HIPAA as a Floor, Not a Ceiling
HIPAA establishes a federal floor of privacy protection, but state laws that are more stringent than HIPAA remain in effect. HIM professionals must understand how to conduct a preemption analysis to determine which law applies in a given situation.
Preemption Analysis
Preemption analysis compares HIPAA's requirements to the applicable state law provision on the same topic. Where state law provides greater privacy protection or grants patients more rights, the state law generally controls, while HIPAA controls where it is more protective or where no comparable state law exists.
The More Stringent Standard
A state law is considered more stringent if it provides individuals greater rights of access to their records, imposes stricter conditions on disclosure, or requires a higher standard of authorization than HIPAA requires.
State-Specific Requirements
States vary significantly in areas such as minimum retention periods, patient access timelines, and requirements for reporting data breaches, meaning a multi-state health system must track and comply with each applicable state's requirements.
Mental Health and Substance Abuse Records
Many states impose heightened confidentiality protections for mental health records beyond HIPAA. Substance use disorder treatment records are further protected under federal law 42 CFR Part 2, which generally requires specific patient consent for redisclosure, even to other treating providers.
Minor Consent Laws
State laws governing minor consent for services such as reproductive health, mental health, and substance abuse treatment vary widely and directly affect whether a parent has a right to access a minor's related health records.
Exam Tip
Remember that 42 CFR Part 2 imposes stricter redisclosure rules than HIPAA for substance use disorder treatment records.