HIPAA State Law Preemption

Question 1

Under HIPAA, when does federal law preempt (override) a state health privacy law?

Accepted Answer

Whenever state law provides less protection for individuals than HIPAA requires

Answer

HIPAA preempts state law when the state law is less protective — meaning it allows disclosures that HIPAA prohibits or provides fewer individual rights. State laws that are MORE protective than HIPAA are generally not preempted and must be followed in addition to HIPAA.

Question 2

A state law requires written patient consent before disclosing HIV test results to public health authorities, a step HIPAA does not require. Which law must a covered entity follow?

Accepted Answer

The state law, because it affords patients greater privacy protection than HIPAA

Answer

When a state law is more stringent than HIPAA — meaning it provides greater privacy protections — it is not preempted and the covered entity must comply with both the state law and HIPAA. The state's consent requirement for HIV disclosures grants patients more protection, so the state law governs.

Question 3

The principle that HIPAA sets a 'floor' rather than a 'ceiling' for health privacy means:

Accepted Answer

States may enact more protective health privacy laws that go beyond HIPAA's minimum requirements

Answer

HIPAA establishes minimum baseline standards ('floor') for health information privacy. States are free to enact laws that provide greater protections, and those more protective state laws are not preempted by HIPAA. However, states cannot enact laws that offer less protection than HIPAA.

Question 4

A covered entity operates clinics in State X, which has a mental health privacy law stricter than HIPAA, and State Y, which has no supplemental mental health privacy law. How must the entity handle mental health records?

Accepted Answer

Apply State X's stricter standard for State X patients; apply HIPAA minimums for State Y patients

Answer

In each jurisdiction, the covered entity must comply with whichever law is more protective. In State X, the stricter state mental health law applies (in addition to HIPAA). In State Y, where there is no supplemental law, HIPAA's requirements govern. Operating uniformly at the HIPAA level in State X would violate that state's law.

Question 5

Which of the following is an example of a state law that would NOT be preempted by HIPAA?

Accepted Answer

A state law requiring additional patient authorization for releasing psychotherapy notes beyond HIPAA's requirements

Answer

A state law requiring additional authorization for psychotherapy notes goes beyond what HIPAA mandates, making it more protective of patient privacy. Such laws survive HIPAA preemption. The other options all weaken patient protections below HIPAA's floor and would be preempted because they conflict with HIPAA's purposes.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA State Law Preemption