The state layer: state privacy statutes that exceed HIPAA

Does state privacy law override HIPAA?

HIPAA is a federal floor, not a ceiling. Its preemption rule keeps any state privacy provision that is more stringent — one giving the patient greater protection or a greater right of access — in full force alongside the federal rule; HIPAA displaces only weaker or conflicting state law 1Ref 1Office of the Federal Register (2026).45 CFR Part 160 — General Administrative Requirements.The HIPAA preemption framework — that a more-stringent state privacy provision is not preempted and stands alongside the federal rule.. So the operative question is never HIPAA or state law, but HIPAA plus whatever your state adds.

Because that addition is jurisdiction-specific, a national policy template under-complies across much of the country — it captures the HIPAA baseline and none of the state overlay. If you are not certain HIPAA reaches you at all, start with the covered-entity test; the state layer is the second question, not the first. Before writing a single privacy policy, pull your state's own medical-confidentiality statute — California's Confidentiality of Medical Information Act is the best-known example — and read it beside HIPAA.

What does 'more stringent' actually mean?

'More stringent' has a specific meaning under the preemption regulation: a state rule stands if it gives individuals more privacy protection, more access to their own information, or more control over disclosures than HIPAA provides 1Ref 1Office of the Federal Register (2026).45 CFR Part 160 — General Administrative Requirements.The HIPAA preemption framework — that a more-stringent state privacy provision is not preempted and stands alongside the federal rule.. When a state rule is merely different, or weaker, HIPAA controls. When it is more protective, you comply with HIPAA by following the state rule — the two are not in tension.

Measure every state provision against HIPAA's own baseline — disclosures for treatment, payment, and health-care operations without authorization, the minimum necessary standard, and the individual-rights set 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.The HIPAA Privacy Rule baseline — TPO disclosures, minimum necessary, and individual rights — that each state provision is measured against.. A state law that shrinks what you may disclose, adds a consent step, shortens a deadline, or widens patient access is the layer you actually implement. Practically, that means writing your policies to the stricter of the two rules, provision by provision, rather than to HIPAA alone.

Where do states most often go further than HIPAA?

A handful of categories account for most of the state overlay a solo practice actually encounters. The table below maps each to what HIPAA does at the floor and where state law commonly reaches further. Read it as the list of statutes to pull for your own jurisdiction — not as a statement of any single state's rule, which will differ from your neighbor's.

Two of these deserve a note. State law can also reshape how you handle law enforcement requests and subpoenas, so the disclosure rules you learn federally are not the whole picture. And while HIPAA's six years covers policies and documentation, your board's clinical records retention rule may run years longer — the two clocks are independent, and you keep to the longer one.

Minors, capacity, and who controls the record

HIPAA hands the hardest privacy question in a family practice to the states: who controls a minor's record. Federally, a parent is usually the minor's personal representative and exercises the child's HIPAA rights — but HIPAA defers to state law where a minor can lawfully consent to a service on their own, and it recognizes narrow abuse-or-endangerment exceptions 3Ref 3HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA defers to state law on who controls a minor's or incapacitated adult's record and recognizes narrow abuse/endangerment exceptions.. So the answer to 'can this parent see this record' is set by your state, not by HIPAA.

The practical workflow: for every minor patient, determine under your state's law which services the minor may consent to alone — commonly some combination of reproductive, mental-health, and substance-use care — and treat the records of those services under the state's access rules, which often means the parent has no automatic right to them. Document the basis for each decision. When a personal representative's authority is unclear, or you suspect the representative endangers the patient, that is the moment to get a state-specific legal read before disclosing.

The tools HIPAA doesn't reach

Not every privacy obligation on a solo practice comes from HIPAA at all. Consumer-facing tools that sit outside a covered entity — a symptom-tracker app, a wellness website, a direct-to-consumer service with no business-associate relationship — can fall under the FTC's Health Breach Notification Rule instead, which reaches health data held by vendors HIPAA never covered 6Ref 6Federal Trade Commission (2026).Health Breach Notification Rule.That the FTC Health Breach Notification Rule reaches health data held by tools and vendors that fall outside HIPAA.. A growing set of state consumer-health-privacy laws adds another layer on the same tools.

For a clinical practice, the line is usually the business associate relationship: a vendor that creates, receives, maintains, or transmits PHI for you is inside HIPAA and needs a BAA. A tool your patients use on their own, with no BAA and no PHI flowing to you, may instead be governed by the FTC rule and by state consumer-health statutes. The upshot is that 'is it HIPAA?' is not the only question — for each tool, ask which regime actually covers it before you rely on it.

How to build your state layer

Building the state layer is a short, repeatable project, and OCR's enforcement record makes clear that small practices are not too small to be investigated 7Ref 7HHS Office for Civil Rights (2026).HIPAA Compliance and Enforcement.That OCR investigates and penalizes even very small practices, so building the state layer is not optional.. Start by pulling four documents for your state: the medical-confidentiality statute, the licensing board's records and privacy rules, the breach-notification statute, and any minor-consent statute. Read each beside its HIPAA counterpart and write your policy to whichever is stricter.

• Map the four sources. Confidentiality statute, board rules, breach law, minor-consent law.
• Write to the stricter rule, provision by provision. Where the state is silent, HIPAA governs; where it is stricter, it wins.
• Date the volatile pieces. State consumer-health-privacy laws are changing quickly; note when you last checked.
• Fold it into onboarding. This review is part of training a workforce of one, and it becomes part of your new-hire packet the day you hire.

Where a provision's meaning is genuinely ambiguous — cross-state telehealth, an unusual custody arrangement — that specific question, not the whole project, is what a one-hour consult with a health-law attorney in your state is for.