These questions often arise in compliance meetings, vendor reviews, and even late-night discussions after a news story about a settlement. The pattern is clear: a team thinks their HIPAA program is solid, but then someone asks if that's truly enough. It usually isn't. Here are six common questions we hear, with direct answers.
Q1: We're HIPAA compliant. Why would a state law even apply to us?
HIPAA sets a baseline, not the full extent of compliance. The preemption rule at 45 C.F.R. § 160.203 states that a HIPAA standard generally overrides a conflicting state law, but there's an important exception: if a state law is "more stringent" than HIPAA, the state law takes precedence.
The Department of Health and Human Services (HHS) has clarified this in guidance on state laws protecting HIV patient information. A more stringent state law prevails without needing an exception determination from HHS. The regulation already includes this provision.
The takeaway is that HIPAA and state compliance are not alternatives; both apply simultaneously. Where they differ, follow the stricter rule.
Q2: Doesn't HIPAA cover all health data? What's left for states to regulate?
No, HIPAA doesn't cover everything. It applies to providers, health plans, clearinghouses, and their Business Associates, but not to health apps, wearables, and consumer websites.
Washington's My Health My Data Act addresses this gap. A University of North Carolina law journal describes it as the first U.S. privacy law to protect personal health data outside HIPAA's scope. If your organization uses a marketing site, mobile app, or analytics tools, check if any data falls outside HIPAA but within a state statute. Many teams haven't made this assessment.
Q3: Can a patient sue us over a privacy breach? I thought HIPAA had no private lawsuits.
HIPAA itself doesn't allow private lawsuits. However, state laws often fill this gap, changing your exposure.
Two key routes:
Statutory claims. California's Confidentiality of Medical Information Act (CMIA) allows individuals to sue directly. A violation can result in $1,000 in nominal damages plus any actual damages. This is per person, so the numbers can escalate quickly. In the Sutter Health class action over a stolen computer, the potential claim was around $4 billion. For California providers, CMIA risk can exceed HIPAA risk, as any private party can sue for damages.
Common-law claims. In Byrne v. Avery Center for Obstetrics & Gynecology, the Connecticut Supreme Court ruled that HIPAA doesn't preempt state common-law negligence claims over confidentiality breaches. HIPAA regulations may inform the standard of care, meaning your HIPAA policies could become the benchmark for a plaintiff.
This should influence how you draft policies. If you document a standard and fail to meet it, you've provided a plaintiff with a benchmark.
Q4: Do state attorneys general actually enforce HIPAA, or just their own laws?
They enforce both, often in the same case. The HITECH Act allows state attorneys general to bring civil actions for HIPAA Privacy and Security Rule violations, seeking damages or injunctions. They also enforce state statutes.
New York provides examples:
- New York-Presbyterian Hospital (2023). Attorney General Letitia James secured $300,000 over unauthorized health information disclosure via the hospital's website. The case involved third-party tracking tools used for marketing.
- Refuah Health Center (2024). The NY AG found the center violated HIPAA and New York General Business Law with its data security practices.
- Albany ENT & Allergy Services. The AG alleged violations of New York's data security law after ransomware attacks affected over 200,000 consumers.
Being HIPAA-regulated didn't protect these entities; it gave the state two legal avenues instead of one.
Q5: Our compliance program is built around OCR. Is that the right target?
It's necessary, but not sufficient. The Office for Civil Rights (OCR) is your federal regulator, but state attorneys general and private plaintiffs also play roles in enforcement.
Federal protections can change. On June 18, 2025, a federal court in Texas vacated most of HHS's 2024 reproductive health privacy rule in Purl v. HHS. The court found the rule unlawfully limited state public health laws and exceeded HHS's authority. When federal rules retreat, state requirements often become more significant. A program focused only on federal developments will miss these shifts.
Q6: What do we actually do about all this? Where do we start?
Begin with these steps:
- Map your footprint. Identify every state where your patients, members, or website visitors reside. Determine the health privacy, breach-notification, and consumer-protection laws that apply.
- Run a gap comparison. Compare each state requirement with the corresponding HIPAA provision. Where they differ, adopt the stricter rule as your standard.
- Inventory data outside HIPAA. Website analytics, apps, and marketing data may fall under state law even if clinical data doesn't. Identify which statute governs each.
- Review tracking tools before deployment. The New York-Presbyterian case hinged on third-party tools on a website. Implement a review process for any new pixel, SDK, or analytics script.
- Plan for litigation, not just audits. In states like California and Washington, private lawsuits are a real possibility. Ensure your incident response and documentation practices are litigation-ready.
One caution: not every state statute functions like these examples. The Illinois Supreme Court's decision in Mosby v. Ingalls Memorial Hospital showed state law working differently. It held that the Biometric Information Privacy Act's healthcare exemption covers information used for treatment, payment, or operations, not just patient data. Read each statute carefully.
Where to go for more
Start with HHS's guidance on preemption and 45 C.F.R. § 160.203; the regulation is short and worth reading. Then review your state's health privacy and breach-notification statutes, along with the attorney general's enforcement actions, to understand what regulators pursue. For data outside HIPAA, compare Washington's My Health My Data Act and California's CMIA. They illustrate how states can approach the same issue differently. Finally, involve your legal counsel early in the gap analysis. A comparison table reviewed by your legal team is far more valuable than one you create alone.
