--- title: "45 CFR 160.202 HIPAA: Definitions" canonical: "https://dposchool.com/hipaa/section/160.202" source: "https://www.ecfr.gov/current/title-45/section-160.202" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 45 CFR 160.202 HIPAA · Part 160: GENERAL ADMINISTRATIVE REQUIREMENTS · Subpart B: Preemption of State Law # 45 CFR 160.202 HIPAA: Definitions eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text For purposes of this subpart, the following terms have the following meanings: Contrary, when used to compare a provision of State law to a standard, requirement, or implementation specification adopted under this subchapter, means: #### 45 CFR 160.202(1) **(1)** A covered entity or business associate would find it impossible to comply with both the State and Federal requirements; or #### 45 CFR 160.202(2) **(2)** The provision of State law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of part C of title XI of the Act, section 264 of Public Law 104-191, or sections 13400-13424 of Public Law 111-5, as applicable. More stringent means, in the context of a comparison of a provision of State law and a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter, a State law that meets one or more of the following criteria: #### 45 CFR 160.202(1) **(1)** With respect to a use or disclosure, the law prohibits or restricts a use or disclosure in circumstances under which such use or disclosure otherwise would be permitted under this subchapter, except if the disclosure is: ##### 45 CFR 160.202(1)(i) **(i)** Required by the Secretary in connection with determining whether a covered entity or business associate is in compliance with this subchapter; or ##### 45 CFR 160.202(1)(ii) **(ii)** To the individual who is the subject of the individually identifiable health information. #### 45 CFR 160.202(2) **(2)** With respect to the rights of an individual, who is the subject of the individually identifiable health information, regarding access to or amendment of individually identifiable health information, permits greater rights of access or amendment, as applicable. #### 45 CFR 160.202(3) **(3)** With respect to information to be provided to an individual who is the subject of the individually identifiable health information about a use, a disclosure, rights, and remedies, provides the greater amount of information. #### 45 CFR 160.202(4) **(4)** With respect to the form, substance, or the need for express legal permission from an individual, who is the subject of the individually identifiable health information, for use or disclosure of individually identifiable health information, provides requirements that narrow the scope or duration, increase the privacy protections afforded (such as by expanding the criteria for), or reduce the coercive effect of the circumstances surrounding the express legal permission, as applicable. #### 45 CFR 160.202(5) **(5)** With respect to recordkeeping or requirements relating to accounting of disclosures, provides for the retention or reporting of more detailed information or for a longer duration. #### 45 CFR 160.202(6) **(6)** With respect to any other matter, provides greater privacy protection for the individual who is the subject of the individually identifiable health information. Relates to the privacy of individually identifiable health information means, with respect to a State law, that the State law has the specific purpose of protecting the privacy of health information or affects the privacy of health information in a direct, clear, and substantial way. State law means a constitution, statute, regulation, rule, common law, or other State action having the force and effect of law. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[65 FR 82798, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002; 74 FR 42767, Aug. 24, 2009; 78 FR 5689, Jan. 25, 2013\] [45 CFR 160.202 on eCFR](https://www.ecfr.gov/current/title-45/section-160.202) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 160.202 Previous: [45 CFR 160.201 HIPAA: Statutory basis](https://dposchool.com/hipaa/section/160.201) Next: [45 CFR 160.203 HIPAA: General rule and exceptions](https://dposchool.com/hipaa/section/160.203) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents