HIPAA Glossary · Laws & rules
Preemption
The principle that HIPAA overrides contrary state law — except where state law is more protective of privacy.
Context
HIPAA sets a floor, not a ceiling. State laws like the California CMIA, New York SHIELD Act, Texas HB 300, and Florida FIPA frequently add protections beyond HIPAA (shorter breach clocks, broader definitions, direct enforcement authority) and are not preempted. The practical consequence: compliance means HIPAA plus every state regime that applies to your residents.
Related terms
- Breach Notification Rule — The HIPAA regulation requiring notification of individuals, HHS, and sometimes the media following a breach of unsecured PHI.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.