Under what conditions does state law take precedence over HIPAA?

State law takes precedence over HIPAA when state law is more restrictive than HIPAA. This means that if a state law provides greater privacy protections or stricter conditions for handling protected health information than those outlined by HIPAA, healthcare entities must follow the state law.

HIPAA establishes a minimum standard for protecting health information, so states have the authority to implement laws that offer additional safeguards. For instance, if a state requires written consent for disclosure of health information and HIPAA does not, the stricter state law must be adhered to in that jurisdiction.

In contrast, scenarios where HIPAA does not apply, or when HIPAA provides more leniency than state law, would lead healthcare entities to follow HIPAA regulations. Therefore, the priority is given to state laws that provide stricter measures than what HIPAA mandates. This balance ensures that patients have the highest level of privacy and security regarding their health information.