HIPAA and state law: when a state rule is stricter.
HIPAA sets a federal floor for privacy. State laws that conflict with it are generally preempted, but several exceptions favor stricter state rules. Employers with multi-state workforces should know how the two fit together.
How preemption works.
A Federal Floor
The Privacy Rule sets a floor of protections. A state law that is contrary to it is preempted unless an exception applies. Think of it as a minimum, not a ceiling. Some state rules add protections on top of it, and a plan sponsor operating in several states should ask counsel which ones apply to its own group.
What Contrary Means
A state law is contrary if a covered entity could not comply with both, or if the state law is an obstacle to the purposes of HIPAA’s administrative simplification rules. This is a legal test that depends on the specific provisions being compared. Ask counsel to analyze both laws side by side before concluding that one overrides the other for your plan.
The Stricter-Law Exception
A state law that relates to the privacy of health information and gives greater protection or greater individual rights is more stringent, and it prevails where it is contrary to the federal rule. State rules that give individuals more privacy protection or more control over their own records can apply alongside the federal rule. Counsel can identify which state laws touch your plan and how they interact.
How federal and state privacy law interact.
The General Rule
A federal health privacy standard preempts a contrary state law. This is the starting point, and the exceptions that follow are narrow. Employers should not assume a state rule is displaced without legal review, because the answer depends on the particular state provision. Counsel can explain how it applies to your plan.
More Stringent State Law
A state law that gives individually identifiable health information more protection than the federal privacy rule is not preempted. Examples often involve especially sensitive information, such as mental health or genetic data, but coverage varies by state. Ask counsel which state rules affect the records your plan or vendors handle.
Public Health Reporting
State laws that provide for reports of disease, injury, child abuse, birth or death, or public health surveillance are not preempted. These reporting duties can apply to providers and health plans in different ways. If you receive a state reporting request, route it to counsel or your privacy lead and keep a record of what was disclosed.
Health Plan Reporting
State laws that require health plans to report or give access to information for audits, program monitoring, or licensure are not preempted. Requests from state regulators are usually formal. Confirm who is allowed to receive plan information, send the request to counsel, and keep a log of what was provided and when.
Secretary Determinations
The Secretary can except a state provision needed to prevent fraud and abuse, regulate insurance and health plans, report on health care costs, or serve a compelling public health need. These are determinations made by the federal government, and they are not something an employer can claim on its own. If a question arises, ask counsel to confirm whether any determination applies to the state rule at issue.
What This Means For Plans
A plan follows the federal rule and any state law that is more protective, so it helps to confirm which state rules apply to your group. Your carriers and administrators will often follow their own state requirements, so ask them how they handle state-specific rules. Keep their responses with your HIPAA compliance file and revisit them when the state mix changes.
Source: 45 CFR 160.203.
What plan sponsors can do.
Comply With Both When Possible
Where a stricter state rule and HIPAA do not conflict, a covered entity follows both. In most cases the more protective standard becomes the practical rule, and staff should be trained on it. Write the combined process into your privacy procedures so employees follow one consistent method.
Watch Public Health And Reporting Laws
State laws on disease reporting, child abuse reporting and certain health plan reporting also fall within exceptions. These exceptions apply to specific types of reports, and not to every request that mentions health. Teach staff to send any outside request for plan information to the privacy lead or counsel before responding.
Ask Counsel For Multi-State Plans
Employers with employees in several states should have counsel confirm which state rules matter. Ask for a short written summary listing the states, the rules that might apply, and the actions needed. Review it at least once a year, and again when the workforce expands into a new state.
Three questions to settle.
Which States Have Employees
List them. Include remote employees and those who live in a different state from the office, since the rules can follow the employee’s location. Update the list each plan year and share it with counsel. Share the list with counsel and your carriers.
Do Any State Rules Add Privacy Rights
Ask counsel about stricter rules. Ask counsel for a short written answer for each state where you have employees, noting any extra rights, consent steps, or special categories of information. File the answer with your HIPAA records. Keep the written answer on file for reference.
Do Our Notices Reflect Them
Check the Notice of Privacy Practices. Compare the notice with your counsel’s state review and with how your plan actually handles requests. If a stricter state rule changes what you do, the notice and the staff procedures should be updated together. Update them together if the review changes anything.
Common Questions About HIPAA And State Law
Does HIPAA override all state privacy laws?
No. It preempts contrary state laws, but exceptions allow stricter state privacy laws and certain reporting laws to stand.
What if a state law gives patients faster access to records?
A state law giving a more timely right of access is the kind of provision that is more stringent than HIPAA.
Does a stricter state law have to be requested or approved?
Not for the stricter-law exception. It is built into the rules.
Does ERISA preemption change this?
ERISA preemption is a separate question and works differently for insured and self-funded plans.
Where is this in the rules?
At 45 CFR 160.202 and 160.203.
Is this legal advice?
No. For an actual issue, involve your counsel. We can help you organize your documentation.
Send us your renewal.
We’ll tell you whether it looks competitive, where we see opportunity, and the five questions we’d put to your carrier. No cost, and no obligation to move anything.
The renewal letter
Your current plan summary
Contribution split by tier
Enrolled counts by tier
Four documents — two more if your group is 50 or more. Nothing else; every extra one is a reason to postpone.
Laws and rules referenced
45 C.F.R. Part 164, Subpart E — HIPAA Privacy Rule.
This page is general information, not legal or tax advice. Rules change and facts matter, so confirm your situation with counsel or a qualified advisor.
An independent employee benefits consulting firm. We look at the entire benefits program: cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential: needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics: tell us which pages get read, so we know what is worth writing more of.
- Advertising: set by third parties such as ad and social platforms to measure and target campaigns.