When a state health privacy law outranks the federal one

The short answer

The federal medical privacy rules state a general rule in one sentence. A standard, requirement, or implementation specification adopted under that subchapter that is contrary to a provision of state law preempts the provision of state law.

Then they list four conditions, any one of which takes a state provision out of that general rule.

The one that matters most to a reader is the second. The general rule does not apply where the provision of state law relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification adopted under the privacy subpart.

The consequence is structural. The federal privacy rules operate as a floor rather than a ceiling for state privacy protections, and the answer to what a company may do with health information can therefore differ depending on where a person is.

Contrary has a definition, and it is narrow

The general rule only bites where a state provision is contrary to a federal one, and contrary is a defined term rather than an ordinary word.

When used to compare a provision of state law to a federal standard, requirement or implementation specification, contrary means either that a covered entity or business associate would find it impossible to comply with both the state and federal requirements, or that the state provision stands as an obstacle to the accomplishment and execution of the full purposes and objectives of the named federal statutory provisions.

Both branches describe a genuine conflict. A state law that adds a requirement without making the federal one impossible or obstructing its purposes is not, on that definition, contrary at all.

The rules also define state law broadly for this purpose: a constitution, statute, regulation, rule, common law, or other state action having the force and effect of law. Common law sitting in that list is worth noticing, because it means the analysis is not confined to statutes on the books.

The six ways a state provision can be more stringent

The exception for a more stringent state provision is not left to judgment. The rules list six criteria, and meeting one or more is enough.

First, with respect to a use or disclosure, the state law prohibits or restricts a use or disclosure in circumstances under which it would otherwise be permitted federally. Two carve-outs are attached: disclosure required by the Secretary in connection with determining compliance, and disclosure to the individual who is the subject of the information.

Second, with respect to the rights of the individual who is the subject of the information regarding access to or amendment of it, the state law permits greater rights of access or amendment.

Third, with respect to information to be provided to that individual about a use, a disclosure, rights, and remedies, the state law provides the greater amount of information.

Fourth, with respect to the form, substance, or the need for express legal permission from the individual for a use or disclosure, the state law provides requirements that narrow the scope or duration, increase the privacy protections afforded, or reduce the coercive effect of the circumstances surrounding the permission.

Fifth, with respect to recordkeeping or requirements relating to accounting of disclosures, the state law provides for retention or reporting of more detailed information, or for a longer duration.

Sixth, and as a catch-all, with respect to any other matter, the state law provides greater privacy protection for the individual.

The fourth criterion is the one most relevant to how consent is collected online, since it reaches the form and substance of a permission and the coercive effect of the circumstances in which it is obtained.

The other three exceptions

The remaining three conditions have less to do with privacy and more to do with keeping other state functions intact.

One covers a determination by the Secretary that a state provision is necessary for a named purpose: to prevent fraud and abuse related to the provision of or payment for health care; to ensure appropriate state regulation of insurance and health plans to the extent expressly authorized by statute or regulation; for state reporting on health care delivery or costs; or for purposes of serving a compelling need related to public health, safety, or welfare. Where a privacy standard is at issue, that last ground additionally requires the Secretary to determine that the intrusion into privacy is warranted when balanced against the need to be served.

The same condition separately covers a state provision whose principal purpose is the regulation of the manufacture, registration, distribution, dispensing, or other control of controlled substances, or of anything a state law deems a controlled substance. That one is directly relevant to how state prescription monitoring functions sit alongside federal privacy rules.

Another covers state provisions, including state procedures established under them, providing for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention.

The last covers state provisions requiring a health plan to report, or to provide access to, information for management audits, financial audits, program monitoring and evaluation, or the licensure or certification of facilities or individuals.

The exception nobody has to ask for, and the one they do

There is an asymmetry in the scheme that is easy to miss on a first read.

The more stringent exception, the public health reporting exception and the health plan audit exception operate by their own terms. Nothing in the rules requires anyone to apply for them.

The first exception is different, because it is defined as a determination made by the Secretary. The rules set out a process for requesting one. A request may be submitted to the Secretary, and a request by a state must come through its chief elected official or a designee, in writing.

It must name the state law and the particular federal standard for which the exception is requested; the part of the standard that will not be implemented, or the additional data to be collected; how health care providers, health plans and other entities would be affected; the reasons the state law should not be preempted, including how it meets one or more of the listed criteria; and any other information the Secretary requests.

The rules also state what happens while a request is pending: until the Secretary's determination is made, the federal standard remains in effect. And they state the basis of decision, which is the extent to which the information provided and other factors demonstrate that one or more of the criteria has been met.

Why this matters for reading a privacy policy

A privacy notice describes what a company does. It is not, on its own, evidence of everything the law requires of that company, because part of what the law requires depends on where the person reading it lives.

The federal rules make that explicit by design. They set a general rule of preemption, then carve out a category of state provisions that are more protective, and then define more protective across six dimensions covering disclosure, access, notice, permission, recordkeeping, and a residual category.

Two limits are worth holding onto. This scheme governs the relationship between the federal medical privacy rules and state law. It says nothing about entities the federal rules do not cover in the first place, which is a separate question decided by different definitions. And it does not tell any individual what protections apply to them, which depends on facts about the entity, the information, and the jurisdiction.

This article names no state and describes no state law. It sets out the test the federal rules use, which is what a reader can carry into any specific question they later ask.

Sources

Each document below is named as it names itself, with the date printed on that document rather than the day it was read.

1. Title 45 Code of Federal Regulations Section 160.202, Definitions, read in full — the definitions of contrary with both branches, more stringent with all six criteria, relates to the privacy of individually identifiable health information, and State law — Electronic Code of Federal Regulations, Office of the Federal Register, September 2026
2. Title 45 Code of Federal Regulations Section 160.203, General rule and exceptions, read in full — the preemption general rule and the four lettered exceptions including the Secretary determination grounds, the controlled substances clause, the more stringent privacy clause, the public health reporting clause and the health plan audit clause — Electronic Code of Federal Regulations, Office of the Federal Register, September 2026
3. Title 45 Code of Federal Regulations Section 160.204, Process for requesting exception determinations, read in full — the six items a request must contain, the requirement that a State request come through its chief elected official or designee, the statement that the federal standard remains in effect until a determination is made, and the basis of decision — Electronic Code of Federal Regulations, Office of the Federal Register, September 2026