When Does State Privacy Law Supersede HIPAA? How the More Stringent Rule Works

Last reviewed: October 12, 2026. This article is general information, not legal advice. Health privacy laws differ a lot by state, so check your state's statute, and ask a health care privacy lawyer if you need a preemption analysis.

HIPAA is the federal law most people think of when it comes to medical privacy, but it isn't the only one. Every state has its own health privacy rules too, and some are much stricter. So when does state privacy law supersede HIPAA? The answer comes from a short, precise federal regulation, and once you know it, the rest falls into place.

Short answer: HIPAA overrides a state law only when the two are contrary, meaning you can't follow both. Even then, the state law wins if it relates to health privacy and is more stringent, giving patients more protection. State laws on reporting disease, child abuse, births and deaths, and public health also survive. When a state law simply adds protections that can be followed alongside HIPAA, both apply.

HIPAA is a floor, not a ceiling

The US Department of Health and Human Services (HHS) describes the HIPAA Privacy Rule as providing "a Federal floor of privacy protections" for health information held by covered entities and their business associates. Under 45 CFR 160.103, covered entities are health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with certain standard transactions.

A floor means states can build higher. They can't build lower: a state law that would allow what HIPAA forbids is generally preempted.

Step 1: Is the state law "contrary"?

Preemption only comes into play if the state law is contrary to HIPAA. HHS explains that "contrary" means it would be impossible for a covered entity to comply with both the state and federal requirements, or that the state law is an obstacle to accomplishing the purposes of HIPAA's Administrative Simplification provisions.

If a provider can follow both laws at once, there's no conflict, and both laws apply. In practice, that's how most stricter state laws work: the provider simply follows the tighter rule.

Step 2: Does an exception save the state law?

If the laws do conflict, 45 CFR 160.203 lists situations where the state law still survives:

• More stringent privacy laws (paragraph (b)), explained below.
• Public health reporting. State laws providing for the reporting of disease or injury, child abuse, birth or death, or for public health surveillance, investigation or intervention (paragraph (c)).
• Health plan reporting. State laws requiring health plans to report or give access to information for audits, program monitoring, or licensing and certification (paragraph (d)).
• HHS exception determinations. On request, HHS can decide that a contrary state law should not be preempted, for example because it is necessary to prevent health care fraud or to regulate controlled substances (paragraph (a)).

What "more stringent" means

The definition in 45 CFR 160.202 is detailed. In summary, a state law is more stringent if, compared with HIPAA, it:

1. prohibits or restricts a use or disclosure that HIPAA would permit (except disclosures required by HHS for compliance checks, or disclosures to the patient themselves);
2. gives patients greater rights to access or amend their own records;
3. gives patients more information about uses, disclosures, rights and remedies;
4. narrows or strengthens the rules for patient permission to disclose;
5. requires more detailed or longer record keeping or accounting of disclosures; or
6. on any other matter, provides greater privacy protection.

Notice the limit in point 1: a state law can't use "privacy" as a reason to stop patients from getting their own records.

State law examples

These examples show the main ways states go further than HIPAA. Always read the current text of your own state's statute.

General consent rules: Minnesota

HIPAA lets covered entities use and disclose health information for treatment, payment and health care operations without a patient's authorization (45 CFR 164.506). The Minnesota Health Records Act is tighter. Minn. Stat. 144.293 says a provider may not release a patient's health records without a signed and dated consent from the patient, specific authorization in Minnesota law, or a representation from a provider holding such a consent, subject to listed exceptions such as medical emergencies and current treatment within related health care entities.

HIV test results: Virginia

Virginia Code 32.1-36.1 makes the results of every HIV test confidential and allows release only to people or entities permitted or authorized to obtain protected health information under applicable law. It also adds its own remedies: a civil penalty of up to $5,000 per willful or grossly negligent violation, and the right for the person affected to sue for actual damages or $100, whichever is greater, plus possible attorney's fees.

Mental health records: Washington

Washington's RCW 70.02.230 provides that the fact of admission for mental health services, and the records of those services, may not be disclosed except as that section and other listed statutes allow, or with a valid authorization. The statute then lists the specific circumstances in which disclosure is permitted.

Reproductive and other consumer health data: Washington

Some of the strongest new state laws cover data HIPAA doesn't reach at all. Washington's My Health My Data Act (RCW chapter 19.373) covers "consumer health data", including information about reproductive or sexual health services. It expressly does not apply to protected health information under HIPAA, so it fills the gap around apps, websites and other businesses that aren't covered entities. Violations are treated as unfair or deceptive practices under Washington's Consumer Protection Act.

The 2024 reproductive health rule and Purl v. HHS

In April 2024, HHS issued the HIPAA Privacy Rule to Support Reproductive Health Care Privacy, which prohibited disclosing protected health information related to lawful reproductive health care in certain circumstances.

According to HHS, on June 18, 2025, the US District Court for the Northern District of Texas, in Carmen Purl, et al. v. U.S. Department of Health and Human Services, et al., No. 2:24-cv-00228-Z, declared unlawful and vacated most of that rule. HHS says the court vacated only certain provisions of the Notice of Privacy Practices changes, that the remaining changes to those requirements stayed in effect, and that compliance with them was required by February 16, 2026.

The vacatur affects the federal rule only. State laws that protect reproductive health information still apply on their own terms, subject to the preemption rules above. If you're following this area, see also our guide on state abortion time limits.

Other federal rules to know

• Substance use disorder records. Many substance use disorder treatment records are covered by a separate federal rule, 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records), which has its own consent rules.
• Personal devices. HHS guidance explains that in most cases HIPAA does not protect health information you access or store on your personal cell phone or tablet.

What this means for you

If you're a patient:

• Ask your provider or health plan for its Notice of Privacy Practices, which explains how it uses and shares your information.
• If you're worried about a sensitive record (mental health, HIV, reproductive care), look up your state's specific statute, which may give you more control than HIPAA alone.
• Remember that health apps and wearables often fall outside HIPAA, so read their privacy policies.

If you're a provider or business:

• Map which state laws apply to the records you hold, especially if you treat patients from several states.
• Where a state rule is stricter and can be followed alongside HIPAA, follow it.
• For a genuine conflict, get a written preemption analysis from a health care privacy lawyer.

For related reading, see what "redacted" means in law, which covers how sensitive details are removed from documents.

Sources

• 45 CFR 160.203, General rule and exceptions: Cornell LII
• 45 CFR 160.202, Definitions (including "contrary" and "more stringent"): Cornell LII
• 45 CFR 160.103, Definitions (including "covered entity"): Cornell LII
• 45 CFR 164.506, Uses and disclosures for treatment, payment and health care operations: Cornell LII
• HHS, Does the HIPAA Privacy Rule preempt State laws?: hhs.gov
• HHS, HIPAA and Reproductive Health (including the Purl v. HHS vacatur notice): hhs.gov
• Minnesota Statutes 144.293: revisor.mn.gov
• Code of Virginia 32.1-36.1: law.lis.virginia.gov
• Revised Code of Washington 70.02.230: app.leg.wa.gov
• Revised Code of Washington chapter 19.373 (My Health My Data Act): app.leg.wa.gov
• 42 CFR Part 2, Confidentiality of Substance Use Disorder Patient Records: Cornell LII