Wyoming Healthcare Compliance Requirements
State-specific breach notification rules, medical records retention periods, PDMP requirements, and mandatory reporting obligations for medical practices operating in Wyoming.
Wyoming maintains the most permissive healthcare-breach regime in the Mountain West. Wyoming Statutes Title 40, Chapter 12 requires breach notification "in the most expedient time possible and without unreasonable delay" with no fixed day-count and no statutory AG-notification threshold — neither population-based nor categorical. Penalties are enforced through the Wyoming Consumer Protection Act, with no specified cap. Records retention under the Wyoming Department of Health Chapter 4 rules requires 10 years from discharge for hospitals; physician offices follow the HIPAA 6-year minimum. The Wyoming PMP (wyoming.pmpaware.net), administered through the Wyoming State Board of Pharmacy, must be queried on every controlled-substance prescription. Mandatory child-abuse reporting under Wyoming Statutes § 14-3-205 names healthcare professionals as required reporters with civil and criminal immunity under WS § 14-3-209. Wyoming's population — the smallest in the United States — means many primary-care practices serve as the only provider within a 60-mile radius, producing distinctive operational concerns absent from urban regimes.
Breach Notification Rules
Notification deadline
Most expedient time possible
Notification must be made in the most expedient time possible and without unreasonable delay.
AG notification threshold
Not explicitly required
Harm analysis required
Penalty range
Enforceable by AG under Consumer Protection Act
Enforcement Posture
The Wyoming Attorney General's Consumer Protection Unit handles breach-notification matters under WS Title 40. Wyoming's enforcement posture is the most reactive of any Mountain-West state — the AG opens investigations almost exclusively in response to consumer complaints, multi-state coordinated actions, or HHS OCR public filings. Settlements, when they occur, typically take the form of assurances of voluntary compliance with corrective-action obligations. The Wyoming Department of Health and Wyoming Board of Medicine separately license facilities and providers and can impose licensing discipline for systemic compliance failures. Wyoming's lack of a statutory AG-notification threshold paradoxically produces less proactive AG visibility — without mandatory filings, the AG learns of breaches mostly secondhand. Practices should not interpret this as license for delay; the federal HIPAA 60-day clock remains the binding outer limit and OCR enforcement remains fully active.
Medical Records Retention
| Record type | Retention period | Measured from |
|---|---|---|
| General medical | 10 years | Last treatment |
Controlled-Substance Prescription Monitoring (Wyoming PMP)
The Wyoming Prescription Drug Monitoring Program (wyoming.pmpaware.net), administered by the Wyoming State Board of Pharmacy, requires queries on every controlled-substance prescription. Delegation to licensed staff under a documented standing order is permitted. Exemptions cover hospice, cancer treatment, ER ≤3-day supplies, and inpatient hospital administration. Civil penalties up to $1,000 per violation plus licensing-board discipline form the primary enforcement framework.
Check required
Every prescription
Check frequency
Every prescription
Delegation allowed
Penalty range
Licensing board discipline; civil penalties up to $1,000 per violation
Exemptions
Hospice patients, cancer treatment, ≤3 day supply in ER, inpatient hospital administration
How Wyoming Rules Hit by Specialty
Pediatrics
Wyoming has no codified pediatric retention extension — the 10-year hospital baseline (Wyoming DOH Chapter 4) and HIPAA 6-year physician floor apply. Pediatric standard of care argues for retention until age of majority (18) plus the longer retention period (effectively age 28 from a chart opened at birth). Codify this internal policy explicitly given the absence of statutory guidance.
Telehealth providers
Out-of-state telehealth providers serving Wyoming residents fall under WS Title 40 for breaches and must register with the Wyoming PMP before issuing any controlled-substance prescription. The Wyoming Board of Medicine requires Wyoming licensure or interstate compact (IMLC) participation.
Behavioral health
Mental-health records sit on the same retention baselines. Mandated child-abuse reporting under WS § 14-3-205 lists psychologists and licensed counselors as reporters with civil and criminal immunity under § 14-3-209. Wyoming does not impose a mandatory adult-IPV reporting duty on healthcare providers.
Pharmacy/compounding
Wyoming pharmacies and compounders face Wyoming State Board of Pharmacy PMP dispensing-report obligations and civil penalties up to $1,000 per violation plus licensing-board discipline. Rural pharmacy locations with limited staffing should automate PMP queries to reduce delegation-failure risk.
Mandatory Reporting Obligations
Mandated reporters
Physicians, nurses, dentists, psychologists, social workers, and all healthcare professionals
Report to
Department of Family Services or local law enforcement
Timeline
Immediately / as soon as possible
Penalty for failure
Misdemeanor, up to 6 months jail and/or $750 fine
Immunity provision
Good faith reporters immune from civil and criminal liability under WS 14-3-209
Mandated reporters
Physicians, nurses, and all healthcare professionals
Report to
Adult Protective Services, Department of Family Services
Timeline
Immediately / as soon as possible
Penalty for failure
Misdemeanor, up to $750 fine
Immunity provision
Good faith reporters immune from civil and criminal liability
Mandated reporters
Healthcare providers treating injuries from suspected domestic violence
Report to
Local law enforcement
Timeline
Immediately / as soon as possible
Immunity provision
Good faith reporters immune from civil liability
Mandated reporters
Physicians, laboratories, and healthcare facility administrators
Report to
Wyoming Department of Health, Public Health Division
Timeline
Within 24 hours
Penalty for failure
Misdemeanor, up to $500 fine
Immunity provision
Good faith reporters immune from civil liability
Mandated reporters
All healthcare providers treating gunshot wounds or injuries from criminal violence
Report to
Local law enforcement
Timeline
Immediately / as soon as possible
Penalty for failure
Misdemeanor
Immunity provision
Good faith reporters immune from civil and criminal liability
Wyoming Compliance FAQs
Wyoming Statutes Title 40, Chapter 12 requires notification 'in the most expedient time possible and without unreasonable delay' — there is no fixed day count and no statutory AG-notification threshold. HIPAA's 60-day federal ceiling controls as the outer limit for covered entities.
The Wyoming Department of Health Chapter 4 rules require hospitals to retain medical records for 10 years from discharge or last treatment. Physician offices follow the HIPAA 6-year minimum unless owned by a hospital, in which case the 10-year hospital rule applies.
Yes. Wyoming PMP permits licensed staff to perform queries under a documented standing order from a licensed prescriber. The prescriber must review and document the result before issuing the prescription. Civil penalties up to $1,000 plus licensing-board discipline enforce compliance.
Yes. WS § 14-3-209 provides civil and criminal immunity for good-faith reporters. Failure to report by a mandated reporter (including all healthcare professionals) is a misdemeanor carrying up to 6 months jail and/or a $750 fine. Reports go to the Wyoming Department of Family Services or local law enforcement.
No. Wyoming's WS Title 40 does not require AG notification at any statutory threshold — notification flows to affected residents. The Wyoming AG's Consumer Protection Unit investigates breaches it learns of through complaints, media, or HHS OCR filings, but there is no mandatory simultaneous AG-notification duty.
Neighboring State Compliance Guides
Stay audit-ready in Wyoming
GuardWell tracks Wyoming-specific breach deadlines, retention periods, Wyoming PMP PDMP queries, and mandatory reporting obligations automatically.