B. State Privacy Law

In addition to federal provisions, a significant body of state law governs the privacy of health information. Most states have specific laws governing mental health records, HIV status, and substance use information. These laws are typically more stringent than their federal counterparts, such as HIPAA. Given the amount of state-specific variation in privacy laws, it is important to consult local legal experts with knowledge of privacy laws in the jurisdiction where you are working to determine how these laws affect your ability to share information.

The Relationship between Federal and State Privacy Laws:

HIPAA and Part 2 set privacy floors. This means that federal law does not supersede state law when state health privacy law provisions impose more stringent requirements, standards, or implementation specifications. In many instances, state law governing mental health records will be more restrictive than HIPAA. State laws governing substance-use information frequently mirror or explicitly codify Part 2.

It is beyond the current scope of this toolkit to provide a comprehensive summary of state medical privacy laws. Click A Quick Guide to State Laws on Sensitive Health Information to read a short summary on  state laws that apply to mental health, substance use, and HIV.

Click on these Additional Resources:

  1. Health Information Security & Privacy Collaboration: This link provides  resources, analytic tools, and a best practices report  produced by the  ”Harmonizing State Privacy Law Collaborative,” which was formed by the federal government to look at variations in state laws’ impact of health information exchange
  2. Your Medical Rights: The Center on Medical Record Rights and Privacy, the Health Policy Institute at Georgetown University provides state-by-state guides to laws governing healthcare consumers’ right to access and amend personal health records in each state.
  3. The State of Health Privacy (2002): Volume I and Volume II provide summaries and links to state health privacy laws.

 Privacy of Criminal Justice Information:

In addition to privacy of health information, it is also important to recognize that information about a person’s involvement in the criminal justice system is also sensitive and protected by law. Only certain information is considered public information. Disclosure of involvement with the criminal justice system can affect many facets of a person’s life, including employment, education, and housing. It can also influence a healthcare provider’s willingness to provide care. It is imperative to factor in the consequences of disclosing criminal justice information when designing an information sharing initiative.

Helpful Resources:

  • Compendium of State Privacy and Security Legislation (2002): The Bureau of Justice Statistics (BJS) provides an overview of State legislation governing the privacy, security, maintenance, and dissemination of criminal history records.
  • Click here to read the Legal Action Center report on the challenges disclosure of criminal records can create for people reintegrating into the community from prison.