If State law and HIPAA got into a fight, who would win?
As a general guide, the law that offers the most protection to the patient in question wins. The whole idea of HIPAA is to increase the privacy of medical records. It doesn’t always succeed in its aims, but that’s beside the point.
There are clauses written in to the HIPAA Administrative Simplification Rules that will either override or be subject to State law depending on which law offers the most protection to the patient and their PHI. These kind of judgements are generally made by a judge or the Department of Health and Human Services (HHS) who administer HIPAA. Even if state law contravenes HIPAA, a judgement may be made against HIPAA or for it depending on this decision.
There is a whole raft of criteria to be taken into account when making a decision, which is why it is reserved for judges and HHS officials. HIPAA can certainly be curtailed if there is a risk of fraud or a compelling public health, or safety reason. Prevention of crimes or abuses would certainly qualify.
So, like everything else that concerns HIPAA, it is complicated, convoluted and never straight forward. However the first statement is as accurate an assessment a layman can make. Whichever law protects the privacy of PHI the most wins. So as with most things HIPAA, it’s heart may appear to be in the right place, even if it’s brain isn’t.
