Does Indiana's Privacy Law Apply to Healthcare Marketing?

Indiana's privacy law mostly does not apply to HIPAA-regulated healthcare. The Indiana Consumer Data Protection Act, in effect since January 1, 2026, exempts HIPAA covered entities, their business associates and 501(c)(3), 501(c)(6) and 501(c)(12) nonprofits, and it exempts protected health information. It can apply to health and wellness businesses outside HIPAA, such as consumer health apps, direct-to-consumer wellness and supplement brands, and med spas or cash-pay practices that are not covered entities, once they process personal data of 100,000 Indiana residents in a year, or 25,000 while earning over half their revenue from selling personal data. Agencies and vendors that process data for them work under a contract the law spells out. For advertisers that do fall under it, Curve Compliance sends conversions to ad platforms server-side, with consent management, a fixed list of fields per platform and a BAA on every plan.

Is this legal advice? No. This page summarizes the statute and the Indiana attorney general's guidance, with links to both. Talk to your counsel about how the law applies to your business.

For every state in one place, see the state health privacy laws reference table. Our guides to Montana, Tennessee and Texas answer the same question, and managing overlapping state laws covers multi-state setups.

The Indiana Consumer Data Protection Act at a glance

Question	Answer
Statute	Indiana Code 24-15
In effect	January 1, 2026
Who must comply	Businesses in Indiana, or targeting its residents, that in a calendar year process personal data of 100,000 or more Indiana consumers, or 25,000 or more while earning over 50% of gross revenue from selling personal data
Exempt in healthcare	HIPAA covered entities and business associates; protected health information
Nonprofits	501(c)(3), 501(c)(6) and 501(c)(12) organizations are exempt
Health data	Sensitive data if it reveals a diagnosis made by a health care provider; consent required
Targeted advertising	Opt-out right; no opt-out signal provision in the statute
Enforcement	Attorney general only; no private right of action
Penalty	Up to 7,500 dollars per violation
Cure period	30 days, with no end date in the text

Who is exempt

IC 24-15-1-1 says the law does not apply to "any covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services (45 CFR Parts 160 and 164) pursuant to HIPAA." IC 24-15-1-2 lists "protected health information under HIPAA" as exempt data, along with substance use disorder patient records under 42 U.S.C. 290dd-2 and research data. The attorney general's consumer bill of rights says these entity exemptions apply "even if they meet the threshold requirements."

The same section exempts "any nonprofit organization," which the law defines as an organization exempt from tax under Section 501(c)(3), 501(c)(6) or 501(c)(12) of the Internal Revenue Code. A 501(c)(4) organization is exempt only if it was set up to detect or prevent insurance crime or fraud and meets the statute's other conditions. None of this takes a covered entity outside HIPAA: HHS says covered entities "must comply with the Rules' requirements to protect the privacy and security of health information."

Which health and wellness businesses it can reach

The test is HIPAA status, not industry. HHS says a health care provider is a covered entity "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard." If a business is neither a covered entity nor a business associate, "it does not have to comply with the HIPAA Rules." Businesses outside HIPAA that meet Indiana's thresholds can include:

• Consumer health, fitness and cycle-tracking apps.
• Direct-to-consumer wellness, nutrition and supplement brands.
• Med spas, cash-pay clinics and subscription telehealth brands that are not covered entities.
• Marketing agencies, analytics companies and ad-tech vendors that process personal data for those brands. The law calls them processors. IC 24-15-5-1 says a processor "shall adhere to the instructions of a controller," and IC 24-15-5-2 sets what their contract must include.

The count is per calendar year and covers Indiana residents "acting only for a personal, family, or household purpose." At 100,000, Indiana's main threshold is four times Montana's 25,000, so it matters most to brands with a large Indiana audience. Personal data means information "linked or reasonably linkable to an identified or identifiable individual," excluding de-identified, aggregate and publicly available data.

Health data is sensitive data, and sensitive data needs consent

IC 24-15-2-28 defines sensitive data to include personal data revealing "a mental or physical health diagnosis made by a health care provider," genetic or biometric data used to identify a person, data from a known child, and precise geolocation, meaning location accurate "within a radius of one thousand seven hundred fifty (1,750) feet." IC 24-15-4-1 says a controller may not "process sensitive data concerning a consumer without obtaining the consumer's consent." Consent is "a clear affirmative act" that is "freely given, specific, informed, and unambiguous."

Indiana's health wording is narrower than Montana's. Montana covers any "mental or physical health condition or diagnosis"; Indiana adds "made by a health care provider." Where that line falls for a given event is a question for counsel. Precise location and biometric data need consent either way.

Indiana also defines a sale narrowly: "the exchange of personal data for monetary consideration by a controller to a third party." Disclosures to a processor working on your behalf are not a sale.

Targeted advertising: the opt-out and the disclosure

Under IC 24-15-3-1, consumers can opt out of processing for "targeted advertising," "the sale of personal data," and profiling with legal or similarly significant effects. Targeted advertising means ads selected from a consumer's activities "over time and across nonaffiliated websites or online applications." It excludes ads based on activity on your "own or affiliated" sites, ads based on the current search or page, and "the processing of personal data solely for measuring or reporting advertising performance, reach, or frequency."

If you sell personal data or use it for targeted advertising, IC 24-15-4-4 requires you to "clearly and conspicuously disclose such activity, as well as the manner in which a consumer may exercise the right to opt out." Indiana's statute has no provision on opt-out preference signals or browser settings, unlike Montana's and Texas's.

IC 24-15-6-1 requires a documented data protection impact assessment for targeted advertising, the sale of personal data, certain profiling and "the processing of sensitive data." It applies to processing activities created or generated after December 31, 2025.

Book a call. Curve's team will go through what your site sends to ad platforms today and set up server-side conversions with consent rules for each state. Book a call with Curve.

Enforcement, penalties and the cure period

The attorney general "has exclusive authority to enforce the provisions of this article" (IC 24-15-10-1). Under IC 24-15-10-2, the attorney general may seek an injunction and a civil penalty of up to 7,500 dollars for each violation, plus reasonable expenses, including attorney's fees.

Before suing, the attorney general must give "thirty (30) days written notice" identifying the alleged violations (IC 24-15-10-3). If the business cures them and gives a written statement that they are cured and will not recur, no action follows. The text sets no end date for that cure period. IC 24-15-10-4 rules out a private right of action.

Consumers who think a business broke the law can use the attorney general's online complaint form, which the consumer bill of rights names as the easiest route.

A working checklist for brands in scope

• Decide with counsel whether each business is a covered entity, a business associate, an exempt nonprofit or none of these.
• Count the Indiana residents whose personal data you process in a calendar year.
• List what your pixels, tags and SDKs send, and flag events tied to a diagnosis or precise location.
• Collect consent before processing sensitive data.
• Disclose targeted advertising and sale, and give a clear opt-out.
• Sign processor contracts with agencies and vendors, and document impact assessments.

Where Curve Compliance fits

For brands in scope in Indiana, Curve Compliance replaces browser ad pixels with one script and sends conversions from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives a fixed list of fields, and anything else is stripped. Page titles, free text and form answers are never sent, and contact identifiers are off by default and SHA-256 hashed when enabled.

Curve's consent management gives every US state its own opt-in or opt-out rule, records each decision in an audit log, and holds back tracking and ad forwarding for visitors who have not allowed it. Global Privacy Control is honored in every region as a decline of advertising. Curve also flags PHI-like patterns, such as condition names in URLs, before data reaches an ad platform. See what to configure in a consent banner, run the free compliance scanner to see which trackers your site loads, or read about conversion tracking.

Book a call. Curve signs a BAA on every plan, so the same setup serves covered entities and the brands these laws reach. Curve's team does the setup, typically live in about a week. Book a call with Curve.

Frequently Asked Questions

When did the Indiana Consumer Data Protection Act take effect?

January 1, 2026, according to the Indiana attorney general's consumer bill of rights.

Does Indiana's privacy law apply to hospitals and clinics?

Not if they are HIPAA covered entities or business associates. IC 24-15-1-1 exempts them, and IC 24-15-1-2 exempts protected health information. HIPAA still applies to them.

Does the Indiana Consumer Data Protection Act apply to nonprofits?

Not to organizations exempt from tax under Section 501(c)(3), 501(c)(6) or 501(c)(12). Other nonprofits are exempt only in the narrow cases the statute lists.

Is health data sensitive data under Indiana law?

Personal data revealing "a mental or physical health diagnosis made by a health care provider" is sensitive data, and processing it requires the consumer's consent.

Does Indiana have a cure period?

Yes. The attorney general must give 30 days' written notice before suing, and a business that cures the violation and provides a written statement avoids the action.

Can consumers sue under Indiana's privacy law?

No. IC 24-15-10-4 says the law does not provide a basis for a private right of action. Only the attorney general enforces it.