HIPAA Pre-Emption Analysis

While HIPAA was the first comprehensive set of federal laws to protect patient privacy, and the computer security of patient records, a patchwork of overlapping and sometimes conflicting state and federal laws impacts the compliance obligations of health providers, government agencies, and health plans.

In Ohio, for example, the Ohio Revised Code and Ohio Administrative Code include sometimes extensive regulation of confidentiality based on setting.  For example:

  • County Developmental Disability Boards
  • County Alcohol & Drug Addiction Service Boards
  • Group Homes for the Developmentally Disabled
  • County Mental Health Boards
  • Psychiatric Hospitals
  • Physician Practices

Various providers and entities must also comply with other federal confidentiality laws, including

  • Family Educational Rights and Privacy Act (FERPA)
  • Federal Alcohol & Drug Abuse Treatment Confidentiality Laws (42 CFR Part 2)
  • Graham-Leach-Bliley (GLB)

In general, an entity must comply with all applicable regulations.  However, various regulations may specify different procedures or thresholds.  In these cases, complex preemption provisions apply.   HIPAA preempts or overrides contrary or different state law unless the state law

  • Is more restrictive regarding allowable uses and disclosures
  • Provides the patient/client/individual greater right of access to his or her medical records
  • Is less coercive to the patient/client/individual

Eagle Consulting Partners has experience with the myriad of different confidentiality provisions and can assist with your complex confidentiality policy requirements.