45 CFR 160.203 HIPAA · Part 160: GENERAL ADMINISTRATIVE REQUIREMENTS · Subpart B: Preemption of State Law
45 CFR 160.203 HIPAA: General rule and exceptions
eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.
Official text
A standard, requirement, or implementation specification adopted under this subchapter that is contrary to a provision of State law preempts the provision of State law. This general rule applies, except if one or more of the following conditions is met:
A determination is made by the Secretary under § 160.204 that the provision of State law:
Is necessary:
To prevent fraud and abuse related to the provision of or payment for health care;
To ensure appropriate State regulation of insurance and health plans to the extent expressly authorized by statute or regulation;
For State reporting on health care delivery or costs; or
For purposes of serving a compelling need related to public health, safety, or welfare, and, if a standard, requirement, or implementation specification under part 164 of this subchapter is at issue, if the Secretary determines that the intrusion into privacy is warranted when balanced against the need to be served; or
Has as its principal purpose the regulation of the manufacture, registration, distribution, dispensing, or other control of any controlled substances (as defined in 21 U.S.C. 802), or that is deemed a controlled substance by State law.
The provision of State law relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter.
The provision of State law, including State procedures established under such law, as applicable, provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention.
The provision of State law requires a health plan to report, or to provide access to, information for the purpose of management audits, financial audits, program monitoring and evaluation, or the licensure or certification of facilities or individuals.
Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR.
Source credit: [65 FR 82798, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002]
eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.
This is reference material, not legal advice.