more direct financial consequences. A Board complaint still creates an official record that can pressure a provider to change practices, particularly when the problem is systemic rather than a one-time mistake.

1
Maine State Legislature. Maine Revised Statutes Title 22 Section 1711 – Patient Access to Hospital Medical Records
2
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
3
Maine State Legislature. Maine Revised Statutes Title 22 Section 1711-B – Patient Access to Treatment Records
4
Maine State Legislature. Maine Revised Statutes 22 Section 1711 – Patient Access to Hospital Medical Records
5
Maine State Legislature. Maine Code Title 22 Chapter 260 – Consent of Minors for Health Services
6
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information
7
Maine State Legislature. Maine Code Title 22 Section 1711-C – Confidentiality of Health Care Information
8
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
9
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
10
Legal Information Institute. 10-144 C.M.R. ch. 258 Section 2 – Notifiable Diseases and Conditions Reporting Requirements
11
American Medical Association. href=”https://www.ama-assn.org/practice-management/hipaa/hipaa-violations-enforcement” target=”_blank” rel=”noopener”>HIPAA Violations and Enforcement
12
Office of the Law Revision Counsel. 42 U.S. Code 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information