The Role of State Laws Protecting Medical Records

HIPAA sets the floor for PHI security and privacy protections. This means that states are free to create laws and rules that provide more protections than HIPAA. Covered entities have to comply with both laws. Generally speaking, the controlling law is whichever law is stricter, or provides greater patient rights.

Any state law that is contrary to HIPAA is not allowed. A state law is contrary if it is impossible for the covered entity to comply with both the state law and HIPAA. In these situations, the state laws are preempted by HIPAA.

States enact many laws that may affect PHI. These laws can provide more rights than allowed by HIPAA. For instance, in 2008 California enacted some of the strictest patient privacy protections in the country. California’s laws specify harsh penalties for providers caught snooping in patient medical records. California healthcare providers must report privacy breaches more quickly than is specified in HIPAA. The California law requires healthcare providers to notify people within 15 days of a breach of a patient’s medical information.⁷¹

It is important to review both state law and federal law when reviewing questions about the security and privacy of PHI. You must review both types of laws to make sure that covered entities are appropriately protecting this information.