HIPAA vs State Law: When Does State Privacy Law Supersede HIPAA? (2026)

State privacy law supersedes HIPAA (Health Insurance Portability and Accountability Act) when a state provision conflicts with the HIPAA Privacy Rule (HIPAA’s core health-privacy regulation, 45 CFR Part 164) and offers greater patient protection.

HIPAA regulations set a federal floor, not a ceiling. Covered entities and business associates follow whichever rule, federal or state, offers greater patient protection. The decision is made provision by provision, not statute by statute.

Compliance teams need the test. Health apps and wellness brands need to know if HIPAA applies. This guide covers both, along with current state overrides and the costs of errors.

This article (HIPAA vs. State Law) deals with preemption under the Privacy Rule. The Security Rule is subject to the same contrary/preemption arrangement in 45 CFR Part 160, so the test is the same. The substance differs.

When does state privacy law supersede HIPAA?

A state privacy law supersedes HIPAA when the state provision is “contrary” to HIPAA (you cannot comply with both) and “more stringent,” meaning it gives patients greater privacy protection or rights than the Privacy Rule. When both conditions are met, covered entities follow the state provision. HIPAA steps aside for that provision. This rule comes from 45 CFR § 160.202 and the HHS Office for Civil Rights preemption FAQ, which describes HIPAA as “a Federal floor of privacy protections.”

Every state-versus-HIPAA question lands in one of three outcomes:

1. Both laws apply. If you can comply with HIPAA and the state provision at once, there is no conflict and nothing is preempted. You do both (the most common outcome).
2. The state provision wins. The two rules genuinely conflict, and the state rule is more protective, or it falls inside a built-in exception such as public-health reporting. You follow the state provision.
3. HIPAA never applied in the first place. Much of what people call “health data” sits outside HIPAA entirely. If no covered entity or business associate is involved, state law governs alone.

“Supersede” suggests one statute knocking out the other. It never works that way. Preemption runs provision by provision. A single section of a state and local law can override a single HIPAA requirement, while every other HIPAA rule still binds you. That is why the analysis is a test you run, not a label you look up. Here is the test.

How does HIPAA preemption work?

Every preemption question resolves with two questions, both defined in 45 CFR § 160.202: is the state provision contrary to HIPAA, and if so, is it more stringent?

What does ‘contrary’ mean?

A state provision is contrary to HIPAA when either of the two prongs is met:

• Impossible to comply with both. Complying with the state requirement would violate the federal one. For example, a state law forbids a disclosure that HIPAA law requires, not merely permits.
• Obstacle to HIPAA’s purposes. The state provision “stands as an obstacle to the accomplishment and execution of the full purposes and objectives” of HIPAA’s Administrative Simplification provisions.

“Contrary” does not include a state law that is simply stricter. HHS’s example of a state law prohibiting disclosure of HIV status, where the Privacy Rule permits it, is not contrary because the covered entity complies with both by not disclosing. Stricter-but-compatible means both apply. Genuine conflict is the exception, not the rule.

What makes a state law ‘more stringent’? Six tests

Once a provision is contrary, it beats HIPAA only if it is more stringent. Section 160.202 sets six criteria. Meeting anyone is enough:

1. Tighter use or disclosure rules. The state law prohibits or restricts a use or disclosure that HIPAA permits (with carve-outs for disclosures to HHS for compliance checks and to the patient).
2. Greater access or amendment rights. Patients can see or correct more of their own information, or do so faster.
3. More information to the patient. Individuals must be told more about uses, disclosures, their rights, or their remedies.
4. Stricter consent or authorization. The state law narrows the scope or duration of consents, or otherwise makes authorization more protective.
5. Deeper recordkeeping. More detailed records or accounting of disclosures, or longer retention.
6. Any other greater privacy protection. The catch-all: greater privacy protection for the individual on any other matter.

HIPAA vs State Law: Which state laws always survive preemption?

Separately from the more stringent test, 45 CFR § 160.203 preserves whole categories of state law even when they conflict with HIPAA:

• Public health and mandated reporting. State provisions requiring reports of disease or injury, child abuse, birth, or death (and provisions for public-health surveillance, investigation, or intervention) are never preempted. State duties to report child abuse (which HIPAA expressly permits) and mandated injury reporting, such as gunshot-wound reports to law enforcement, continue regardless of HIPAA.
• Health-plan oversight. State provisions requiring health plans to report or provide access for management audits, financial audits, program monitoring, or licensure and certification survive.
• HHS exception determinations. Below.

What is an HHS exception determination?

A state or any person can ask The Department of Health and Human Services (HHS) to formally except a contrary state provision from preemption on narrow statutory grounds: preventing healthcare fraud and abuse, state insurance regulation authorized by statute, state reporting on healthcare delivery or costs, a compelling public-health or safety need, and controlled-substances regulation (45 CFR § 160.203(a); OCR FAQ 404).

Two operational points. Outside of this process, HHS will not tell you whether a state law is contrary to or more stringent. That analysis is yours to make and document. Once granted, an exception determination applies generally to everyone subject to the provision and is published in the Federal Register by HHS.

The four-way sort

Run any state provision through the two questions, and you get four outcomes:

Only the fourth row has HIPAA displacing state law: a genuinely conflicting rule that protects patients less. That’s the rare case. Treat “HIPAA preempts our state obligations” as a claim to prove, not a default.

The test assumes HIPAA applies to you.

First gate: Does the HIPAA Privacy Rule apply to you at all?

Preemption only matters inside HIPAA’s perimeter. Outside, there is nothing to preempt. The first question is whether you are inside at all.

HIPAA binds two classes of organizations (45 CFR § 160.103):

• Covered entities (CEs): health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in connection with standard transactions such as billing, claims, and eligibility checks. This covers effectively every provider.
• Business associates (BAs): any company that creates, receives, maintains, or transmits protected health information on behalf of a covered entity, including billing vendors, EHR hosts, analytics contractors, and cloud providers under a business associate agreement (BAA).

And it protects one class of data: protected health information (PHI), individually identifiable health information held or transmitted by a CE or BA, in any form.

What falls outside HIPAA?

If you are not a CE or a BA, HIPAA does not apply, no matter how medical the data feels:

• Wellness and health apps consumers download directly (fitness, fertility, meditation, symptom logs)
• Health-adjacent e-commerce: supplement shops, pharmacy-adjacent retail, DTC testing brands outside provider relationships
• Employer-held health records: the ADA, FMLA, and GINA govern these, not HIPAA
• Most website analytics collected by companies that aren’t CEs or BAs

For covered entities with websites, the boundary between marketing data and PHI is its own discipline. See the HIPAA-compliant tracking guide.

For everyone else, the pivot is this: if HIPAA does not apply, state law governs alone. States have built laws precisely for this universe. The next two sections show how.

Where does state law beat HIPAA? 

This table is organized by what state law does beyond HIPAA, not by state. It mirrors how your question arises. Rows are limited to provisions verified against primary sources.

States beat HIPAA on four axes: 

• scope (Texas and Washington bind companies HIPAA never reaches)
• speed (10-day record access, 30-day breach notice)
• sensitivity (HIV, mental health, and reproductive data get consent walls HIPAA doesn’t build)
• standing (several state laws let patients sue directly, which HIPAA never does). 

If your compliance program assumes the federal rule is the hard one, this table corrects that assumption.

Exemption or preemption? The confusion that costs companies

A team reads that a state privacy law “doesn’t apply to HIPAA-covered data,” files the law under preempted, and closes the ticket. This is wrong.

When a state privacy statute carves out HIPAA-regulated data, that is the state law choosing its own boundaries: a scope exemption written by the state, not a victory by HIPAA. The legislature declined to double-regulate data that federal law already covers. Everything outside the carve-out remains fully regulated by state law. HIPAA has no say.

For example, the California Consumer Privacy Act (CCPA) exempts protected patient health information collected by covered entities and business associates, and medical information governed by the CMIA. So a California health system’s patient records sit outside the CCPA. But:

Two consequences. The exemption is data-level, not entity-level: the same company holds exempt and covered data side by side (Virginia’s SB 754, above, is written exactly this way). And “CCPA exempts this data” doesn’t mean “no privacy law binds this data”: in California, CMIA (a more stringent state law with nominal statutory damages) usually stands next to HIPAA, not behind it. See our guide for the full CCPA program.

A policy memo that says “HIPAA preempts” where it should say “the state statute exempts PHI from its own scope” will mis-scope every adjacent dataset the company touches.

Does HIPAA cover apps, websites, and trackers?

HIPAA was written in 1996 for hospitals, insurers, and their vendors. Much of what 2026 calls “health data” (period trackers, fitness apps, telehealth-adjacent wellness brands, condition-research browsing on consumer sites) is generated by companies HIPAA doesn’t bind. State law moved into that gap. It brought enforcement mechanisms that HIPAA doesn’t have.

• Washington’s My Health My Data Act is the flagship. It defines “consumer health data” so broadly that browsing behavior tied to health conditions can qualify, requires consent to collect or share, and a valid authorization to sell, and gives individuals a private right of action (damages and AG-penalty terms in the landscape table above). The first suits arrived fast: Maxwell v. Amazon, filed February 10, 2025, is now consolidated into In re Amazon Ads SDK. HIPAA’s role in that litigation: none. It doesn’t reach the defendants. 
• California’s CIPA applies its pen-register provision, § 638.51 (added to the 1967 wiretap act in 2015), to pixels and session-replay scripts that transmit visitor data: statutory damages per violation, per visitor, in private litigation. We’ve covered how CIPA wiretap claims work and pen registers and your website in depth; the point here is that no HIPAA analysis is required for these suits to land. (One to watch: pending SB 690 would strip the private action for website and app claims, retroactively, if signed by September 30, 2026.)
• For covered entities’ own websites, the federal line moved too. OCR’s tracking-technologies bulletin asserted that an IP address plus a visit to an unauthenticated public health page could itself be PHI: the “Proscribed Combination.” A federal court vacated that theory in AHA v. Becerra, and HHS dropped its appeal on August 29, 2024. What the ruling did not change: authenticated portals, scheduling flows, and anything transmitted under a BAA remain fully governed. The page-by-page picture lives in our HIPAA-compliant tracking guide.

What does getting it wrong cost?

Preemption errors surface as one of four concrete exposures:

• State Attorney General enforcement. New York’s AG extracted $300,000 from NewYork-Presbyterian in December 2023 over tracking pixels on patient pages. The AG’s own release framed the conduct as HIPAA violations, which state AGs enforce directly under HITECH (42 U.S.C. § 1320d-5(d)). Penalty ceilings for Texas’s Medical Privacy Act, SB 1188, and MHMD sit in the landscape table above; Virginia’s amended VCPA allows up to $2,500 for willful violations.
• Private rights of action with statutory damages. The exposure HIPAA never creates: CMIA pays nominal damages with no proof of harm required; per-violation amounts for CMIA, CIPA, and MHMD sit in the table above. Virginia’s reproductive-health provision allows the greater of actual damages or $500 (treble or $1,000 if willful). Statutory damages turn a misconfigured pixel into arithmetic: per-violation × per-visitor × per-pageview.
• HIPAA as the civil standard of care. HIPAA grants no private right of action. Individuals can’t sue “under HIPAA.” But plaintiffs routinely plead HIPAA violations as the standard of care in negligence and invasion-of-privacy suits; the federal floor shows up in state-court complaints as a measuring stick.
• Federal enforcement in parallel. Preemption never removes HIPAA obligations. A state provision winning under § 160.202 doesn’t switch off the Privacy Rule, and OCR enforcement continues regardless. OCR’s civil money penalties were inflation-adjusted in January 2026 to $73,011 per violation, capped at $2,190,294 per calendar year per identical requirement (91 Fed. Reg. 3665). A single tracking practice can sit under three regimes at once (federal HIPAA duties, state AG authority, and private statutory claims), and settling one doesn’t settle the others.

The cheapest point to catch any of this is before data moves.

Which law governs this data? The five-question framework

Run this on each specific data practice, not your organization as a whole. The answer changes dataset by dataset. Multi-state operators run it per state, per provision: a single telehealth encounter can touch several states’ laws at once.

Three operational notes make the framework defensible:

1. Your Notice of Privacy Practices must keep up. The Privacy Rule requires NPPs to describe uses and disclosures as limited by more-stringent state law, per 45 CFR § 164.520(b)(1)(ii)(C). A preemption determination that never reaches your NPP is a compliance gap on its own.
2. Document every determination. HHS will not tell you whether a state law is contrary or more stringent (OCR FAQ 404). The analysis is yours, and the memo is your evidence. Record the provision, the two-question answers, and the date; revisit when either law amends.
3. Use the federal vocabulary for breach calls. When an incident straddles HIPAA and state breach law, the HIPAA question is the four-factor low-probability-of-compromise assessment under 45 CFR § 164.402: what was sent, who received it, whether it was acquired or viewed, and how far it’s been mitigated. State deadlines (30 days in New York, expedient in Illinois) run on their own clocks regardless of how the federal assessment lands.

For the operational version on your website (inventorying what’s transmitted, classifying pages, running the audit), see the HIPAA-compliant tracking guide.

See what your website actually sends → Start with a company name or domain.

How Melurna helps

Preemption analysis tells you which rules apply to a data flow. It can’t tell you what your pages actually transmit: which pixels fire on a scheduling page, what event parameters leave the browser. Or which third parties receive them. That’s an observation problem, not a legal one. Most preemption memos silently assume it.

Melurna observes the client side of your website: the trackers, pixels, and event transport your pages execute in visitors’ browsers, mapped against the frameworks that govern them, HIPAA included.

If the five-question framework says HIPAA applies to a page on your site, see every tracker and pixel firing on your patient-facing pages.

FAQs

DISCLAIMER: This guide is for general informational purposes only and does not constitute legal advice. While we strive for accuracy, we make no warranties about the completeness or reliability of this information, and are not liable for any errors, omissions, or actions taken based on its contents. Consult a licensed attorney for guidance specific to your business.