Ascension Health HIPAA Web Site
Maintained by Don Stry, Information Services Division
(812) 228-2131 Email: dstry@ascensionhealth.org
Section: State Health Privacy Laws - Websites for State Law Preemption of HIPAA
Updated 11/17/03
1. AHA Website for State Preemption Analyses
http://www.hospitalconnect.com/aha/key_issues/hipaa/resources/PreemptMap/PreemptionAnalysisMap.html
2. Health Privacy Project at Georgetown University for State LawsGo to http://www.healthprivacy.org/ and click on the State Law button.
In 1999, the Health Privacy Project (from the Institute for Health Care Research and Policy, Georgetown University) released a summary of state health privacy statutes. The report, The State of Health Privacy: An Uneven Terrain (A Comprehensive Survey of State Health Privacy Statutes), is the first-ever survey of its kind. It is being updated in Nov. 2002.You can use the report to:
- Learn generally about the kinds of protections offered in state statutes, and where there are gaps.
- Obtain a summary of your state's health privacy statutes.
- Compare protections between states.
The Project is in the process of updating the summaries of state health privacy statutes. As of November 2002, the following state summaries have been updated and are now available online: Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, District of Columbia, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin and Wyoming.
Go to http://www.healthprivacy.org/ and click on the State Law button. Then you can either select to view the whole report or for a selected state.
Please note that the survey is not exhaustive. The state summaries speak most directly to the use and disclosure of information gathered and shared in the course of providing and paying for health care. Finally, the survey is specifically and exclusively a survey of statutes, not regulations or case law.
3. State HIPAA Preemption Analysis Results (added 08/11/03 )
Here is the results of which States have HIPAA preemption analysis. The research was performed by John C. Cody, Esq., NYS Central HIPAA Coordination Project, NYS Office for Technology.
- LOCAL GOVERNMENTS: No responses about any local governments performing and posting preemption analyses. Zero, zilch, nada.
- STATE GOVERNMENTS: (a) Almost 1/4 of the state GOVERNMENTS (eleven
states) have posted Privacy Rule preemption analyses on their own STATE GOVERNMENT websites; and (b) two additional states appear to tacitly approve of analyses which have been posted on non-government websites (i.e. while the results are not posted on a GOVERNMENT website, governmental folks were apparently integrally involved in creating those analyses and supported the respective "collaboratives'" efforts).
The eleven states I could find which have posted preemption analyses on their own STATE GOVERNMENT websites include:
1. ALASKA: Yes, see: http://health.hss.state.ak.us/das/is/hipaa/legal.htm and click on "the Alaska State Comparative Health Law Matrix".
2. ARIZONA: Yes, see: http://www.ahcccs.state.az.us/HIPAA/HIPAAPrivacy/PDFs/Pre-EmptionAnalysi sReportv3.pdf.
3. CALIFORNIA: Yes, see http://www.ohi.ca.gov/state/calohi/ohiHome.jsp, click on the left-hand side of the page on "Legal Issues", and their Privacy Rule preemption analyses come right up.
4. ILLINOIS: Yes, see: http://www.illinois.gov/hipaa/PreempAnalysis.pdf. When clicking through into this document from the main website, it requires anyone wishing to access the preemption analysis to first click-through an "I agree" set of disclaimers before one can proceed.
5. IOWA: Yes, see: http://www.state.ia.us/government/hipaa/isbacle.htm and click on "HIPAA Law Preemption Analysis of Iowa Law" near the bottom of the page.
6. KENTUCKY: Yes, its preemption analyses are sited at: http://www.mc.uky.edu/compliance/HIPAA/HIPAAProjectTeam.htm.
9. NEW YORK: Yes, go to www.oft.state.ny.us, click on "Central HIPAA Coordination Project", then "Tools and Deliverables", and scroll down to "Preemption Analyses".
10. SOUTH CAROLINA: Yes, see: http://www.hipaa.state.sc.us/tools.htm and click on the link to, "S.C. STATUTES POTENTIALLY PREEMPTED (Word file)".
11. WEST VIRGINIA: Yes, see: http://www.wvdhhr.org/hipaa/default.asp, then click through on the left side of the page on "Privacy", which will take you to: http://www.wvdhhr.org/hipaa/privacy.asp. Then, click on the various "preemption" links at the bottom of the page (e.g. http://www.wvdhhr.org/hipaa/documents/pre_matrix.pdf). (Note that this is a website using an "org" domain, but you will see that it states on the webpages that it is actually THE official State of West Virginia governmental HIPAA website).Two additional sites which appear to have the tacit approval by their respective state governments (given the apparently extensive participation of their state government folks in the efforts) are:
12. NORTH CAROLINA: Go to http://www.nchica.org/HIPAAResources/Samples/Default.asp, and scroll down to: "Analysis of the HIPAA Privacy Rule and Selected North Carolina Statutes 12/11/01". This is the website of NCHICA (the North Carolina Healthcare Information and Communications Alliance, Inc.), a "nonprofit consortium" whose members, the website states, include "national, state and local health agencies". I am also told that participants in creating these preemption analyses included the "state AG's office, the NC DHHS staff, and the UNC Institute of Government". As with Illinois' website, this website requires a click-through agreement to a disclaimer before one can proceed. (These analyses appear to be outdated, however, dating from December 2001).
13. WISCONSIN: See: http://www.hipaacow.org/hipaacow/Docs/Microsoft%20Word%20-%20ch%20146%20%202-25-03.pdf. This is the website of HIPAACOW (the HIPAA Collaborative of Wisconsin), a collaborative effort which includes several public and private entities including the WI Dept Health & Family Services (WIDHFS). But while this analysis isn't posted publicly on a Wisconsin website, I am told by one of the governmental participants that the WIDHFS created several parts of this preemption analysis, and its attorneys approved of the other sections. The analysis itself notes "The workgroup consulted with the Wisconsin Department of Health and Family Services and the analysis has been reviewed by the Department in February 2003."
14. Utah AG offers HIPAA guidance on State Laws (added 11/17/03)
John C. Cody, Esq., NYS Central HIPAA Coordination Project
NYS Office for Technology
State Capitol - PO Box 2062
Albany, NY 12220-0062
Phone: 518/474-0683 john.cody@oft.state.ny.us
Internet: http://www.oft.state.ny.us/hipaa/index.htm----------------------------------------