HIPAA’s preemption rule is at 45 C.F.R. § 160.203. It says a HIPAA standard that is contrary to a state law generally overrides that state law, unless an exception applies. The most important exception is for more protective state laws. When a state law is “more stringent” than its HIPAA counterpart, the state law prevails.

The Department of Health and Human Services (HHS) says, in its guidance on a state law protecting HIV patient information, that the “more stringent” State law would prevail. HHS added that no one needs to ask HHS for a preemption exception determination in that situation, because HIPAA’s own rules already carve out more stringent, contrary state laws.

HIPAA compliance and state compliance are therefore not alternatives; for organizations, both apply at once, and where they differ, the stricter rule wins.

 

HIPAA doesn’t reach everyone who handles health data

HIPAA applies to providers, health plans, clearinghouses, and their business associates. A University of North Carolina law journal explains that HIPAA protects data held by covered entities but does not extend to the wider digital landscape of health apps and wearables. Washington responded with the My Health My Data Act, which the same journal describes as the first U.S. privacy law to protect personal health data collected beyond HIPAA’s scope. Washington State Standard reported that the law is much broader in scope and protects data HIPAA doesn’t cover.

Read also: The state laws that regulate health data outside of HIPAA

 

HIPAA gives you no lawsuit, but state law often does

HIPAA has no private right of action. A patient whose records were mishandled cannot sue under HIPAA itself. State law fills that gap in several ways.

  • California’s CMIA. California’s Confidentiality of Medical Information Act lets individuals sue directly. A violation can bring $1,000 in nominal damages plus any actual damages; for many providers, the practical risk under the CMIA exceeds the risk under HIPAA, because any private party can bring a lawsuit for monetary damages. The stakes can be very large. In the Sutter Health class action over a stolen computer, the potential claim was around $4 billion because of the per-patient damages.
  • Common-law claims, with HIPAA as the yardstick. In Byrne v. Avery Center for Obstetrics & Gynecology, a patient had told her provider not to release her records to a particular person. The provider responded to that person’s subpoena by handing over the records without telling her. The trial court tossed her negligence claims as preempted by HIPAA. The Connecticut Supreme Court reversed, holding that HIPAA does not preempt state common-law negligence claims over breaches of confidentiality. Becker’s Hospital Review reported that the court said HIPAA regulations may be utilized to inform the standard of care in these cases. In effect, HIPAA became the measuring stick inside a state-law lawsuit.

 

State attorneys general enforce both

State AGs can enforce HIPAA itself. HHS states that the HITECH Act authorized state attorneys general to bring civil actions for HIPAA Privacy and Security Rule violations, seeking damages for residents or injunctions. The AGs also enforce their own state statutes, often in the same case. New York’s recent record shows this:

  • New York-Presbyterian Hospital (2023). Attorney General Letitia James secured $300,000 from the hospital for disclosing health information of people who visited its website. The settlement followed allegations that between June 2016 and June 2022, the hospital used third-party tracking tools on its site for marketing. Healthcare IT News quoted James saying the hospital had failed to handle its patients’ health information with care.
  • Refuah Health Center (2024). The NY AG found the center’s data security practices violated HIPAA as well as New York General Business Law.
  • Albany ENT & Allergy Services. According to JD Supra, the AG alleged the provider violated New York’s data security law after two 2023 ransomware attacks affecting over 200,000 consumers.

In these cases, being a HIPAA-regulated entity didn’t protect the organization from state law. It gave the state two legal pathways.

 

Cases where state law carried the case

  • Maxwell v. Amazon (W.D. Wash., filed 2025). This was the first class action under Washington’s My Health My Data Act. Law firm WilmerHale reported that the complaint was filed on February 10, 2025, more than a year after the law passed. Paul Hastings added that the suit alleges Amazon collected consumer health data through software development kits licensed to mobile apps. The allegations are unproven, and Amazon denies them. An Amazon spokesperson told reporters that “customer privacy is a top priority for Amazon.” The case matters because it was brought under a state statute covering data HIPAA does not.
  • Mosby v. Ingalls Memorial Hospital (Ill. 2023). This case shows state law cutting both ways. Nurses sued under Illinois’s Biometric Information Privacy Act over fingerprint-scan medication cabinets. The Illinois Supreme Court unanimously held that BIPA’s health care exemption covers information used for treatment, payment, or operations, not only patients’ data. Notably, the exemption itself borrows HIPAA’s definitions.

 

When federal protections retreat, state law matters more

On June 18, 2025, a federal court in Texas vacated nearly all of HHS’s 2024 reproductive health privacy rule in Purl v. HHS. Holland & Knight reported that the court found the rule unlawfully limited state public health laws and exceeded HHS’s authority. The firm predicted that additional state action may be seen to fill the gap.

 

What this means in practice

HIPAA compliance is necessary but not sufficient. Organizations should:

  • Map every state where patients, members, or website visitors live, and identify each state’s health privacy, breach-notification, and consumer-protection laws.
  • Compare state requirements with HIPAA provisions, and follow the stricter rule where they differ.
  • Check whether any of your data falls outside HIPAA, such as website analytics, apps, or marketing data, and which state laws govern it.
  • Review online tracking tools before deployment.
  • Plan for private lawsuits, not just regulators, in states like California and Washington.

Learn more: Does any law protect health data once it's outside HIPAA's reach?

 

FAQs

Does following HIPAA mean an organization is automatically compliant with state privacy laws?

No, because HIPAA sets a federal baseline and stricter state laws apply alongside it, so you need to satisfy both.

 

What counts as “health data” outside of HIPAA?

It generally includes information about your health collected by apps, wearables, websites, or other consumer services that aren’t HIPAA-regulated.

 

Who enforces health privacy laws?

Enforcement may come from federal agencies, state attorneys general, and, depending on the law, private individuals.