HIPAA compliance for independent medical practices in Massachusetts

Massachusetts keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Massachusetts has 10 recorded rules that apply to independent medical practices differently from other businesses in the state — set out below with their conditions and sources.

Massachusetts jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Massachusetts's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Medical practices that electronically submit claims, check eligibility, request authorization, or conduct another adopted transaction are HIPAA covered entities. That describes the overwhelming majority of modern medical practices. The duties below are required; an EHR does not perform them for the practice.

State — how Massachusetts law interacts with HIPAA

Massachusetts substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Independent medical practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Massachusetts requires notice content that HIPAA does not require, including the name of the person responsible for the breach if known and whether the entity maintains a written information security program. HIPAA notice alone does not satisfy Massachusetts content requirements.

What Massachusetts adds for independent medical practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Massachusetts's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Limit on liability

No physician or dentist, nor any hospital or clinic, shall be liable for a failure to obtain consent where emergency examination and treatment is given and delay in treatment will endanger the life, limb, or MENTAL WELL-BEING of the patient.

Provider class: a physician or dentist
Service: emergency examination and treatment

What this means operationally

Massachusetts is the only jurisdiction closed so far whose emergency provision names mental well-being alongside life and limb. That materially widens what counts as an emergency for a behavioral health presentation — a psychiatric crisis in which delay would endanger the patient's mental well-being is inside this provision, where in most states the emergency route is framed around physical risk.

Applies when

Emergency examination and treatment is given
Delay would endanger the life, limb, or mental well-being of the patient

State statuteMass. Gen. Laws ch. 112, § 12F, emergency clausePatients requiring emergency examination and treatmentVerified 2026-08-29

Limit on liability

A physician or dentist who relied in good faith upon the representations of a minor that they are eligible to consent under § 12F, or that they are over eighteen years of age, shall not be liable for that reliance.

Provider class: a physician or dentist
Service: care given on a minor's own consent under § 12F

What this means operationally

The section supplies TWO representations a practice may rely on, and the second is the broader one: a claim simply to be over eighteen. That means the good-faith protection covers the ordinary case of an adult-presenting patient as well as the § 12F status routes, none of which — married, in the armed forces, living separately and self-supporting — can be verified at a front desk.

Applies when

The minor represented eligibility to consent under § 12F, or that they are over eighteen
The physician or dentist relied on that representation in good faith

State statuteMass. Gen. Laws ch. 112, § 12F, good-faith clauseMinors representing eligibility to consentVerified 2026-08-29

Payment liability

The parent or legal guardian shall not be liable for the payment of any care rendered on the minor's own consent under § 12F unless the parent or legal guardian has expressly agreed to pay for it.

Service: care given on a minor's own consent under § 12F

What this means operationally

The condition is an EXPRESS agreement to pay, which is a higher bar than the participation tests California and Maryland use — a parent who attends the appointment, or who is listed as the insurance subscriber, has not thereby agreed. Read alongside the § 12F confidentiality clause, which permits release only on the minor's written consent or a court order, billing a parent's account would also be a disclosure the section does not authorize.

Applies when

Care was rendered on the minor's own consent under § 12F

Exceptions

A parent or guardian who has expressly agreed to pay is liable

State statuteMass. Gen. Laws ch. 112, § 12F, payment clauseMinors who consented to their own care under § 12FVerified 2026-08-29

Minor may consent

A minor twelve years of age or older who is found to be drug dependent by two or more physicians may give consent to hospital and medical care related to the diagnosis or treatment of that drug dependency, and the consent of a parent or legal guardian is not necessary. Records shall be kept of such care. The parent or legal guardian shall not be liable for payment of care rendered under the section. The section does not apply to methadone maintenance therapy.

Service: hospital and medical care related to the diagnosis or treatment of drug dependency
Patient population: minors 12 and older found drug dependent by two or more physicians

What this means operationally

The gate is a finding by TWO OR MORE physicians, which is unique in this corpus — every other substance-use consent route in the closed jurisdictions turns on the minor's request or on a single professional's judgment. A practice with one physician cannot open this route by itself, so the referral arrangement has to exist before the patient does. Methadone maintenance is carved out entirely, which parallels the California and Texas treatment of replacement narcotic therapy.

Applies when

The minor is 12 or older
Two or more physicians have found the minor to be drug dependent
The care relates to diagnosis or treatment of that drug dependency

Exceptions

Does not apply to methadone maintenance therapy

State statuteMass. Gen. Laws ch. 112, § 12EMinors 12 and older found drug dependentVerified 2026-08-29

Limit on liability

No physician or dentist, nor any hospital or clinic, shall be liable for a failure to obtain parental or guardian consent where the care is given for the prevention of HIV for sexually active minors.

Provider class: a physician or dentist, and any hospital or clinic
Service: care for the prevention of HIV
Patient population: sexually active minors

What this means operationally

The limb that is easiest to miss because it shares a sentence with the emergency rule and is read as though it inherited the emergency trigger. It does not. Prevention of HIV for a sexually active minor is protected on its own terms, with no urgency requirement, so a Massachusetts practice can provide PrEP or equivalent preventive care to a sexually active minor without parental consent and without arguing that delay would have been dangerous. It pairs with the consent limb in the same section: the minor's own consent is effective for that care, and the provider is separately protected for not seeking the parent's.

Applies when

The care is for the prevention of HIV
The minor is sexually active

State statuteMass. Gen. Laws ch. 112, § 12F, HIV-prevention clauseSexually active minorsVerified 2026-08-29

Minor confidentiality

Release prohibited

All information and records kept in connection with care given to a minor who consented under § 12F shall be confidential between the minor and the physician or dentist, and shall not be released except upon the written consent of the minor or a proper judicial order.

Provider class: the physician or dentist attending the minor
Service: care given to a minor on the minor's own consent under § 12F

What this means operationally

Among the strictest confidentiality rules in this corpus, because it names only two routes out — the MINOR's written consent, or a court order. There is no clinical-judgment exception and no parental route, so a Massachusetts practice cannot release these records to a parent on any professional determination it makes itself. The single carve-out lives elsewhere in the section, in the life-or-limb notification duty, and that duty is to notify of the CONDITION rather than to release the record.

Applies when

The care was given on the minor's own consent under § 12F

Exceptions

Release on the written consent of the minor
Release upon a proper judicial order

State statuteMass. Gen. Laws ch. 112, § 12F, confidentiality clauseMinors who consented to their own care under § 12FVerified 2026-08-29

Provider disclosure to a parent

Provider must disclose

Where the physician or dentist attending a minor reasonably believes the minor's condition to be so serious that life or limb is endangered, the physician or dentist shall notify the parents, legal guardian or foster parents of that condition.

Provider class: the physician or dentist attending the minor
Patient population: minors treated on their own consent under § 12F

What this means operationally

This is an obligation, not a permission — the opposite of Texas § 32.004, and it fires on a clinical threshold rather than on a request. A practice treating minors on their own consent needs the escalation path defined in advance, because the moment the threshold is met the notification is required and there is no discretion left to exercise.

Applies when

The minor was treated on their own consent under § 12F
The attending physician or dentist reasonably believes life or limb is endangered

State statuteMass. Gen. Laws ch. 112, § 12F, life-or-limb clauseMinors treated on their own consent under § 12FVerified 2026-08-29

Destruction and disposition

Destruction or disposition requirement

Any such record or any part or portion thereof MAY BE DESTROYED 20 YEARS AFTER THE DISCHARGE OR THE FINAL TREATMENT THEREIN OF THE PATIENT to whom it relates. The hospital or clinic MAY DESTROY RECORDS ONLY AFTER THE APPLICABLE RETENTION PERIOD HAS ELAPSED AND AFTER NOTIFYING THE DEPARTMENT OF PUBLIC HEALTH, in accordance with its regulations, that the records will be destroyed. The department, through its regulations, shall establish an appropriate notification process.

Setting: hospitals and clinics subject to licensure by the Department of Public Health, or supported in whole or in part by the Commonwealth

Reaches this practice type only where the practice is a licensed clinic rather than a private office.

What this means operationally

Twenty years is far longer than any practice-level period in this corpus, and it applies to licensed hospitals and clinics rather than to private offices — a distinction that matters for a group practice deciding whether it holds a clinic license. Two conditions gate destruction and both must be satisfied: the period must have elapsed AND the Department of Public Health must have been notified beforehand. A facility that destroys on schedule without notifying has breached the section even though the twenty years ran. The clock is compound — discharge or final treatment, whichever applies to the encounter.

Applies when

A licensed hospital or clinic proposes to destroy a patient record

Exceptions

Medical peer review committee records and proceedings are outside the definition of record for this section

State statuteMass. Gen. Laws ch. 111, § 70Patients of a licensed hospital or clinicVerified 2026-08-30

Provider must disclose

ON THE NOTICE OF PRIVACY PRACTICES distributed to its patients, a hospital or clinic SHALL PROVIDE: information concerning the provisions of this section, AND THE HOSPITAL OR CLINIC'S RECORDS TERMINATION POLICY.

Setting: hospitals and clinics subject to Department of Public Health licensure

Reaches this practice type only where the practice is a licensed clinic rather than a private office.

What this means operationally

Massachusetts requires the records-destruction policy to be published to patients in the notice of privacy practices, which is not a federal requirement and is easy to miss when a facility adopts a standard template. Two things follow. The facility must actually HAVE a written records termination policy, because it cannot publish one otherwise. And the notice must also explain the section itself — the twenty-year period, the destruction conditions and the access rights — so a generic HIPAA notice will not satisfy it without a Massachusetts-specific addition.

Applies when

A hospital or clinic distributes a notice of privacy practices to its patients

State statuteMass. Gen. Laws ch. 111, § 70Patients of a licensed hospital or clinicVerified 2026-08-30

Closure, transfer and custody of records

Custody on closure or transfer

IN THE EVENT OF THE TRANSFER OF OWNERSHIP of a hospital or a clinic, ALL MEDICAL RECORDS OF THE SAME SHALL BE MAINTAINED BY THE NEW OWNER AS IF THERE WERE NO CHANGE IN OWNERSHIP. IN THE EVENT OF THE PERMANENT CLOSING of a hospital or clinic, such hospital or clinic SHALL ARRANGE FOR PRESERVATION of such medical records FOR THE TIME REQUIRED HEREIN.

Setting: hospitals and clinics subject to Department of Public Health licensure

Reaches this practice type only where the practice is a licensed clinic rather than a private office.

What this means operationally

AS IF THERE WERE NO CHANGE IN OWNERSHIP is the operative phrase and it is unusually absolute: the acquirer inherits the full twenty-year obligation on records it did not create, with no reset of the clock and no ability to negotiate the duty away in the purchase agreement. For diligence that makes the completeness and usability of the transferred set a priced item. On permanent closure the duty does not lapse either — the closing facility must ARRANGE preservation for the balance of the period, which requires a custodian to be identified before the doors shut.

Applies when

Ownership of a hospital or clinic is transferred, or the facility permanently closes

State statuteMass. Gen. Laws ch. 111, § 70Patients of a licensed hospital or clinicVerified 2026-08-30

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Massachusetts breach obligations

These apply to businesses generally rather than to independent medical practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Massachusettsbreach data →

Individual notice deadline

As soon as practicable and without unreasonable delay after knowing or having reason to know of the breach or unauthorized use. The statute does not fix a numeric outer bound, but delay past what is reasonable is itself a violation.

The statute does not fix a numeric outer bound. Unreasonable delay is itself a violation and may result in state enforcement action, so treat the operative timeframe as the shortest window your incident circumstances reasonably support.

State regulator notice

Required

Notice must be provided to (1) the Massachusetts Attorney General and (2) the Director of the Office of Consumer Affairs and Business Regulation, in addition to affected residents.

Source: Mass. Gen. Laws ch. 93H, § 3

Statewide rules that also reach independent medical practices

Minor may consent

A minor may consent to medical or dental care without parental permission where the minor is married, widowed or divorced; is the parent of a child; is a member of any of the armed forces; is pregnant or believes themselves pregnant; is living separately from parents and managing their own financial affairs; or reasonably believes themselves to be suffering from or to have come into contact with a disease defined as dangerous to the public health, OR SEEKS CARE FOR THE PREVENTION OF HIV IF THE MINOR IS SEXUALLY ACTIVE.

What this means operationally

Consent turns on the minor's circumstances rather than age, so intake has to capture status — marital, parental, service, residential, financial — and not merely date of birth. The public-health limb is the one most likely to arise unplanned in a general practice, and it is scoped to the disease rather than to the visit.

Applies when

One or more of the enumerated circumstances applies
For the HIV-prevention limb, the trigger is that the minor is sexually active — not exposure to or belief in a disease

Exceptions

Consent may not be given under the second through sixth circumstances for abortion or sterilization

StatewideMass. Gen. Laws ch. 112, § 12F, consent clauseAll minors under 18Verified 2026-08-29

Parental right of access

A health care provider who maintains records for a patient treated or examined by such provider SHALL PERMIT INSPECTION of such records by the patient or an AUTHORIZED REPRESENTATIVE of the patient, and UPON REQUEST A COPY of the patient's record SHALL BE FURNISHED UPON PAYMENT OF A REASONABLE FEE, AS DEFINED IN SECTION 70 OF CHAPTER 111.

What this means operationally

The operative detail is the cross-reference. Massachusetts does not write a separate fee rule for practices — § 12CC imports the schedule that chapter 111 § 70 writes for HOSPITALS AND CLINICS, so a private dental, optometric or chiropractic office charges on a hospital's schedule. A practice looking only in the professions chapter will not find a figure at all. Note the section states no deadline for an ordinary request; the only stated clock in Massachusetts is the thirty days for benefit-claim requests.

Applies when

A patient or authorized representative asks to inspect, or requests a copy of, records held by a health care provider

StatewideMass. Gen. Laws ch. 112, § 12CCPatients and authorized representativesVerified 2026-08-30

Parental right of access

NO HEALTH CARE PROVIDER SHALL CHARGE A FEE to any applicant, beneficiary or individual representing an applicant or beneficiary for furnishing a health record IF THE RECORD IS REQUESTED FOR THE PURPOSE OF SUPPORTING A CLAIM OR APPEAL UNDER ANY PROVISION OF THE SOCIAL SECURITY ACT OR ANY FEDERAL OR STATE FINANCIAL NEEDS-BASED BENEFIT PROGRAM. A health care provider SHALL FURNISH a health record requested pursuant to such a claim or appeal WITHIN THIRTY DAYS of the request. Any person for whom no fee shall be charged SHALL PRESENT REASONABLE DOCUMENTATION at the time of the records request that the purpose of the request is to support such a claim or appeal.

What this means operationally

This is the only stated response deadline for a Massachusetts practice, and it attaches to the free route rather than the paid one — thirty days for a benefit-claim request, nothing specified for an ordinary request. The documentation condition sits on the requester and must be presented AT THE TIME of the request, so a practice may properly ask what the records are for before waiving the fee, and a later assertion does not retroactively make the copy free. The program list is broad: any provision of the Social Security Act and any federal or state needs-based benefit program, which reaches disability, SSI and state assistance appeals alike.

Applies when

A record is requested to support a claim or appeal under the Social Security Act or a federal or state needs-based benefit program, with documentation presented at the time of request

StatewideMass. Gen. Laws ch. 112, § 12CC; ch. 111, § 70Patients and authorized representativesVerified 2026-08-30

Limit on copy fees, format or delivery

A REASONABLE FEE for these purposes MEANS a BASE CHARGE OF NOT MORE THAN $15 for each request for a medical record; a PER PAGE CHARGE OF NOT MORE THAN $0.50 for each of the FIRST 100 PAGES copied per request; and NOT MORE THAN $0.25 PER PAGE for each page IN EXCESS OF 100 PAGES copied per request. The reasonable fee MAY BE ADJUSTED to reflect the CONSUMER PRICE INDEX FOR MEDICAL CARE SERVICES, such that the base amount and the per page charge shall be increased by the proportional consumer price index in effect AS OF OCTOBER OF THE CALENDAR YEAR IN WHICH THE REQUEST IS MADE, rounded to the nearest dollar. An ADDITIONAL FEE may be charged to cover the cost of POSTAGE, other priority mailing, and PREPARATION OF AN EXPLANATION OR SUMMARY of the record if so requested.

This changes on 2027-10-01

The $15 base and the $0.50 and $0.25 per-page figures in this proposition are the statutory base amounts, not necessarily the lawful charge in any given year. The adjustment recurs annually, so a synthesis quoting these numbers must date them or state that they are subject to CPI adjustment.

What this means operationally

The schedule is degressive — the per-page rate halves after a hundred pages — so a large chart is proportionally cheaper than a small one, which is the opposite of most states. Two practical points. The CPI adjustment is keyed to OCTOBER of the year the request is made, so the lawful figure changes annually and any published number needs a date beside it; rounding to the nearest dollar also means the base charge moves in whole dollars. And the summary-preparation charge is only available where the patient asked for a summary — it is not a general handling fee.

Applies when

A copy of a medical record is furnished under § 12CC or § 70

Exceptions

No fee at all where the record supports a Social Security Act or needs-based benefit claim or appeal

StatewideMass. Gen. Laws ch. 111, § 70Patients and authorized representativesVerified 2026-08-30

What applies to independent medical practices everywhere

Independent medical practices often have the broadest technology and data surface: EHRs, portals, laboratories, e-prescribing, imaging, claims, referrals, fax, remote access, and dozens of vendors. The SRA must cover the whole environment — not merely the primary EHR.

The complete inventory of systems that create, receive, maintain, or transmit ePHI

EHR access, administrative privileges, audit logging, integrations, APIs, and patient-portal connections

Laboratory, imaging, e-prescribing, pharmacy, hospital, specialist, and referral data flows

Claims, eligibility, prior authorization, clearinghouse, billing, and payment workflows

Email, text, e-fax, forms, telehealth, call recording, voicemail, and patient messaging

Workstations, servers, laptops, tablets, phones, network equipment, remote access, cloud storage, and backup

Full medical practicescompliance guide →

Knowing the Massachusetts rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Massachusetts rules on this page.

Start the risk assessment