Does HIPAA Preempt State Law? When State Privacy Laws Win

State privacy law supersedes HIPAA when a state provision relates to the privacy of health information and is more stringent than the HIPAA Privacy Rule, or when it fits one of the other exceptions in 45 CFR 160.203; otherwise, a HIPAA standard that is contrary to a state law "preempts the provision of State law" (eCFR). HHS describes the Privacy Rule as "a Federal floor of privacy protections" for health information held by covered entities and their business associates (HHS). So stricter state health privacy laws still bind healthcare marketers, and state consumer health data laws reach data HIPAA does not cover. Curve Compliance handles the ad tracking side: it signs a BAA on every plan and strips PHI before data reaches an ad platform.

Book a call. Curve Compliance sends conversions to your ad platforms server-side, and Curve's team does the setup. Book a call with Curve.

Is HIPAA a state or federal law?

HIPAA is federal: the Health Insurance Portability and Accountability Act of 1996, "Public Law 104-191, was enacted on August 21, 1996," and HHS issued the Privacy Rule under it (HHS). The Privacy Rule applies to health plans, health care clearinghouses and health care providers that conduct standard electronic transactions, and to their business associates. State laws add to it, and 45 CFR Part 160, Subpart B settles conflicts. For who counts as covered, see what a HIPAA covered entity is.

The preemption rule and its four exceptions

The general rule is in 45 CFR 160.203: "A standard, requirement, or implementation specification adopted under this subchapter that is contrary to a provision of State law preempts the provision of State law. This general rule applies, except if one or more of the following conditions is met" (eCFR). The conditions:

Exception	What 45 CFR 160.203 says	Does HHS have to decide?
More protective privacy law, 160.203(b)	The state provision "relates to the privacy of individually identifiable health information and is more stringent than" the Privacy Rule standard (eCFR)	No.
Public health and vital reporting, 160.203(c)	The state law "provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention" (eCFR)	No.
Health plan reporting, 160.203(d)	The state law "requires a health plan to report, or to provide access to, information for the purpose of management audits, financial audits," program monitoring, or licensure or certification (eCFR)	No.
HHS exception determination, 160.203(a)	HHS finds the state law necessary to prevent health care fraud and abuse, regulate insurance, support "State reporting on health care delivery or costs," or meet a compelling public health, safety or welfare need, or the law mainly regulates controlled substances (eCFR)	Yes. A written request under 45 CFR 160.204; a state files "through its chief elected official, or his or her designee" (eCFR).

While a request is pending, the federal standard "remains in effect" (eCFR); a granted exception lasts until the law materially changes or HHS revokes it (eCFR). When an exception applies, HHS says "a covered entity is not required to comply with a contrary provision of the Privacy Rule" (HHS).

What "contrary" and "more stringent" mean

Preemption only starts when a state law is "contrary" to HIPAA. Under 45 CFR 160.202, that means a covered entity or business associate "would find it impossible to comply with both the State and Federal requirements," or the state law "stands as an obstacle" to HIPAA's purposes (eCFR). If you can follow both, you follow both.

A state law relates to health privacy when it "has the specific purpose of protecting the privacy of health information or affects the privacy of health information in a direct, clear, and substantial way." It is more stringent when it does one of six things (eCFR):

• Restricts uses or disclosures. It "prohibits or restricts a use or disclosure in circumstances under which such use or disclosure otherwise would be permitted," except disclosures to HHS for compliance checks or to the person the information is about.
• Gives more access rights. It "permits greater rights of access or amendment."
• Tells people more. It "provides the greater amount of information" to the person.
• Tightens permission. It narrows a person's permission or reduces "the coercive effect of the circumstances surrounding the express legal permission."
• Keeps better records. It "provides for the retention or reporting of more detailed information or for a longer duration."
• Protects privacy more in any other way. It "provides greater privacy protection for the individual."

When state law wins: examples by type

Texas's Health and Safety Code chapter 181 reaches past HIPAA. It defines a covered entity to include any person who "comes into possession of protected health information," and its list names a "person who maintains an Internet site" (Texas Health and Safety Code ch. 181). Two provisions matter to marketers:

• Marketing permission. Section 181.152 says a covered entity "must obtain clear and unambiguous permission in written or electronic form to use or disclose protected health information for any marketing communication," with exceptions such as face-to-face communications and promotional gifts of nominal value (Texas).
• Electronic disclosures. Section 181.154(b) says a covered entity "may not electronically disclose an individual's protected health information to any person without a separate authorization from the individual or the individual's legally authorized representative for each disclosure," subject to exceptions in 181.154(c), such as disclosures to another covered entity for treatment, payment or health care operations, or "as otherwise authorized or required by state or federal law" (Texas).

Texas's attorney general enforces chapter 181 (section 181.201, Texas); for HIPAA itself, see who enforces HIPAA. Whether a Texas provision is more stringent than HIPAA for a given use is decided provision by provision, so talk to your counsel before relying on either one. For more states, see the state health privacy laws reference table.

State consumer health data laws outside HIPAA

Preemption only matters where HIPAA applies. HHS's tracking bulletin says the HIPAA Rules "do not apply to health information that an individual enters into a mobile app offered by an entity that is not regulated by HIPAA," and that in those cases "other law may apply," naming the FTC Act and the FTC's Health Breach Notification Rule (HHS).

One example is Washington's My Health My Data Act. It covers "consumer health data," meaning "personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status." Collecting it needs consent "for a specified purpose" unless it is necessary for a product or service the consumer asked for, and sharing needs consent "that is separate and distinct from the consent obtained to collect consumer health data," with the same exception (RCW 19.373). The two laws split the data rather than compete: the Act "does not apply to" information that meets the definition of "Protected health information for purposes of the federal health insurance portability and accountability act of 1996" (RCW 19.373.100). So PHI follows HIPAA, while consumer health data outside that definition can fall under the Washington law. Other states exempt whole businesses: Oklahoma's new privacy law excludes "A covered entity or business associate governed by the privacy, security, and breach notification rules" (SB 546); see Oklahoma and Louisiana. See the MHMDA compliance checklist and overlapping state privacy laws.

Which law to follow when they differ

Situation	Which rule governs	Source
You can comply with both the state law and HIPAA	Both.	45 CFR 160.202
A contrary state law gives less privacy protection	HIPAA. The state provision is preempted.	45 CFR 160.203
A contrary state law relates to health privacy and is more stringent than the Privacy Rule	The state law.	160.203(b); HHS
A state law requires public health, vital or health plan reporting	The state law.	160.203(c) and (d)
HHS granted an exception for the state law	The state law, until the law changes or HHS revokes the exception.	160.203(a); 160.205
The data is not held by a covered entity or business associate	State law, and FTC rules where they apply. HIPAA does not apply.	HHS; HHS bulletin

What this means for ad tracking

HIPAA is the minimum. HHS says disclosures of PHI to tracking technology vendors "for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures" (HHS), and states such as Texas and Washington add their own permission and consent rules. See HIPAA marketing authorization and ad tracking and what counts as PHI on a website.

How Curve Compliance helps

Curve Compliance signs a BAA on every plan and replaces browser ad pixels with one script that sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok.

Curve also offers consent management under the same BAA, and Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. The free website scan lists a page's trackers.

Sources, checked October 26, 2026: 45 CFR 160.202; 45 CFR 160.203; 45 CFR 160.204; 45 CFR 160.205; 45 CFR 164.512; HHS, Does the HIPAA Privacy Rule preempt state laws?; HHS, Summary of the HIPAA Privacy Rule; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates; Texas Health and Safety Code chapter 181; Washington RCW chapter 19.373; Oklahoma SB 546.

Frequently Asked Questions

When does state privacy law supersede HIPAA?

When a contrary state provision relates to health privacy and is more stringent than the Privacy Rule, or fits another exception in 45 CFR 160.203, such as public health reporting (eCFR). State law also governs on its own where HIPAA does not apply, because HHS describes the Privacy Rule as a floor for information held by covered entities and their business associates (HHS).

In what situations does a state or federal law or regulation preempt HIPAA?

HIPAA is the federal law, so the question is when a state law survives it. A state law that is not contrary to HIPAA is not preempted at all (45 CFR 160.202); a contrary one survives only in the four situations in 45 CFR 160.203, namely more protective privacy laws, public health or vital reporting, health plan reporting, and HHS exceptions granted on request (eCFR). For other legal mandates, the Privacy Rule permits disclosures "required by law" (45 CFR 164.512).

Do some states have more stringent privacy laws than HIPAA?

Yes. HHS calls the Privacy Rule "a Federal floor of privacy protections" (HHS), and states can go further. Texas, for example, requires "clear and unambiguous permission in written or electronic form" before PHI is used or disclosed for marketing communications, with limited exceptions (Texas ch. 181).

Can state law supersede HIPAA?

Yes, in the cases 45 CFR 160.203 lists, and then the covered entity follows the state law. HHS says that in those circumstances "a covered entity is not required to comply with a contrary provision of the Privacy Rule" (HHS).

When should you follow state laws instead of HIPAA?

Follow both wherever you can (45 CFR 160.202). Follow the state law instead when it conflicts with the Privacy Rule and is more stringent, or fits another 160.203 exception, and where HIPAA does not apply at all (HHS).

When a state law is more stringent than HIPAA privacy law, the?

The state law provision is not preempted, so the covered entity follows it. Under 45 CFR 160.203(b), a provision that "relates to the privacy of individually identifiable health information and is more stringent" than the Privacy Rule stays in force (eCFR).

What state has the most privacy laws?

It depends on which laws you count. For healthcare marketers the useful question is which states reach health data beyond HIPAA, such as Texas (chapter 181) and Washington (the My Health My Data Act); our state reference table lists more.

Does HIPAA have exceptions?

Yes. The preemption rule has the four exceptions in 45 CFR 160.203, and the Privacy Rule permits some disclosures without authorization, such as those "required by law" (45 CFR 164.512). For the breach rule's three exceptions, see the HIPAA Breach Notification Rule.

Talk to Curve Compliance

Book a call. See what your site sends to ad platforms today and how Curve Compliance removes PHI before anything is sent to an ad platform, under the BAA it signs on every plan. Book a call with Curve.