Guide · HIPAA

When does a state breach law apply alongside HIPAA?

HIPAA sets a federal floor, and state law is generally preempted only when it is contrary to HIPAA and less protective. State laws that are more stringent, or that can be followed alongside HIPAA, generally continue to apply, so a healthcare breach can trigger both HIPAA and state breach notification duties.

When does state privacy law supersede HIPAA?

HHS explains that HIPAA preempts contrary state law, with exceptions, including where the state law is more stringent in protecting individually identifiable health information. A state law is "contrary" when it is impossible to comply with both. Where both can be followed, both apply.

How state breach statutes treat HIPAA entities

Every state and DC has its own breach notification statute. These laws differ on what information is covered, timing, and attorney general notice. Some treat compliance with HIPAA as compliance with the state law; others do not. The PRC 2026 survey records medical information as covered in 24 of 51 jurisdictions. Check each state below.

State law pages

Compare several at once with the compare tool.

Frequently asked questions

When does state privacy law supersede HIPAA?

Under HHS guidance, a state law generally survives preemption when it is more stringent than HIPAA in protecting health information, or when it does not conflict with HIPAA.

Does HIPAA override stricter state laws?

Generally no. HIPAA preempts contrary state law that is less protective; more stringent state privacy provisions are an exception to preemption.

Do HIPAA entities have to follow state breach notification laws?

Often yes, depending on the state statute. Some state laws deem HIPAA compliance sufficient; check the specific state law.

Sources

Last updated 2026-10-20.