---
title: "45 CFR 160.204 HIPAA: Process for requesting exception determinations"
canonical: "https://dposchool.com/hipaa/section/160.204"
source: "https://www.ecfr.gov/current/title-45/section-160.204"
source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR."
text_as_of: "2026-10-29"
language: "en"
publisher: "DPO School"
---

45 CFR 160.204 HIPAA · Part 160: GENERAL ADMINISTRATIVE REQUIREMENTS · Subpart B: Preemption of State Law

# 45 CFR 160.204 HIPAA: Process for requesting exception determinations

eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.

## Official text

### 45 CFR 160.204(a)

**(a)** A request to except a provision of State law from preemption under § 160.203(a) may be submitted to the Secretary. A request by a State must be submitted through its chief elected official, or his or her designee. The request must be in writing and include the following information:

#### 45 CFR 160.204(a)(1)

**(1)** The State law for which the exception is requested;

#### 45 CFR 160.204(a)(2)

**(2)** The particular standard, requirement, or implementation specification for which the exception is requested;

#### 45 CFR 160.204(a)(3)

**(3)** The part of the standard or other provision that will not be implemented based on the exception or the additional data to be collected based on the exception, as appropriate;

#### 45 CFR 160.204(a)(4)

**(4)** How health care providers, health plans, and other entities would be affected by the exception;

#### 45 CFR 160.204(a)(5)

**(5)** The reasons why the State law should not be preempted by the federal standard, requirement, or implementation specification, including how the State law meets one or more of the criteria at § 160.203(a); and

#### 45 CFR 160.204(a)(6)

**(6)** Any other information the Secretary may request in order to make the determination.

### 45 CFR 160.204(b)

**(b)** Requests for exception under this section must be submitted to the Secretary at an address that will be published in the Federal Register. Until the Secretary's determination is made, the standard, requirement, or implementation specification under this subchapter remains in effect.

### 45 CFR 160.204(c)

**(c)** The Secretary's determination under this section will be made on the basis of the extent to which the information provided and other factors demonstrate that one or more of the criteria at § 160.203(a) has been met.

## Source

Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR.

[45 CFR 160.204 on eCFR](https://www.ecfr.gov/current/title-45/section-160.204)

eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.

This is reference material, not legal advice.

## Navigation

[HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 160.204

Previous: [45 CFR 160.203 HIPAA: General rule and exceptions](https://dposchool.com/hipaa/section/160.203)

Next: [45 CFR 160.205 HIPAA: Duration of effectiveness of exception determinations](https://dposchool.com/hipaa/section/160.205)

## For AI agents

- Machine-readable index: https://dposchool.com/hipaa/llms.txt
- JSON API: https://dposchool.com/hipaa/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents