Does HIPAA preempt state law?
Yes and no. Any federal law preempts state law if the laws cover the same subject matter, unless the federal law has exceptions to preemption. The HIPAA privacy statute has a specific section dealing with preemption. The statute provides that the HIPAA privacy statute shall supersede any contrary provision of state law. Social Security Act section 1178(a)(1), 42 U.S.C. 1320d-7(a)(1). The statute then lists several exceptions to preemption. Social Security Act section 1178(a)(2), 42 U.S.C. 1320d-7(a)(2). The HIPAA privacy statute also provides that the HIPAA privacy regulations shall not supercede a contrary provision of state law, if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regulation. Public Law 104-191, 264(c)(2), Social Security Act section 1178(a)(2)(B), 42 U.S.C. 1320d-7(a)(2)(B). There is a three-step process for determin
