Federal HIPAA Mandates vs. Privacy Laws by State

HIPAA sets the minimum for health privacy, and state laws can go further. A state law that conflicts with HIPAA gives way, unless it protects patient privacy more or gives patients more rights. Then you must follow both. Many states also set shorter breach deadlines and cover health data that HIPAA does not reach.

State Privacy Laws vs Federal HIPAA Requirements

Navigating state privacy laws alongside federal HIPAA rules is one of the most complex challenges facing healthcare organizations that operate across multiple states. While HIPAA establishes a national baseline for protecting health information, it does not occupy the field entirely. States retain broad authority to enact their own privacy protections.

Many have done so with rules that exceed HIPAA in major ways.

For compliance officers, attorneys, and healthcare administrators, the interaction between state and federal privacy law demands careful analysis. Applying the wrong standard in the wrong jurisdiction can expose an organization to regulatory action, civil liability, and reputational harm. This guide examines how the federal preemption doctrine works, highlights key state laws that affect healthcare organizations, and offers practical strategies for building a multi-state regulatory compliance program.

The Federal Preemption Doctrine

How HIPAA Preemption Works

HIPAA includes a preemption provision (a rule about which law wins when the two conflict) that governs its relationship with state law. Under 45 CFR 160.203, HIPAA preempts state laws that are contrary to the federal rules (meaning an organization could not follow both, or the state law blocks HIPAA's goals). However, this preemption is not absolute. A state law is not preempted if it is more stringent than the corresponding HIPAA rule in protecting patient privacy or providing patients with greater rights regarding their health information.

This “floor, not ceiling” approach means that HIPAA sets the minimum standard for privacy protection. States are free to impose rules that go further than HIPAA.

When they do, healthcare organizations must comply with both the federal and the more restrictive state standard.

The “More Stringent” Standard

Determining whether a state law is “more stringent” requires analyzing the specific requirement at issue. Under 45 CFR 160.202, a state privacy law is more stringent than the HIPAA Privacy Rule if it meets any of the following criteria:

• Prohibits or restricts a use or disclosure (sharing) that HIPAA would permit.
• Gives patients greater rights of access to their own health information.
• Gives patients greater rights to amend (correct) their records.
• Gives patients more information about how their information is used and shared, and about their rights and remedies.
• Tightens the rules for patient permission to use or share their information, for example by narrowing its scope or how long it lasts.
• Requires more detailed record-keeping, or keeping records longer, including for accountings of disclosures (lists of when information was shared).
• Gives greater privacy protection on any other matter.

When a state law is determined to be more stringent, organizations must follow the state law in that jurisdiction while still meeting all other HIPAA rules. This creates a layered compliance obligation that can vary greatly from state to state.

Preemption in Practice: Real Examples

The following examples show how the floor-not-ceiling rule plays out for covered entities operating in specific states:

• Medical records turnaround: HIPAA gives patients 30 days to receive their records (with one 30-day extension). California law requires copies within 15 days of the request. A California provider must meet the 15-day standard.
• Breach notice windows: HIPAA allows 60 days from discovery. Colorado and Florida require notice within 30 days. Multi-state organizations must meet the shorter deadline for affected patients in those states.
• Vendor coverage: HIPAA reaches business associates through signed agreements. Texas HB 300 extends HIPAA-equivalent obligations directly to vendors and contractors regardless of whether a BAA is in place.
• Consumer health apps: A period-tracking app or wellness platform that is not a covered entity is not subject to HIPAA. It may, however, be subject to California CPRA, Washington's My Health My Data Act, or Nevada SB370. All of these cover consumer health data outside the HIPAA ecosystem.

Exceptions to Preemption

Several categories of state law are explicitly exempt from HIPAA preemption, regardless of whether they are more or less stringent:

• State laws for reporting disease, injury, child abuse, birth, or death.
• Public health surveillance, investigation, or intervention laws.
• Laws requiring health plans to report or give access to information for management audits, financial audits, program monitoring and evaluation, or the licensing and certification of facilities or individuals.
• State laws the HHS Secretary approves for set purposes, such as preventing health care fraud and abuse, or laws mainly about controlling controlled substances.

These exceptions ensure that key state public health and regulatory functions continue to operate without interference from the federal privacy framework.

Key State Privacy Laws Affecting Healthcare

California: CCPA, CPRA, and CMIA

California has the most extensive state privacy framework in the nation. Healthcare organizations operating in California must navigate multiple overlapping laws:

The Confidentiality of Medical Information Act (CMIA) predates HIPAA and imposes extra restrictions on the use and sharing of medical information. CMIA applies to healthcare providers, health insurers, and their contractors, with several provisions that exceed HIPAA:

• Written authorization rules (rules for the signed permission a patient gives to share records) that are more detailed than HIPAA’s authorization standard.
• Restrictions on marketing uses of health information that go beyond HIPAA’s marketing provision.
• Private right of action allowing patients to sue for unauthorized disclosures, with $1,000 in damages without proof of harm, plus any actual damages.
• Criminal penalties in some cases of unauthorized sharing.

The California Consumer Privacy Act (CCPA) and its successor, the California Privacy Rights Act (CPRA), usually exempt health information covered by HIPAA. However, the exemption applies only to information that is actually protected by HIPAA. Consumer health data collected outside the HIPAA framework, such as health information gathered by wellness apps or direct-to-consumer health services, may fall under CCPA/CPRA protections instead.

New York: SHIELD Act

The New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act greatly expanded New York’s data breach notice rules and imposed affirmative data security duties on businesses that hold private information of New York residents.

Key SHIELD Act provisions relevant to healthcare organizations include:

• Expanded definition of private information that includes biometric data and username/email combined with a password.
• Broader breach notice triggers including unauthorized access to data, not just acquisition (someone taking a copy).
• Mandatory security program rules including administrative, technical, and physical safeguards.
• Penalties of up to $5,000 per violation for failing to meet the security rules. For breach notice failures, the penalty is the greater of $5,000 or up to $20 per failed notice, with the per-notice total capped at $250,000.

The SHIELD Act’s security rules parallel HIPAA’s Security Rule in many respects but apply to a broader range of data types. A business that complies with HIPAA is treated as compliant with the SHIELD Act’s security rules.

Texas: HB 300 and the Texas Medical Records Privacy Act

Texas passed House Bill 300 in 2011 (it took effect in 2012), creating one of the strictest state health privacy laws in the country. Key provisions include:

• Expanded definition of covered entities that goes beyond HIPAA’s categories to include any person who assembles, collects, or obtains PHI.
• Training rules mandating that employees with access to PHI complete privacy training within 90 days of hire, and again within a year after a change in the law that affects their duties.
• Enhanced penalties of up to $5,000 per violation for negligence, up to $25,000 for knowing or intentional violations, and up to $250,000 when PHI is knowingly used for financial gain.
• Consumer health privacy protections that apply to organizations not covered by HIPAA, filling gaps in federal protection.
• Restrictions on digital sharing with specific rules for transmitting health information electronically.
• State AG enforcement with explicit authority for the Texas Attorney General to investigate breaches and pursue penalties.

Texas HB 300 is especially important because it extends privacy duties to organizations that fall outside HIPAA’s covered entity and business associate framework (covered entities are providers, health plans, and clearinghouses; business associates are vendors that handle PHI for them), creating a broader protective net for patient health information.

Massachusetts: 201 CMR 17.00

Massachusetts 201 CMR 17.00 establishes comprehensive data protection rules for any organization that owns or licenses personal information of Massachusetts residents. While not specific to healthcare, the regulation imposes requirements that affect healthcare organizations operating in the state:

• Written Information Security Program (WISP) requirement with specific mandated elements.
• Encryption rules for personal information transmitted wirelessly or stored on portable devices.
• Access control rules including unique user IDs, secure authentication, and restrictions on access to records.
• Monitoring rules for unauthorized access or use of personal information.
• Vendor management duties including contractual requirements for third-party service providers.

Massachusetts 201 CMR 17.00 is notable for its prescriptive technical rules, which in some areas exceed the flexibility that HIPAA’s Security Rule provides through its “addressable” implementation specifications. An addressable item must be put in place if it is reasonable and appropriate; if not, you document why and use an equal alternative where reasonable.

Illinois: Biometric Information Privacy Act (BIPA)

Illinois' Biometric Information Privacy Act (BIPA) is one of the strictest biometric data laws in the country.

BIPA applies to any private entity that collects, captures, purchases, or otherwise obtains biometric identifiers, including retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry. Healthcare organizations are only partly exempt. BIPA leaves out information captured from a patient in a health care setting, and information collected, used, or stored for treatment, payment, or operations under HIPAA. Staff biometrics, such as fingerprint time clocks, can still fall under BIPA.

Key BIPA requirements that go beyond HIPAA:

• Written informed consent is required before collecting biometric data. HIPAA has no equivalent requirement for biometric identifiers.
• Written retention and destruction policy must be made available to the public.
• No sale or profit from biometric data: organizations cannot sell, lease, trade, or profit from biometric identifiers.
• Private right of action with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation. Plaintiffs do not need to show actual harm.

Healthcare organizations in Illinois that use biometrics outside the health care exclusion, such as staff time clocks, must comply with BIPA on top of their HIPAA obligations. See our Illinois HIPAA compliance guide for state-specific requirements.

Washington: My Health My Data Act (2023)

Washington's My Health My Data Act (MHMD), effective March 2024 for large businesses and June 2024 for small businesses, is the first U.S. state law specifically targeting consumer health data outside the HIPAA ecosystem. It is among the most significant state health privacy developments since HIPAA itself.

Key provisions:

• Scope beyond HIPAA: MHMD covers any entity that conducts business in Washington or targets Washington consumers, regardless of HIPAA covered entity status. Apps, wellness platforms, and data brokers that handle health data fall under MHMD even if they are not subject to HIPAA.
• Consent required for collection and sharing: Organizations must obtain consumer consent before collecting or sharing consumer health data, a requirement with no direct HIPAA equivalent for non-covered entities.
• Right to deletion: Consumers can demand deletion of their health data and require that the organization direct third parties to delete it as well.
• Geofencing prohibition: MHMD prohibits geofencing around healthcare facilities for the purpose of identifying, tracking, or targeting individuals seeking healthcare services.
• Private right of action through the Washington Consumer Protection Act, with potential for class actions.

Nevada: SB370 Health Data Protections (2023)

Nevada Senate Bill 370 (passed in 2023) added health data protections to Nevada's existing privacy framework. Like Washington's MHMD, SB370 is designed to reach consumer health data outside the HIPAA ecosystem.

Key requirements:

• Consumer consent rules for collecting, sharing, and selling health data.
• Applies to non-HIPAA entities including apps, wellness services, and data brokers operating in Nevada or targeting Nevada residents.
• Enforcement by the Nevada Attorney General, with no private right of action under SB370 itself.

Connecticut: CTDPA Sensitive Health Data Provisions (2023)

Connecticut's Data Privacy Act (CTDPA), effective July 2023, classifies health data as sensitive data and imposes opt-in consent requirements for its processing. When it took effect, CTDPA covered businesses that processed personal data of 100,000 or more Connecticut residents in a year. It also covered those that processed data of 25,000 or more residents and earned more than 25% of revenue from selling personal data. Connecticut has since changed these limits, so check the current law.

Relevant provisions for healthcare-adjacent organizations:

• Opt-in consent required before processing sensitive health data. This is stricter than HIPAA, which lets providers use and share PHI for treatment, payment, and health care operations without the patient's permission.
• Right to opt out of the sale of personal data and targeted advertising.
• Data minimization requirements: only collect data adequate, relevant, and necessary for the stated purpose.
• Exemption for HIPAA-covered data: data actually protected under HIPAA is exempt, but consumer health data outside the HIPAA framework is not.

Florida: Breach Notification and the Digital Bill of Rights

Florida combines HIPAA-overlapping breach notice rules with a 2023 digital privacy law that affects healthcare-adjacent technology companies. Florida's breach notice law requires notice within 30 days of breach determination (half of HIPAA's 60-day window) and mandates notice to the Florida Attorney General for breaches affecting 500 or more individuals.

Florida's Digital Bill of Rights (SB 262, effective July 1, 2024) applies to large data controllers. It gives consumers rights over personal data processed outside the HIPAA framework, including sensitive data such as health information. See our Florida HIPAA compliance guide for complete state requirements.

State Privacy Laws vs. HIPAA: Quick Reference Table

The following table summarizes key divergences between HIPAA and major state health privacy laws. This is a reference summary, not legal advice. Consult healthcare compliance counsel for jurisdiction-specific guidance.

Key takeaway: If your organization operates in California, Texas, Washington, or New York, you almost certainly face requirements that go beyond HIPAA alone. If you handle consumer health data through apps, wellness services, or non-clinical platforms, Washington, Nevada, and Connecticut laws may apply regardless of your HIPAA status.

Breach Notification Variations by State

The Patchwork of State Requirements

Every U.S. state, plus Washington D.C. and several U.S. territories, has enacted its own breach notice law, creating a complex patchwork that healthcare organizations must navigate when a data breach occurs. While the HIPAA Breach Notification Rule provides a federal baseline, state laws often impose extra or different rules.

Key areas where state breach notice laws vary:

• Definition of personal information that triggers notice duties.
• Definition of breach including whether unauthorized access alone is enough or whether acquisition (taking a copy) is required.
• Notice timeframes ranging from “most expedient time possible” to specific day counts (such as 30, 45, or 60 days).
• Notice recipients including affected individuals, state regulators, consumer reporting agencies, and in some states the state Attorney General.
• Content rules for notice letters, with some states mandating specific information elements.
• Substitute notice methods available when direct notice is impractical.
• Safe harbor provisions (exceptions) for encrypted data, with variations in what qualifies as enough encryption.

States with Notably Stringent Requirements

Several states stand out for breach notice rules that greatly exceed the federal HIPAA standard:

• Colorado requires notice within 30 days of breach discovery, considerably shorter than HIPAA’s 60-day window.
• Florida requires notice within 30 days and mandates notice to the state Attorney General for breaches affecting 500 or more people.
• New York requires notice within 30 days of discovery, and notice to the Attorney General, Department of State, Division of State Police, and Department of Financial Services whenever New York residents are notified.
• Oregon requires notice within 45 days and mandates notice to the Attorney General when a breach affects more than 250 consumers.

Healthcare organizations must track the breach notice rules for every state in which they have patients or hold personal information. A breach affecting patients in multiple states can trigger dozens of different notice duties simultaneously.

Reproductive Health Privacy: The Post-Dobbs Compliance Landscape (2025 to 2026)

No area of health privacy law has moved faster than reproductive health data since the Supreme Court's 2022 Dobbs decision. Since then, a federal rule has come and gone, and new state laws have created a fast-changing compliance landscape for covered entities and non-HIPAA health data holders alike.

The HHS Reproductive Health Privacy Rule (Struck Down in 2025)

HHS issued a final rule in 2024. It barred covered entities and business associates from using or sharing protected health information related to lawful reproductive health care to investigate or impose liability on someone for seeking, obtaining, providing, or facilitating that care.

On June 18, 2025, a federal court in Texas vacated (struck down) that rule nationwide in Purl v. HHS. The online federal code (eCFR) still prints the vacated text, but it is not enforceable.

What this means now:

• The ban on sharing reproductive health PHI for investigations is no longer in force under HIPAA.
• The attestation requirement (a signed statement from a requester that the PHI will not be used for a banned purpose, 45 CFR 164.509) is no longer in force.
• The reproductive health items the rule added to the Notice of Privacy Practices are not required.
• One part survived: Notice of Privacy Practices updates tied to 42 CFR Part 2 (the federal rules for substance use disorder treatment records). A covered entity that creates or keeps Part 2 records had to update its notice by February 16, 2026. Practices without Part 2 records are not affected.
• State laws still apply. The state protections below are separate from the federal rule.

State-Level Reproductive Health Data Protections

Several states have their own reproductive health data protections, often reaching non-HIPAA entities:

• California: The CMIA and other California laws limit sharing reproductive health information, including in response to out-of-state requests.
• Washington: The My Health My Data Act explicitly includes reproductive health data in its definition of "consumer health data" and extends protections to apps, period trackers, and wellness platforms, entities not covered by HIPAA at all.
• Colorado: Colorado law and executive orders limit state agencies from helping out-of-state investigations into reproductive health care that is legal in Colorado.
• Illinois: Illinois law protects patient information about reproductive health care sought or obtained in Illinois.

Practical steps for covered entities in 2026:

1. If you hold substance use disorder records covered by 42 CFR Part 2, confirm your Notice of Privacy Practices was updated by February 16, 2026. The reproductive health items from the vacated 2024 rule are not required.
2. Before sharing reproductive health information with law enforcement or an out-of-state requester, check the laws of each state where you operate.
3. Train workforce members who handle records requests on the state rules that apply to you.
4. If you operate a consumer-facing health app or wellness platform in Washington, Nevada, or California, assess whether the My Health My Data Act, SB370, or CPRA applies to your reproductive health data independently of HIPAA.

Multi-State Compliance Strategies

Building a Unified Compliance Framework

Organizations operating in multiple states need a systematic approach to managing overlapping and potentially conflicting privacy rules. The most effective strategy is to build a compliance framework that meets the most stringent relevant standard across all states.

Step 1: Identify all relevant states. Map every state in which your organization provides services, stores data, has employees, or has patients. Each jurisdiction may impose its own privacy and breach notice rules.

Step 2: Conduct a comparative analysis. For each major compliance area (consent, access rights, breach notice, data security, patient rights), compare the HIPAA rule with the relevant state rules in each jurisdiction. Identify where state law is more stringent.

Step 3: Adopt the highest standard. Where practical, implement policies and procedures that meet the most stringent rule across all relevant states. This approach simplifies compliance by reducing the need for jurisdiction-specific variations.

Step 4: Keep jurisdiction-specific procedures. For rules that are truly jurisdiction-specific and cannot be generalized (such as specific breach notice recipients or state-mandated forms), keep written procedures that address each state’s unique rules.

Step 5: Monitor legislative changes. State privacy laws are evolving rapidly. Assign responsibility for tracking new legislation and regulatory changes in every relevant jurisdiction, and update your compliance program as needed.

Practical Compliance Tips

• Keep a state law matrix that lists the key privacy and breach notice rules for each state where you operate.
• Train team members on the strictest relevant standards rather than the minimum HIPAA rule.
• Set up relationships with local counsel in states with especially complex rules.
• Include state-specific terms in Business Associate Agreements (contracts with vendors that handle PHI) to ensure vendors comply with relevant state rules, not just HIPAA.
• Document your preemption analysis showing how you determined which standard applies in each jurisdiction.

For extra context on federal HIPAA rules that form the baseline for this analysis, see our guides on HIPAA Privacy Rule requirements and what is HIPAA.

State vs Federal HIPAA FAQ

Does HIPAA override all state health privacy laws?

No. HIPAA only preempts state laws that are contrary to HIPAA (meaning you could not follow both), and not when the state law is more protective of patient privacy. State laws that provide greater privacy protections or grant patients extra rights are not preempted and must be followed in addition to HIPAA. This means healthcare organizations often must comply with both federal and state rules simultaneously.

How do I determine which standard applies in a specific situation?

Compare the HIPAA rule with the relevant state law, one provision at a time. If the state law is more stringent (prohibits something HIPAA permits, gives patients more rights, or requires more protections), follow the state law. If the state law is less protective than HIPAA, follow HIPAA. When in doubt, consult with legal counsel experienced in health privacy law.

Do state laws apply to business associates?

It depends on the state. HIPAA applies to business associates through the federal framework. However, many state laws also impose duties on organizations that handle health or personal information, even if those organizations are not HIPAA-covered entities or business associates. Texas HB 300, for example, applies to any person who assembles, collects, or obtains PHI, regardless of HIPAA status.

What happens if I comply with HIPAA but violate a more stringent state law?

You may face state-level enforcement action, civil penalties, and potentially private lawsuits under state law. HIPAA compliance does not provide a defense against state law claims when the state law imposes a higher standard. Some states allow people to sue directly for breaches, creating liability exposure beyond what OCR enforcement alone would produce.

Are there states considering new health privacy laws?

Yes. The state privacy law space is evolving rapidly. Multiple states are considering or have recently enacted comprehensive privacy laws that affect healthcare data. Organizations should track legislative developments in every state where they operate and update their compliance programs as new laws take effect.

Does Washington's My Health My Data Act apply to HIPAA-covered entities?

Only in part. Data that is regulated as PHI under HIPAA is exempt from the My Health My Data Act. Consumer health data that falls outside HIPAA, such as data a consumer wellness app collects outside any covered entity's HIPAA role, may still be subject to MHMD. Organizations operating in Washington should map their data to see which data streams are HIPAA-covered and which may fall under MHMD.

What happened to the HIPAA reproductive health privacy rule?

HHS issued the rule in 2024. It barred covered entities and business associates from using or sharing PHI tied to lawful reproductive health care to investigate or impose liability on people for seeking or providing that care. It also required a signed attestation for some PHI requests. On June 18, 2025, a federal court vacated (struck down) the rule nationwide in Purl v. HHS, so those parts are not enforceable.

One piece survived: Notice of Privacy Practices updates tied to 42 CFR Part 2 substance use disorder records, due February 16, 2026. If you do not hold Part 2 records, that change does not affect you. State reproductive health laws still apply.

Does Texas HB 300 apply to my organization if we are not a Texas-based covered entity?

Texas HB 300 applies to any person who collects, stores, uses, or transmits protected health information, without regard to whether the organization is a Texas-based covered entity or a HIPAA business associate. If you handle the PHI of Texas residents, even from another state, HB 300 may apply. The law also sets employee training deadlines that HIPAA does not: staff who handle PHI must be trained within 90 days of hire, and again within a year after a change in the law that affects their duties.

Does Illinois BIPA apply to healthcare organizations?

In part. Illinois BIPA applies to any private entity that collects, stores, or uses biometric identifiers or biometric information. It leaves out information captured from a patient in a health care setting, and information collected, used, or stored for treatment, payment, or operations under HIPAA. Biometrics outside that exclusion, such as staff time clocks, are still covered.

BIPA requires written consent before collection. It also requires a public retention and destruction policy. BIPA prohibits the sale of biometric data. Penalties are $1,000 per negligent violation and $5,000 per intentional or reckless one. No proof of actual harm is needed. That litigation risk has produced significant class action activity in Illinois.

If we operate in multiple states, which state privacy law applies when there is a conflict?

In most cases, there is no true conflict: you simply apply the strictest relevant standard from each jurisdiction. The rule of thumb is to identify, for each compliance obligation (consent, access rights, breach notice, data retention), which state imposes the highest bar.

Build your policy to meet that bar uniformly. True conflicts (where complying with one state's law makes it impossible to comply with another) are rare and generally require legal counsel to resolve. For breach notice specifically, when a breach affects individuals in multiple states, you must meet the shortest notice deadline among all affected states.

State vs Federal Law Takeaways

The intersection of state privacy laws and federal HIPAA rules creates a layered compliance challenge that demands careful analysis and ongoing vigilance. Healthcare organizations that operate across state lines cannot rely on HIPAA compliance alone. They must identify, track, and comply with the more stringent state rules that apply in each jurisdiction where they serve patients or handle health information. As of 2026, the landscape is much more complex. Washington's My Health My Data Act and new consumer health data laws in Nevada and Connecticut have expanded obligations far beyond the traditional HIPAA-covered entity universe.

For the HIPAA side, the One Guy Consulting Full-Scope plan walks you through software and a process for becoming HIPAA compliant. How a specific state law applies to your practice is a legal question, so speak with a lawyer about that. Contact us to learn more.

Related: HIPAA requirements in California · HIPAA requirements in Florida · HIPAA requirements in Illinois · HIPAA requirements in New York · HIPAA requirements in Texas

Sources

• NCSL: Security Breach Notification Laws
• 45 CFR Part 164: Security and Privacy Rules
• HHS OCR Enforcement Actions

Related Reading

• How the HITECH Act Changed HIPAA Enforcement
• HIPAA Fines 2025: The Full Breakdown
• How Long Does HIPAA Compliance Take?

Related reading: HIPAA vs the Cures Act: May Share, May Not Block, How They Fit