Law / United States / 
Montana
Uniform Health Care Information Act: disclosure, patient access and remedies
Mont. Code Ann. §§ 50-16-501 to 50-16-553
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Data subject rights, Security, Disclosure
As of .
What it requires
- If you are a health care provider not subject to the Health Insurance Portability and Accountability Act (HIPAA) privacy provisions, do not disclose health care information about a patient to any other person without the patient's written authorization, except as sections 50-16-529 and 50-16-530 and other law allow, and conform any disclosure to the authorization.
- Keep with a patient's recorded health care information a record of each person who received or examined it in the preceding 3 years, with name, address, institutional affiliation, date and, to the extent practicable, a description of the information disclosed.
- Effect reasonable safeguards for the security of all health care information you maintain.
- If you provide health care at a facility you operate and maintain patient records, create a notice of information practices and post it in a conspicuous place in the facility.
- Within 10 days of a written request from a patient to examine or copy recorded health care information, make it available for examination without charge or provide a copy, or tell the patient it does not exist, who keeps it, why there is a delay (not later than 21 days) or that the request is denied under section 50-16-542.
- If you are a mental health digital service handling health care information on behalf of an individual, comply with the disclosure and confidentiality provisions of the part.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 50-16-551(1) makes examining or obtaining health care information maintained by a health care provider, in violation of the part, by bribery, theft or misrepresentation of identity, purpose of use or entitlement, a misdemeanor punishable by a fine not exceeding $10,000 or imprisonment not exceeding 1 year, or both.
Who enforces it
Enforcement body
The attorney general or the appropriate county attorney, who may maintain a civil action to enforce the part.
What this law does
The part applies only to a health care provider that is not subject to the privacy provisions of Health Insurance Portability and Accountability Act (HIPAA) and administrative rules adopted in connection with HIPAA. A health care provider is a person licensed, certified, or otherwise authorized by the laws of Montana to provide health care in the ordinary course of business or practice of a profession.
A person includes an individual, corporation, business trust, estate, trust, partnership, association, joint venture, government, governmental subdivision or agency, or other legal or commercial entity. A health care provider, an individual who assists in the delivery of health care, or an agent or employee of a provider may not disclose health care information about a patient to any other person without the patient's written authorization, except as the part allows.
A health care provider must maintain with a patient's recorded health care information a record of each person who received or examined it during the preceding 3 years. A health care provider shall effect reasonable safeguards for the security of all health care information it maintains.
Upon receipt of a written request from a patient to examine or copy recorded health care information, a health care provider must act as promptly as required and no later than 10 days after receiving the request. A mental health digital service is subject to the disclosure and confidentiality provisions of the part when handling health care information on behalf of an individual. Section 50-16-546 was added by section 1 of chapter 273, Laws of 2025.
The attorney general or appropriate county attorney may maintain a civil action to enforce the part. If a court determines that there is a violation of the part, the aggrieved person is entitled to recover damages for pecuniary losses and, if the violation results from willful or grossly negligent conduct, may recover not in excess of $5,000 in addition, exclusive of any pecuniary loss.
A person who by bribery, theft, or misrepresentation of identity, purpose of use, or entitlement examines or obtains health care information maintained by a provider in violation of the part is guilty of a misdemeanor punishable by a fine not exceeding $10,000 or imprisonment not exceeding 1 year, or both.
When LexLint raises it
When your app profile says your app handles health records.