HIPAA State Law Preemption

Question 1

Under HIPAA, when does federal law preempt (override) a state health privacy law?

Accepted Answer

Whenever state law provides less protection for individuals than HIPAA requires

Answer

In all circumstances, because federal law always supersedes state law under the Supremacy Clause

Answer

Only when the state has not enacted its own comprehensive health privacy statute

Answer

Whenever state law grants patients more rights than HIPAA

Question 2

A state law requires written patient consent before disclosing HIV test results to public health authorities, a step HIPAA does not require. Which law must a covered entity follow?

Accepted Answer

The state law, because it affords patients greater privacy protection than HIPAA

Answer

HIPAA, because federal law is supreme under the Supremacy Clause

Answer

The provider may choose whichever law is operationally simpler

Answer

Neither law — the provider must obtain a court order in this situation

Question 3

The principle that HIPAA sets a 'floor' rather than a 'ceiling' for health privacy means:

Accepted Answer

States may enact more protective health privacy laws that go beyond HIPAA's minimum requirements

Answer

All state privacy laws are automatically invalidated by HIPAA

Answer

States are prohibited from enacting any health privacy laws that differ from HIPAA

Answer

Federal regulators alone determine the maximum permissible level of health privacy protection

Question 4

A covered entity operates clinics in State X, which has a mental health privacy law stricter than HIPAA, and State Y, which has no supplemental mental health privacy law. How must the entity handle mental health records?

Accepted Answer

Apply State X's stricter standard for State X patients; apply HIPAA minimums for State Y patients

Answer

Apply HIPAA standards uniformly across both states for operational consistency

Answer

Request a federal preemption waiver to use only HIPAA standards in State X

Answer

Apply the least restrictive standard in both states to minimize operational burden

Question 5

Which of the following is an example of a state law that would NOT be preempted by HIPAA?

Accepted Answer

A state law requiring additional patient authorization for releasing psychotherapy notes beyond HIPAA's requirements

Answer

A state law permitting PHI disclosure without patient consent for marketing purposes

Answer

A state law eliminating the requirement for a covered entity to issue a Notice of Privacy Practices

Answer

A state law removing a patient's right to request restrictions on certain disclosures

Question 6

Under HIPAA, a 'contrary' state law is defined as one that:

Accepted Answer

Makes it impossible to comply with both the state law and HIPAA simultaneously, or stands as an obstacle to HIPAA's purposes

Answer

Was enacted prior to HIPAA's passage in 1996

Answer

Applies only to electronic health records and not paper records

Answer

Covers only health plans but not individual healthcare providers