lawyer

#HIPAA Preemption Charts

The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") gave the federal Department of Health and Human Services ("HHS") the authority to promulgate regulations containing standards with respect to the privacy of individually identifiable health information. HIPAA provided that such standards shall not supersede State law that imposes more stringent standards (P.L. 104-191, 264(c)). HHS promulgated the federal standards, and they are now in Parts 160 and 164 of Title 45 of the Code of Federal Regulations (the "Privacy Rule").

Under the Supremacy Clause of the U.S. Constitution, federal law preempts State law when preemption is the clear and manifest purpose of Congress. In instances where the purpose of Congress is not clear, only the judicial branch of government can determine whether a federal law preempts a State law under the Supremacy Clause.

In enacting HIPAA, Congress clearly did not supersede State laws that impose more stringent standards with respect to the privacy of individually identifiable health information. Thus, the Department will continue to enforce such State laws that are within the Department's purview to enforce. The Department will enforce other State laws to the extent that the Privacy Rule does not preempt them. Under the provisions of the Privacy Rule, the Privacy Rule does not alter State laws that permit individuals greater rights of access to or amendment of their own individually identifiable health information (45 CFR 160.202(More stringent)).

April 14, 2003, is the compliance date for most covered entities under the Privacy Rule. Unless the relevant federal or State laws or regulations are amended, the Department intends to enforce specified provisions of State law as outlined in the following charts.