Montana Healthcare Compliance Requirements
State-specific breach notification rules, medical records retention periods, PDMP requirements, and mandatory reporting obligations for medical practices operating in Montana.
Montana operates a relatively traditional breach regime under Montana Code Annotated § 30-14-1704, requiring notification "without unreasonable delay" with simultaneous notification to the Montana Attorney General — no statutory threshold, all breaches affecting Montana residents trigger AG notification. Penalties under the Montana Unfair Trade Practices Act reach $10,000 per violation. Records retention under ARM 37.106.402 requires 10 years from discharge for hospitals, with pediatric records running age of majority plus 10 years (effectively age 28). The Montana Prescription Drug Registry, branded as the Montana PMP at montana.pmpaware.net, must be queried on every controlled-substance prescription and is administered through the Montana Board of Pharmacy. Mandatory child-abuse reporting under MCA § 41-3-201 names healthcare professionals as required reporters with civil and criminal immunity under MCA § 41-3-203. Montana's vast geography means many practices serve as the only provider for hundreds of square miles, producing distinctive continuity-of-care and retention concerns absent from urban-state regimes.
Breach Notification Rules
Notification deadline
Most expedient time possible
Notification must be made without unreasonable delay. AG must be notified simultaneously with consumer notification.
AG notification threshold
All breaches
Notify: AG
Harm analysis required
Penalty range
Up to $10,000 per violation under Unfair Trade Practices Act
Enforcement Posture
The Montana Attorney General's Office of Consumer Protection handles breach-notification matters under MCA Title 30, Chapter 14. Montana's enforcement posture has historically been reactive and complaint-driven, similar to other low-population Mountain-West states, with the AG opening investigations primarily after multi-state breaches surface in HHS OCR filings. Settlements typically take the form of assurances of voluntary compliance with corrective-action obligations. The Montana Department of Public Health and Human Services and the Montana Board of Medical Examiners separately license facilities and providers and can impose licensing discipline. Because Montana's statutory penalty cap ($10,000 per violation) is moderate by national standards, the state's enforcement leverage typically comes through coordinated multi-state actions led by larger AGs. Practices should expect AG inquiries about breach-discovery timelines and continuity-of-care planning for affected rural Montanans.
Medical Records Retention
| Record type | Retention period | Measured from |
|---|---|---|
| General medical | 10 years | Last treatment |
| Pediatric | 10 years | Patient turns 18 |
Controlled-Substance Prescription Monitoring (Montana PMP)
The Montana Prescription Drug Registry (montana.pmpaware.net), administered by the Montana Board of Pharmacy, requires queries on every controlled-substance prescription. Delegation to licensed staff under a documented standing order is permitted. Exemptions cover hospice, cancer treatment, ER ≤3-day supplies, and inpatient hospital administration. Civil penalties up to $1,000 per violation plus licensing-board discipline form the primary enforcement framework.
Check required
Every prescription
Check frequency
Every prescription
Delegation allowed
Penalty range
Licensing board discipline; civil penalties up to $1,000 per violation
Exemptions
Hospice patients, cancer treatment, ≤3 day supply in ER, inpatient hospital administration
How Montana Rules Hit by Specialty
Pediatrics
Montana's ARM 37.106.402 pediatric retention rule — age of majority plus 10 years — produces a 28-year retention floor for a chart opened at birth. This is among the longer pediatric retention windows nationally. Encode the calculation as age 18 + 10 = age 28 to avoid premature destruction.
Telehealth providers
Out-of-state telehealth providers serving Montana residents fall under MCA § 30-14-1704 for breaches and must register with the Montana PMP before issuing any controlled-substance prescription. The Montana Board of Medical Examiners requires Montana licensure or interstate compact (IMLC) participation.
Behavioral health
Mental-health records follow the 10-year ARM 37.106.402 baseline. Mandated child-abuse reporting under MCA § 41-3-201 lists psychologists and licensed counselors as reporters with civil and criminal immunity. The MCA framework does not impose a mandatory adult-IPV reporting duty on healthcare providers.
Pharmacy/compounding
Montana pharmacies and compounders face Montana Board of Pharmacy PMP dispensing-report obligations and are subject to civil penalties up to $1,000 per violation plus licensing-board discipline. Rural pharmacy locations should automate PMP queries given limited staffing redundancy.
Mandatory Reporting Obligations
Mandated reporters
Physicians, nurses, dentists, psychologists, social workers, and all healthcare professionals
Report to
Department of Public Health and Human Services, Child and Family Services Division
Timeline
Immediately / as soon as possible
Penalty for failure
Misdemeanor, up to $500 fine and/or 6 months jail
Immunity provision
Good faith reporters immune from civil and criminal liability under MCA 41-3-203
Mandated reporters
Physicians, nurses, and all healthcare professionals
Report to
Adult Protective Services, Department of Public Health and Human Services
Timeline
Immediately / as soon as possible
Penalty for failure
Misdemeanor, up to $500 fine
Immunity provision
Good faith reporters immune from civil and criminal liability
Mandated reporters
Healthcare providers treating injuries from suspected domestic abuse
Report to
Local law enforcement
Timeline
Immediately / as soon as possible
Immunity provision
Good faith reporters immune from civil liability
Mandated reporters
Physicians, laboratories, and healthcare facility administrators
Report to
Montana Department of Public Health and Human Services, Communicable Disease Bureau
Timeline
Within 24 hours
Penalty for failure
Misdemeanor, up to $500 fine
Immunity provision
Good faith reporters immune from civil liability
Mandated reporters
All healthcare providers treating gunshot wounds or injuries from criminal violence
Report to
Local law enforcement
Timeline
Immediately / as soon as possible
Penalty for failure
Misdemeanor
Immunity provision
Good faith reporters immune from civil and criminal liability
Montana Compliance FAQs
MCA § 30-14-1704 requires notification 'without unreasonable delay' with simultaneous notification to the Montana Attorney General — there is no resident-count threshold. HIPAA's 60-day federal ceiling controls as the outer limit for covered entities. The Montana AG's Office of Consumer Protection receives the filing.
ARM 37.106.402 requires 10 years from discharge for hospital records, including a 10-year retention for pediatric records measured from age of majority — effectively age 28 for a chart opened at birth. Physician records sit at the HIPAA 6-year floor unless the practice is hospital-owned.
Yes. The Montana Prescription Drug Registry permits licensed staff to perform queries under a documented standing order. The prescriber must review and document the result before issuing the prescription. Civil penalties up to $1,000 plus licensing-board discipline enforce compliance.
Yes. MCA § 41-3-203 provides civil and criminal immunity for good-faith reporters. Failure to report by a mandated reporter (including healthcare professionals) is a misdemeanor carrying up to $500 fine and/or 6 months jail. Reports go to the Department of Public Health and Human Services, Child and Family Services Division.
No. MCA § 30-14-1704 requires AG notification for any breach affecting Montana residents — there is no minimum-resident threshold. This produces relatively high AG visibility into smaller breaches that would not trigger notification in states with 500-resident thresholds.
Stay audit-ready in Montana
GuardWell tracks Montana-specific breach deadlines, retention periods, Montana PMP PDMP queries, and mandatory reporting obligations automatically.