Preemption Analysis of Texas Laws Relating to the Privacy of Health ...

HIPAA, the Task Force generally noted the relevant provision in the attached table. It is
important to note, however, that enumerating a permitted use and disclosure provision is not
tantamount to a conclusion that no other provision applies. Moreover, not specifying a permitted
use and disclosure provision should not be construed to mean that one is not applicable.
In many instances in which the Task Force noted that a state statute authorizes (rather than
mandates) that which is prohibited by HIPAA, no specific recommendations were made. If the
Legislature chooses to amend these statutes, it has several options, including: (1) leave the
substance of the state law intact, but add a reference to HIPAA’s additional requirements or
inconsistent provisions, see, e.g., discussion of section 153.371 of the Texas Family Code; (2)
make the state law that authorizes use or disclosure mandatory so that the provision of HIPAA
that permits use or disclosure if required by law applies, 45 C.F.R. § 164.512(a); or (3) require
that the authorized use or disclosure comply with federal law, specifically HIPAA. By choosing
the first option, the Legislature could take the opportunity to minimize confusion for Texas’
covered entities. By choosing the second option, making use or disclosure mandatory where
HIPAA prohibits it or prohibiting use or disclosure where HIPAA permits it, the Legislature
would, in effect, allow state law to control. Conversely, by choosing the third option, the
Legislature would choose to let HIPAA control. A factor to consider in weighing these options is
that HIPAA applies to covered entities only, while state law may apply to non-covered entities as
well as to covered entities.
Even where a law is found to be contrary, HIPAA provides certain exceptions from the general
rule of preemption. According to this general rule, a state law that is “contrary” to a standard,
requirement or implementation specification of HIPAA will be preempted, unless the state law
falls under one of the following four categories of exceptions:
1. The state law has been the subject of a determination by the Secretary [of Health
and Human Services] in which the state law was held not to be preempted;
2. The state law is more stringent than HIPAA;
3. The state law provides for the reporting of disease, injury, child abuse, birth or
death, or for the conduct of public health surveillance, investigation, or
intervention; or
4. The state law governs accessibility to, or the reporting of information in the
possession of health plans for the purpose of certain audits, licensure, or program
monitoring and evaluation.
See 45 C.F.R. § 160.203. The exceptions found to apply most often were the second exception,
the state law is more stringent than HIPAA, and the third exception, reporting of child abuse.
State laws are generally “more stringent” than HIPAA where: (1) they are more restrictive with
respect to use and disclosure of PHI by covered entities; (2) they offer individuals who are the
subjects of personally identifiable health information greater rights of access to or amendment of
their PHI; or (3) they provide an overall greater amount of privacy protection to such individuals.
-10-