Wisconsin Healthcare Compliance Requirements
State-specific breach notification rules, medical records retention periods, PDMP requirements, and mandatory reporting obligations for medical practices operating in Wisconsin.
Wisconsin's data-breach statute — the Wisconsin Notice of Personal Information Breach law, Wis. Stat. §134.98, enforced by the Wisconsin Attorney General through the Department of Justice's Office of Consumer Protection in Madison — is one of the few central-Midwest rules with a hard clock: notice within 45 days of learning of the breach, two weeks inside the federal 60-day outer limit. It does not reach your practice. Section 134.98(3m)(b), titled "Regulated entities exempt", provides that the section does not apply to an entity described in 45 C.F.R. §164.104(a) that complies with 45 C.F.R. Part 164 — so a HIPAA covered entity answers to the federal Breach Notification Rule and its 60-day outer limit rather than to Wisconsin's 45-day one. The exemption is conditioned on the federal compliance it names, which makes 45 C.F.R. Part 164, not §134.98, the standard your incident-response plan has to satisfy. Penalties under §134.98 reach $10,000 per negligent violation and $100,000 per intentional violation for the entities the section does cover, with the AG retaining discretion to layer deceptive-trade-practices claims under Wis. Stat. §100.18. Hospital records must be retained 7 years from last treatment under Wis. Admin. Code DHS §124.14, with pediatric records held until age of majority plus 7 years. The Wisconsin ePDMP requires queries before every controlled-substance prescription. Retention and PDMP duties, not breach timing, are where Wisconsin law adds to your federal obligations.
Breach Notification Rules
Notification deadline
60 calendar days (HIPAA)
Wisconsin law states 45 days, but that figure does not bind a HIPAA covered practice — see below.
Notification must be made within 45 days of learning of the breach — Wis. Stat. §134.98(3)(a). Decisively for this audience: §134.98(3m)(b), titled "Regulated entities exempt", provides that the section does not apply to an entity described in 45 C.F.R. §164.104(a) that complies with 45 C.F.R. Part 164 — so a HIPAA-covered medical practice is exempt from the Wisconsin statute and the federal rule governs instead. (The exemption is §134.98(3m)(b); §134.98(2)(cm) is the unrelated harm-threshold exception.)
AG notification threshold (as the statute reads)
Not explicitly required
Harm analysis required
Penalty range
Up to $10,000 per negligent violation, $100,000 per intentional violation
Enforcement Posture
The Wisconsin Attorney General's posture is moderate, and for healthcare it is largely indirect: §134.98(3m)(b) lifts HIPAA covered entities out of the very statute the Department of Justice's Office of Consumer Protection enforces, so breach-notice review of a compliant practice runs through OCR rather than Madison. The AG's independent hooks survive — Wis. Stat. §100.18 deceptive-trade-practices claims reach a confusing or misleading consumer notice on their own terms, and the exemption is written for an entity "that complies with 45 C.F.R. Part 164," so it is only as durable as your federal program. The Madison-Milwaukee corridor generates most enforcement activity, with cross-border health-system incidents adding complexity when records flow across Wisconsin's Illinois, Minnesota, Iowa, and Michigan borders — in those incidents it is the neighboring states' clocks, not Wisconsin's, that compress the notice timeline.
Medical Records Retention
| Record type | Retention period | Measured from |
|---|---|---|
| General medical | 7 years | Last treatment |
| Pediatric | 7 years | Patient turns 18 |
Controlled-Substance Prescription Monitoring (WI ePDMP)
The Wisconsin ePDMP requires queries before every controlled-substance prescription, with delegation to licensed staff permitted. Exemptions cover hospice, cancer treatment, ER three-day supplies, and inpatient or long-term-care administration. Civil penalties reach $1,000 per violation, with Wisconsin Medical Examining Board discipline available in parallel. Register at pdmp.wi.gov and document the query in the patient chart. Wisconsin's ePDMP supports integrated EHR queries that satisfy both the documentation requirement and the every-prescription mandate when configured correctly.
Check required
Every prescription
Check frequency
Every prescription
Delegation allowed
Penalty range
Licensing board discipline; civil penalties up to $1,000 per violation; possible misdemeanor charges
Exemptions
Hospice patients, cancer treatment, ≤3 day supply in ER, inpatient hospital or long-term care administration
How Wisconsin Rules Hit by Specialty
Telehealth providers
Wisconsin requires telehealth providers furnishing care to Wisconsin patients to hold a Wisconsin Medical Examining Board license or qualify under IMLC. Breach response involving cross-border telehealth services must distinguish the licensing state from the patient-residence state, though Wisconsin itself adds no clock: §134.98(3m)(b) exempts HIPAA covered entities, so a Wisconsin-resident patient's records sit on the federal 60-day timeline while out-of-state residents in the same incident may pull in their own state's rule.
Hospital systems
Aurora, Froedtert, Marshfield Clinic, and Ascension Wisconsin span the state with cross-border networks reaching Illinois, Minnesota, Iowa, and Michigan. A single regional EHR incident reaches residents of all five states at once, and each state's own carve-outs decide which of their rules actually bind a HIPAA covered entity — Minnesota and Iowa, for instance, set no numeric deadline at all. Wisconsin's does not bind: §134.98(3m)(b) exempts HIPAA covered entities, leaving the federal rule to govern the Wisconsin residents in the file. Check each affected state individually rather than assuming the tightest clock wins.
Behavioral health
Wisconsin's behavioral-health record protections under Wis. Stat. §51.30 are stricter than HIPAA on disclosure, requiring written authorization for most releases — a duty that survives untouched even though §134.98(3m)(b) exempts covered entities from the state breach statute. A breach involving §51.30-protected records should address the §51.30 authorization posture alongside the federal breach notice.
Dental practices
Wisconsin dentists are mandated reporters of child abuse under Wis. Stat. §48.981, with up to $1,000 fine and 6 months jail for failure to report. The §134.98(3m)(b) exemption applies equally to dental practices that are HIPAA covered entities, so a dental breach runs on the federal 60-day clock — worth confirming in the many small offices that had planned around a tighter state deadline.
Mandatory Reporting Obligations
Mandated reporters
Physicians, nurses, dentists, psychologists, social workers, EMTs, and all healthcare professionals
Report to
County Department of Human/Social Services or local law enforcement
Timeline
Immediately / as soon as possible
Penalty for failure
Up to $1,000 fine and/or 6 months jail
Immunity provision
Good faith reporters immune from civil and criminal liability under Wis. Stat. 48.981(4)
Mandated reporters
Physicians, nurses, social workers, and all healthcare professionals
Report to
County Department of Human/Social Services, Elder Abuse Reporting Agency
Timeline
Immediately / as soon as possible
Penalty for failure
Up to $500 fine
Immunity provision
Good faith reporters immune from civil and criminal liability
Mandated reporters
Healthcare providers treating injuries from suspected domestic abuse or criminal acts
Report to
Local law enforcement
Timeline
Immediately / as soon as possible
Immunity provision
Good faith reporters immune from civil liability
Mandated reporters
Physicians, laboratories, and healthcare facility administrators
Report to
Wisconsin Department of Health Services, Division of Public Health, or local health department
Timeline
Within 24 hours
Penalty for failure
Up to $500 fine per violation
Immunity provision
Good faith reporters immune from civil liability
Mandated reporters
All healthcare providers treating gunshot wounds or injuries from criminal violence
Report to
Local law enforcement
Timeline
Immediately / as soon as possible
Penalty for failure
Up to $500 fine
Immunity provision
Good faith reporters immune from civil and criminal liability
Wisconsin Compliance FAQs
For a HIPAA covered entity, Wisconsin sets none. Wis. Stat. §134.98(3)(a) does impose a 45-day deadline, but §134.98(3m)(b) — titled "Regulated entities exempt" — provides that the section does not apply to an entity described in 45 C.F.R. §164.104(a) that complies with 45 C.F.R. Part 164. A compliant medical practice therefore works to HIPAA's 60-day outer limit, and the shorter state window binds Wisconsin businesses that are not covered entities.
Wis. Stat. §134.98 violations carry up to $10,000 per negligent violation and $100,000 per intentional violation — exposure that falls on the entities the section covers, which under §134.98(3m)(b) does not include a HIPAA covered entity complying with 45 C.F.R. Part 164. The AG retains discretion to layer Wis. Stat. §100.18 deceptive-trade-practices claims on top, and those reach a misleading consumer notice independently of the breach statute, with the Department of Justice's Office of Consumer Protection able to pursue restitution and injunctive relief. The intentional-vs-negligent distinction matters for anyone the section does reach; document the investigation timeline contemporaneously either way.
No. Wis. Stat. §134.98 imposes no separate AG-notification mandate, and §134.98(3m)(b) exempts HIPAA covered entities from the section altogether, so no Wisconsin filing survives for a compliant practice — your notice obligations run to the affected individuals and to HHS under the federal Breach Notification Rule, plus prominent media notice when more than 500 residents of one state or jurisdiction are affected. The Department of Justice's Office of Consumer Protection still retains broad oversight authority, and practices experiencing a multi-thousand-record breach sometimes make voluntary AG notice as a defensive measure.
Wis. Admin. Code DHS §124.14 requires hospitals to retain general medical records for 7 years from last treatment. Pediatric records must be retained until age of majority plus 7 years. Physician offices follow the same 7-year benchmark under Wisconsin Medical Examining Board guidance, providing consistency between hospital and outpatient retention.
The Wisconsin ePDMP (electronic Prescription Drug Monitoring Program) is the state's controlled-substance monitoring database. Prescribers must query before every controlled-substance prescription, with delegation to licensed staff allowed. Civil penalties reach $1,000 per violation, plus Wisconsin Medical Examining Board discipline. Integrated EHR queries can satisfy both documentation and frequency requirements.
Guides & Articles
Stay audit-ready in Wisconsin
GuardWell tracks Wisconsin-specific breach deadlines, retention periods, WI ePDMP PDMP queries, and mandatory reporting obligations automatically.