The Preemption Question Every Healthcare Compliance Manager Eventually Faces
If you operate in the healthcare space—whether as a covered entity, business associate, or a defense contractor supporting a federal health program—you have almost certainly encountered the moment where HIPAA and a state privacy law appear to point in different directions. The question is not academic. Getting it wrong exposes your organization to regulatory enforcement from two directions simultaneously.
The short answer is: HIPAA generally preempts state law, but with significant and operationally important exceptions. Understanding those exceptions is where most compliance programs fall short.
At Cleared Systems, we work with healthcare organizations navigating exactly this intersection. This article provides a practical framework for compliance managers and executives who need to know how to prioritize competing legal obligations.
How Federal Preemption Works Under HIPAA
The Health Insurance Portability and Accountability Act establishes a national floor for the protection of protected health information (PHI). Under the HIPAA Privacy Rule, federal law preempts any state law that is contrary to HIPAA's requirements—meaning a state law that makes it impossible to comply with both HIPAA and the state rule simultaneously will yield to HIPAA.
However, the statute carves out three categories of state laws that survive preemption:
- More stringent state laws: If a state law affords greater privacy protections to patients than HIPAA does, the state law controls. Federal preemption does not eliminate stronger state protections—it eliminates weaker ones.
- Public health exceptions: State laws designed to support state public health reporting requirements are generally preserved, even where they differ from HIPAA's approach.
- State laws relating to the regulation of health plans: Certain insurance regulation statutes are explicitly shielded from HIPAA preemption.
This means that HIPAA Privacy Rule compliance is not a ceiling—it is a floor. Any state that has enacted stricter protections for patient health data requires covered entities operating in that state to comply with the more restrictive rule.
Defining "More Stringent": The Standard That Creates Confusion
The term "more stringent" is defined under 45 CFR § 160.202 with reasonable specificity, but applying it in practice requires analysis. A state law is considered more stringent than HIPAA when it:
- Prohibits or restricts a use or disclosure that HIPAA permits
- Grants an individual greater rights of access to or amendment of PHI
- Requires a covered entity to retain records longer
- Provides greater notice to individuals about the use of their information
- Narrows the scope of information that may be used or disclosed without authorization
The compliance challenge is that this determination must be made individually for each relevant state law and each type of PHI use at issue. A state that is more restrictive in one context may be less restrictive in another—and each context requires its own analysis.
Organizations with operations in multiple states cannot assume that a single policy covers all jurisdictions. A multi-state covered entity needs a policy framework that identifies which state laws apply in which contexts and how those laws interact with HIPAA's baseline requirements. This is precisely the kind of work our Compliance Program Development service is designed to address.
State Laws That Routinely Create Compliance Tension
Several categories of state law consistently generate preemption questions for compliance managers:
Mental Health and Substance Use Records
Virtually every state has enacted heightened protections for mental health records and substance use disorder treatment records, which also intersect with federal regulations at 42 CFR Part 2. Most state mental health privacy statutes are more stringent than HIPAA in ways that directly restrict disclosures HIPAA would otherwise permit. These state laws survive preemption and must be applied alongside HIPAA requirements.
Minors' Health Information
HIPAA generally defers to state law on the question of whether a minor or a parent controls access to the minor's PHI. States vary dramatically on this question—particularly for services like reproductive healthcare, STI treatment, and mental health services where minors may have independent consent rights. Where state law grants the minor the right to consent to treatment, that same state law typically controls access rights under HIPAA, overriding a parent's access that HIPAA might otherwise permit.
Reproductive Health Data
Following the Dobbs decision, a number of states enacted laws both restricting and expanding privacy protections around reproductive health information. Some states explicitly prohibit disclosures of abortion-related PHI even where HIPAA might permit them. Other states have moved in the opposite direction, requiring disclosure in circumstances HIPAA would not compel. Federal regulatory guidance has attempted to address some of these conflicts, but this remains one of the most actively evolving areas of healthcare privacy law.
HIV/AIDS Status
Most states impose specific restrictions on the disclosure of HIV status that are more stringent than HIPAA's general PHI rules. These state laws typically require specific written authorization, impose criminal penalties for unauthorized disclosure, and restrict the circumstances under which even otherwise permitted disclosures may occur.
Genetic Information
HIPAA covers genetic information as PHI when held by covered entities. A growing number of states have enacted standalone genetic privacy statutes that impose additional consent, use, and disclosure restrictions. Given the increasing use of genetic data in both treatment and research contexts, this is an area requiring close state-by-state legal analysis.
The California Example: When State Consumer Privacy Law Meets Healthcare
California's privacy framework—the California Consumer Privacy Act as amended by the California Privacy Rights Act—has prompted significant questions about its interaction with HIPAA. The CPRA contains an explicit exemption for PHI governed by HIPAA, so a covered entity's HIPAA-regulated data is generally not subject to CPRA's consumer rights provisions.
However, the exemption is narrower than it first appears. Non-HIPAA data held by healthcare organizations—employee health information, de-identified data that doesn't meet HIPAA's de-identification standard, and data held by entities that are not covered entities under HIPAA—may all be subject to CPRA requirements. Healthcare organizations operating in California should not assume that HIPAA compliance automatically resolves their California obligations. Our blog post on how the California Privacy Rights Act affects businesses and consumers provides additional context on this framework.
Similar analysis applies in states including Texas, Virginia, Colorado, Connecticut, and others that have enacted comprehensive consumer privacy laws with partial or conditional exemptions for HIPAA-covered data.
What This Means for Compliance Program Design
The practical implication for compliance managers is that HIPAA Privacy Rule compliance is a necessary but not sufficient condition for a complete healthcare privacy program. A compliant program requires:
- Jurisdiction mapping: Identifying every state in which the organization holds PHI or provides services, and cataloging applicable state privacy laws for each category of sensitive health information.
- Preemption analysis: For each identified state law, determining whether it is more stringent than HIPAA's requirements and in what specific contexts.
- Policy layering: Building policies that satisfy HIPAA's baseline while incorporating any more stringent state requirements as applicable addendums or conditional protocols.
- Staff training calibrated to jurisdiction: Ensuring that frontline staff handling PHI understand when state-specific rules apply, not just federal defaults.
- Ongoing monitoring: State privacy laws are changing rapidly. A preemption analysis that is accurate today may be incomplete in twelve months.
Organizations that lack the internal security leadership to manage this complexity on an ongoing basis frequently benefit from a Regulatory vCISO engagement, which provides the senior-level oversight needed to keep multi-framework compliance programs current without the cost of a full-time CISO.
For organizations looking to build foundational knowledge, our HIPAA Privacy & Security Compliance for Healthcare Administrators resource provides structured guidance on both the Privacy Rule requirements and their interaction with broader compliance obligations. For organizations that want a ready-to-deploy documentation baseline, our HIPAA Compliance Documentation Toolkit offers an immediate starting point.
A Note for Defense Contractors Supporting Federal Health Programs
Organizations in the defense industrial base that support military health programs, VA contracts, or federal health IT initiatives face an additional layer of complexity. These organizations may simultaneously be subject to HIPAA as business associates, to CMMC and DFARS requirements as defense contractors, and to state privacy laws based on where their personnel and systems are located. The frameworks do not always align cleanly, and assumptions imported from one regulatory context can create exposure in another.
If your organization handles both controlled unclassified information and protected health information, the compliance architecture needs to address both simultaneously. Our work with federal and defense clients increasingly involves precisely this kind of multi-framework analysis.
The Bottom Line on Preemption
Federal preemption under HIPAA operates as a floor, not a ceiling. HIPAA displaces state law only when state law is less protective—when it would permit something HIPAA prohibits or require something HIPAA forbids. Where state law is more stringent, it survives and must be followed. Where state law addresses subjects HIPAA does not govern, it applies without any preemption question.
Compliance managers who treat HIPAA as the complete answer to healthcare privacy obligations are carrying more legal risk than they recognize. The organizations that manage this well are those that invest in systematic preemption analysis, build it into policy infrastructure, and treat state law monitoring as a recurring compliance function rather than a one-time exercise.
Ready to Strengthen Your Healthcare Privacy Compliance Program?
Cleared Systems works with healthcare organizations, federal contractors, and regulated industries to build compliance programs that address both federal and state-level obligations. Whether you need a comprehensive risk assessment to identify your current exposure or a full compliance program build, our team brings the technical and regulatory depth to get it right. Request a quote today and let us help you build a privacy compliance program that holds up under scrutiny—from any direction.