According to the National Institute of Health, “In general, the Privacy Rule overrides (or preempts) State laws relating to the privacy of health information that are contrary to the Rule. Any provision of State law that is not contrary to a provision of the Privacy Rule will remain in full force and effect, so that covered entities will continue to have to follow such State laws in addition to the Privacy Rule. However, even where a State law is contrary to the Privacy Rule, there are certain exceptions where the Privacy Rule will not override the contrary State law. For example, State laws that relate to the privacy of individually identifiable health information and are both contrary to and more stringent than the Privacy Rule will continue to stand. In addition, contrary laws and procedures established under State law that provide for reporting of disease or injury, child abuse, birth or death, or for conducting public health surveillance, investigation, and intervention also are not overridden by the Privacy Rule.”
Related: HIPAA Privacy Rule's impact on state public record laws
“Similar to the federal-level Freedom of Information Act (FOIA), state open records laws allow individuals to access records and information held by state agencies,” states ScienceDirect in “Using open records laws for research purposes”.These laws typically require that government agencies make their records available to the public upon request, with certain exceptions. Each state has its own version of these laws, sometimes called "sunshine laws" or "open records acts."
The Department of Health and Human Services (HHS) clarifies that, “The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other individually identifiable health information (collectively defined as “protected health information”) and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on the uses and disclosures that may be made of such information without an individual’s authorization. The Rule also gives individuals rights over their protected health information, including rights to examine and obtain a copy of their health records, to direct a covered entity to transmit to a third party an electronic copy of their protected health information in an electronic health record, and to request corrections.”
The HIPAA Privacy Rule generally preempts contrary state laws, including public records laws, when they provide less protection for individual privacy. However, if a state law provides greater privacy protections or rights concerning protected health information (PHI), the state law prevails.
The HHS outlines that, “In general, State laws that are contrary to the Privacy Rule are preempted by the federal requirements, which means that the federal requirements will apply. "Contrary" means that it would be impossible for a covered entity to comply with both the State and federal requirements, or that the provision of State law is an obstacle to accomplishing the full purposes and objectives of the Administrative Simplification provisions of HIPAA.”
The Privacy Rule provides exceptions to the general rule of federal preemption for contrary State laws that;
In addition the HHS states, “Preemption of a contrary State law will not occur if HHS determines, in response to a request from a State or other entity or person, that the State law:
Learn more: The function of the Privacy Rule in preventing conflict with state laws
Government agencies must comply with HIPAA rules and can only release PHI if authorized by the individual or permitted under the Privacy Rule.
A hybrid entity is a government agency that designates specific parts of its organization as subject to HIPAA requirements.
State laws can override HIPAA if they provide greater privacy protections, are necessary for public health, or are required for specific state purposes.