--- title: "42 U.S.C. 1320d–7 HIPAA: Effect on State law" canonical: "https://dposchool.com/hipaa/section/1320d-7" source: "https://uscode.house.gov/us/usc/119-136/t42/s1320d-7/" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-22" language: "en" publisher: "DPO School" --- 42 U.S.C. 1320d–7 HIPAA · Chapter 7: SOCIAL SECURITY # 42 U.S.C. 1320d–7 HIPAA: Effect on State law United States Code, current through Public Law 119-136 (October 22, 2026). Retrieved 30 October 2026. ## Official text ### 42 U.S.C. 1320d–7(a) **(a)** General effect #### 42 U.S.C. 1320d–7(a)(1) **(1)** General rule Except as provided in paragraph (2), a provision or requirement under this part, or a standard or implementation specification adopted or established under sections 1320d–1 through 1320d–3 of this title, shall supersede any contrary provision of State law, including a provision of State law that requires medical or health plan records (including billing information) to be maintained or transmitted in written rather than electronic form. #### 42 U.S.C. 1320d–7(a)(2) **(2)** Exceptions A provision or requirement under this part, or a standard or implementation specification adopted or established under sections 1320d–1 through 1320d–3 of this title, shall not supersede a contrary provision of State law, if the provision of State law⁠— ##### 42 U.S.C. 1320d–7(a)(2)(A) **(A)** is a provision the Secretary determines⁠— ###### 42 U.S.C. 1320d–7(a)(2)(A)(i) **(i)** is necessary⁠— ###### 42 U.S.C. 1320d–7(a)(2)(A)(i)(I) **(I)** to prevent fraud and abuse; ###### 42 U.S.C. 1320d–7(a)(2)(A)(i)(II) **(II)** to ensure appropriate State regulation of insurance and health plans; ###### 42 U.S.C. 1320d–7(a)(2)(A)(i)(III) **(III)** for State reporting on health care delivery or costs; or ###### 42 U.S.C. 1320d–7(a)(2)(A)(i)(IV) **(IV)** for other purposes; or ###### 42 U.S.C. 1320d–7(a)(2)(A)(ii) **(ii)** addresses controlled substances; or ##### 42 U.S.C. 1320d–7(a)(2)(B) **(B)** subject to section 264(c)(2) of the Health Insurance Portability and Accountability Act of 1996, relates to the privacy of individually identifiable health information. ### 42 U.S.C. 1320d–7(b) **(b)** Public health Nothing in this part shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention. ### 42 U.S.C. 1320d–7(c) **(c)** State regulatory reporting Nothing in this part shall limit the ability of a State to require a health plan to report, or to provide access to, information for management audits, financial audits, program monitoring and evaluation, facility licensure or certification, or individual licensure or certification. ## Source Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source credit: ( Aug. 14, 1935, ch. 531 , title XI, § 1178, as added Pub. L. 104-191, title II, § 262(a) , Aug. 21, 1996 , 110 Stat. 2029 .) [42 U.S.C. 1320d–7 on the Office of the Law Revision Counsel](https://uscode.house.gov/us/usc/119-136/t42/s1320d-7/) United States Code, current through Public Law 119-136 (October 22, 2026). Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 42 U.S.C. 1320d–7 Previous: [42 U.S.C. 1320d–6 HIPAA: Wrongful disclosure of individually identifiable health information](https://dposchool.com/hipaa/section/1320d-6) Next: [42 U.S.C. 1320d–8 HIPAA: Processing payment transactions by financial institutions](https://dposchool.com/hipaa/section/1320d-8) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents