{"id":15756,"date":"2026-10-06T11:32:50","date_gmt":"2026-10-06T11:32:50","guid":{"rendered":"https:\/\/savethevideo.net\/blog\/?p=15756"},"modified":"2026-10-06T11:44:41","modified_gmt":"2026-10-06T11:44:41","slug":"hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance","status":"publish","type":"post","link":"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/","title":{"rendered":"HIPAA Laws: HHS HIPAA Rules vs State Privacy Laws for Healthcare Compliance"},"content":{"rendered":"<p><strong>Healthcare compliance should start with HIPAA, but it cannot stop there.<\/strong> The U.S. Department of Health and Human Services sets the federal baseline through the HIPAA Rules, while state privacy laws may add stricter duties, shorter deadlines, broader patient rights, or special rules for sensitive data. A compliant healthcare organization must meet both.<\/p>\n<p><strong>TLDR:<\/strong> HIPAA is the federal floor for protecting patient health information, not the ceiling. If a state law gives patients stronger privacy rights or requires faster breach notice, the healthcare organization usually must follow the stricter state rule. For example, a multi-state clinic with 40,000 patients may use one HIPAA privacy program, but still need separate workflows for California, Texas, and Washington. Missing those state rules can turn one incident into several legal violations.<\/p>\n<h2>HHS HIPAA Rules: The Federal Baseline<\/h2>\n<p>HIPAA is enforced by the <strong>HHS Office for Civil Rights<\/strong>, often called OCR. It applies to <strong>covered entities<\/strong> and <strong>business associates<\/strong>. Covered entities include health plans, healthcare clearinghouses, and most healthcare providers that transmit health information electronically. Business associates include vendors that handle protected health information, or <strong>PHI<\/strong>, for covered entities.<\/p>\n<p>The core HHS HIPAA framework has four main parts:<\/p>\n<ul>\n<li><strong>Privacy Rule:<\/strong> Controls how PHI may be used and disclosed.<\/li>\n<li><strong>Security Rule:<\/strong> Requires safeguards for electronic PHI, known as ePHI.<\/li>\n<li><strong>Breach Notification Rule:<\/strong> Sets duties after an impermissible use or disclosure.<\/li>\n<li><strong>Enforcement Rule:<\/strong> Gives OCR authority to investigate and issue penalties.<\/li>\n<\/ul>\n<p>The Privacy Rule gives patients rights to access records, request amendments, request restrictions, and receive an accounting of certain disclosures. The Security Rule requires administrative, physical, and technical safeguards. That means risk analysis, access controls, audit logs, encryption decisions, workforce training, and incident response.<\/p>\n<img loading=\"lazy\" decoding=\"async\" width=\"1080\" height=\"720\" src=\"https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/10\/a-security-and-privacy-dashboard-with-its-status-hipaa-compliance-patient-data-security-safeguards.jpg\" class=\"attachment-full size-full\" alt=\"\" srcset=\"https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/10\/a-security-and-privacy-dashboard-with-its-status-hipaa-compliance-patient-data-security-safeguards.jpg 1080w, https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/10\/a-security-and-privacy-dashboard-with-its-status-hipaa-compliance-patient-data-security-safeguards-300x200.jpg 300w, https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/10\/a-security-and-privacy-dashboard-with-its-status-hipaa-compliance-patient-data-security-safeguards-1024x683.jpg 1024w, https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/10\/a-security-and-privacy-dashboard-with-its-status-hipaa-compliance-patient-data-security-safeguards-768x512.jpg 768w\" sizes=\"auto, (max-width: 1080px) 100vw, 1080px\" \/>\n<p>HIPAA does not require perfection. It requires a documented, reasonable, risk-based program. That distinction matters. A small clinic and a 20-hospital system will not have the same budget or technical stack. Yet both must prove they assessed risks and acted on them.<\/p>\n<h2>State Privacy Laws Can Be Stricter<\/h2>\n<p>State laws often protect the same information HIPAA protects, but they may go further. Some apply to more organizations. Some cover health data that falls outside HIPAA. Some require consent before sharing certain records. Others impose shorter breach reporting timelines.<\/p>\n<p>This is where compliance teams often get frustrated. HIPAA gives one federal structure, but states can add their own rules on top. The catch is simple: <strong>when state law is more protective of patient privacy, it often controls<\/strong>.<\/p>\n<p>Common state-level requirements include:<\/p>\n<ul>\n<li><strong>Shorter breach notice deadlines<\/strong> than HIPAA\u2019s general 60-day outer limit.<\/li>\n<li><strong>Special protection<\/strong> for mental health, HIV, genetic, substance use, or reproductive health records.<\/li>\n<li><strong>Broader definitions<\/strong> of covered health data or consumer health data.<\/li>\n<li><strong>Consent requirements<\/strong> for specific disclosures.<\/li>\n<li><strong>Private rights of action<\/strong>, allowing patients to sue under some laws.<\/li>\n<\/ul>\n<p>For example, California\u2019s <strong>Confidentiality of Medical Information Act<\/strong> adds state medical privacy requirements. Washington\u2019s <strong>My Health My Data Act<\/strong> reaches some consumer health data not covered by HIPAA. Texas has medical privacy rules that can apply to entities beyond traditional HIPAA covered entities. These laws do not replace HIPAA. They sit beside it.<\/p>\n<h2>HIPAA Preemption: Which Rule Wins?<\/h2>\n<p>HIPAA includes a preemption rule. In plain English, that means HIPAA can override contrary state law. But there is a major exception. A state law that is <strong>more stringent<\/strong> than HIPAA usually survives.<\/p>\n<p>A state law may be more stringent if it gives patients greater access, stronger control, more privacy protection, or stricter limits on disclosure. State public health reporting laws may also remain valid. So do many laws tied to child abuse reporting, disease reporting, health oversight, court orders, and vital records.<\/p>\n<p>Here is the practical hierarchy:<\/p>\n<ol>\n<li><strong>Follow HIPAA as the baseline.<\/strong><\/li>\n<li><strong>Check state law for stricter privacy, consent, and breach terms.<\/strong><\/li>\n<li><strong>Apply the rule that gives the patient greater protection.<\/strong><\/li>\n<li><strong>Document the reason for the decision.<\/strong><\/li>\n<\/ol>\n<p>Documentation matters. OCR, state attorneys general, and plaintiffs\u2019 lawyers will all ask the same basic question after an incident: <em>What did you know, when did you know it, and what did you do about it?<\/em><\/p>\n<h2>Where Organizations Get Into Trouble<\/h2>\n<p>Most failures are not caused by one bad policy. They come from gaps between policy and daily work. A privacy notice says one thing. A patient portal does another. A vendor contract is missing. A staff member sends records to the wrong fax number. It drives me crazy that some systems still make staff click through three screens just to confirm a disclosure, adding 20 seconds per request and encouraging shortcuts.<\/p>\n<p>High-risk areas include:<\/p>\n<ul>\n<li><strong>Vendor management:<\/strong> Missing or weak business associate agreements.<\/li>\n<li><strong>Access controls:<\/strong> Shared logins, stale accounts, and weak role limits.<\/li>\n<li><strong>Patient access:<\/strong> Delayed records production or improper fees.<\/li>\n<li><strong>Breach response:<\/strong> Late notices or poor incident documentation.<\/li>\n<li><strong>Marketing and tracking tools:<\/strong> Use of pixels, analytics scripts, or ad tools on patient-facing pages.<\/li>\n<\/ul>\n<img loading=\"lazy\" decoding=\"async\" width=\"1080\" height=\"720\" src=\"https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2025\/09\/a-man-and-a-woman-looking-at-a-computer-screen-ai-compliance-healthcare-ai-audit-transparency.jpg\" class=\"attachment-full size-full\" alt=\"\" srcset=\"https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2025\/09\/a-man-and-a-woman-looking-at-a-computer-screen-ai-compliance-healthcare-ai-audit-transparency.jpg 1080w, https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2025\/09\/a-man-and-a-woman-looking-at-a-computer-screen-ai-compliance-healthcare-ai-audit-transparency-300x200.jpg 300w, https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2025\/09\/a-man-and-a-woman-looking-at-a-computer-screen-ai-compliance-healthcare-ai-audit-transparency-1024x683.jpg 1024w, https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2025\/09\/a-man-and-a-woman-looking-at-a-computer-screen-ai-compliance-healthcare-ai-audit-transparency-768x512.jpg 768w\" sizes=\"auto, (max-width: 1080px) 100vw, 1080px\" \/>\n<p>Tracking tools deserve special attention. HHS has warned that regulated entities may disclose PHI through website and app technologies if data identifies a patient and relates to healthcare. State consumer privacy laws may add more exposure. A hospital website is not just a marketing asset. It can become a compliance risk.<\/p>\n<h2>How to Build a Joint HIPAA and State Law Program<\/h2>\n<p>A serious compliance program should treat HIPAA and state law as one combined duty. Separate binders and scattered spreadsheets create confusion. Use one control map that ties each requirement to a policy, owner, system, and proof.<\/p>\n<p>Start with these steps:<\/p>\n<ul>\n<li><strong>Map data flows:<\/strong> Identify where PHI and state-regulated health data is created, stored, shared, and deleted.<\/li>\n<li><strong>Classify sensitive data:<\/strong> Flag behavioral health, reproductive health, genetic, HIV, and minor records.<\/li>\n<li><strong>Review state coverage:<\/strong> List each state where patients, employees, systems, or vendors are located.<\/li>\n<li><strong>Update contracts:<\/strong> Confirm business associate terms and state-required privacy clauses.<\/li>\n<li><strong>Test breach response:<\/strong> Run tabletop exercises with HIPAA and state deadlines side by side.<\/li>\n<li><strong>Train by role:<\/strong> Billing, front desk, clinicians, IT, and marketing need different examples.<\/li>\n<\/ul>\n<p>Do not train staff only once a year with generic slides. Use short, practical refreshers. A five-minute lesson on misdirected emails may prevent more harm than a 90-minute lecture nobody remembers.<\/p>\n<h2>Compliance Is Also an Operations Issue<\/h2>\n<p>Privacy teams cannot carry this alone. IT controls access. Legal reads state requirements. HR manages workforce sanctions. Marketing manages web tools. Clinical teams handle real patient requests. Compliance fails when these groups work in silos.<\/p>\n<p>Set clear ownership. For example, assign the privacy officer to approve disclosure policies, IT to review audit logs, legal to track state changes, and operations to confirm staff follow workflows. Then report metrics. Useful measures include average patient record response time, percentage of completed access reviews, number of open vendor risks, and days from incident discovery to notice decision.<\/p>\n<img loading=\"lazy\" decoding=\"async\" width=\"1080\" height=\"720\" src=\"https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/04\/a-padlock-rests-on-a-computer-keyboard-online-privacy-concept-data-protection-lock-icon-responsible-internet-use.jpg\" class=\"attachment-full size-full\" alt=\"\" srcset=\"https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/04\/a-padlock-rests-on-a-computer-keyboard-online-privacy-concept-data-protection-lock-icon-responsible-internet-use.jpg 1080w, https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/04\/a-padlock-rests-on-a-computer-keyboard-online-privacy-concept-data-protection-lock-icon-responsible-internet-use-300x200.jpg 300w, https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/04\/a-padlock-rests-on-a-computer-keyboard-online-privacy-concept-data-protection-lock-icon-responsible-internet-use-1024x683.jpg 1024w, https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/04\/a-padlock-rests-on-a-computer-keyboard-online-privacy-concept-data-protection-lock-icon-responsible-internet-use-768x512.jpg 768w\" sizes=\"auto, (max-width: 1080px) 100vw, 1080px\" \/>\n<h2>Bottom Line for Healthcare Compliance<\/h2>\n<p>HIPAA sets the national standard, but state law may raise the bar. The safest approach is to build a privacy program that treats HIPAA as the starting point and state rules as required overlays. That means tracking where patients are located, what type of data is involved, who receives it, and which deadline applies.<\/p>\n<p><strong>A compliant organization does not ask only, \u201cIs this allowed under HIPAA?\u201d<\/strong> It also asks, <strong>\u201cDoes any state law give this patient stronger protection?\u201d<\/strong> That second question is where many costly mistakes are caught before they become investigations, penalties, or loss of patient trust.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Healthcare compliance should start with HIPAA, but it cannot stop there. The U.S. Department of Health and Human Services sets the federal baseline through the HIPAA Rules, while state privacy &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"HIPAA Laws: HHS HIPAA Rules vs State Privacy Laws for Healthcare Compliance\" class=\"read-more button\" href=\"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/#more-15756\" aria-label=\"Read more about HIPAA Laws: HHS HIPAA Rules vs State Privacy Laws for Healthcare Compliance\">Read more<\/a><\/p>\n","protected":false},"author":88,"featured_media":15758,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[495],"tags":[],"class_list":["post-15756","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","no-featured-image-padding"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>HIPAA Laws: HHS HIPAA Rules vs State Privacy Laws for Healthcare Compliance - Save the Video Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"HIPAA Laws: HHS HIPAA Rules vs State Privacy Laws for Healthcare Compliance - Save the Video Blog\" \/>\n<meta property=\"og:description\" content=\"Healthcare compliance should start with HIPAA, but it cannot stop there. The U.S. Department of Health and Human Services sets the federal baseline through the HIPAA Rules, while state privacy ... Read more\" \/>\n<meta property=\"og:url\" content=\"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/\" \/>\n<meta property=\"og:site_name\" content=\"Save the Video Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-06T11:32:50+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-06T11:44:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/10\/red-padlock-on-black-computer-keyboard-hipaa-compliance-patient-data-security-safeguards.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1080\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Jonathan Dough\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jonathan Dough\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\\\/\"},\"author\":{\"name\":\"Jonathan Dough\",\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/#\\\/schema\\\/person\\\/7af40201b760c80578ce2da4a3adf274\"},\"headline\":\"HIPAA Laws: HHS HIPAA Rules vs State Privacy Laws for Healthcare Compliance\",\"datePublished\":\"2026-10-06T11:32:50+00:00\",\"dateModified\":\"2026-10-06T11:44:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\\\/\"},\"wordCount\":1249,\"publisher\":{\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/red-padlock-on-black-computer-keyboard-hipaa-compliance-patient-data-security-safeguards.jpg\",\"articleSection\":[\"Blog\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\\\/\",\"url\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\\\/\",\"name\":\"HIPAA Laws: HHS HIPAA Rules vs State Privacy Laws for Healthcare Compliance - Save the Video Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/red-padlock-on-black-computer-keyboard-hipaa-compliance-patient-data-security-safeguards.jpg\",\"datePublished\":\"2026-10-06T11:32:50+00:00\",\"dateModified\":\"2026-10-06T11:44:41+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/savethevideo.net\\\/blog\\\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\\\/#primaryimage\",\"url\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/red-padlock-on-black-computer-keyboard-hipaa-compliance-patient-data-security-safeguards.jpg\",\"contentUrl\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/red-padlock-on-black-computer-keyboard-hipaa-compliance-patient-data-security-safeguards.jpg\",\"width\":1080,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"HIPAA Laws: HHS HIPAA Rules vs State Privacy Laws for Healthcare Compliance\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/\",\"name\":\"Save the Video Blog\",\"description\":\"Everything you need to know about videos\",\"publisher\":{\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/#organization\",\"name\":\"Save the Video Blog\",\"url\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/02\\\/cropped-stv-logo.png\",\"contentUrl\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/02\\\/cropped-stv-logo.png\",\"width\":500,\"height\":119,\"caption\":\"Save the Video Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/#\\\/schema\\\/person\\\/7af40201b760c80578ce2da4a3adf274\",\"name\":\"Jonathan Dough\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9afc32c64534e0fac8123f418680cd8c214b1c82b9a0e765b34eddf7636ede6d?s=96&d=monsterid&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9afc32c64534e0fac8123f418680cd8c214b1c82b9a0e765b34eddf7636ede6d?s=96&d=monsterid&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9afc32c64534e0fac8123f418680cd8c214b1c82b9a0e765b34eddf7636ede6d?s=96&d=monsterid&r=g\",\"caption\":\"Jonathan Dough\"},\"url\":\"https:\\\/\\\/savethevideo.net\\\/blog\\\/author\\\/jonathand\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"HIPAA Laws: HHS HIPAA Rules vs State Privacy Laws for Healthcare Compliance - Save the Video Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/","og_locale":"en_US","og_type":"article","og_title":"HIPAA Laws: HHS HIPAA Rules vs State Privacy Laws for Healthcare Compliance - Save the Video Blog","og_description":"Healthcare compliance should start with HIPAA, but it cannot stop there. The U.S. Department of Health and Human Services sets the federal baseline through the HIPAA Rules, while state privacy ... Read more","og_url":"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/","og_site_name":"Save the Video Blog","article_published_time":"2026-10-06T11:32:50+00:00","article_modified_time":"2026-10-06T11:44:41+00:00","og_image":[{"width":1080,"height":720,"url":"https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/10\/red-padlock-on-black-computer-keyboard-hipaa-compliance-patient-data-security-safeguards.jpg","type":"image\/jpeg"}],"author":"Jonathan Dough","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Jonathan Dough","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/#article","isPartOf":{"@id":"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/"},"author":{"name":"Jonathan Dough","@id":"https:\/\/savethevideo.net\/blog\/#\/schema\/person\/7af40201b760c80578ce2da4a3adf274"},"headline":"HIPAA Laws: HHS HIPAA Rules vs State Privacy Laws for Healthcare Compliance","datePublished":"2026-10-06T11:32:50+00:00","dateModified":"2026-10-06T11:44:41+00:00","mainEntityOfPage":{"@id":"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/"},"wordCount":1249,"publisher":{"@id":"https:\/\/savethevideo.net\/blog\/#organization"},"image":{"@id":"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/#primaryimage"},"thumbnailUrl":"https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/10\/red-padlock-on-black-computer-keyboard-hipaa-compliance-patient-data-security-safeguards.jpg","articleSection":["Blog"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/","url":"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/","name":"HIPAA Laws: HHS HIPAA Rules vs State Privacy Laws for Healthcare Compliance - Save the Video Blog","isPartOf":{"@id":"https:\/\/savethevideo.net\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/#primaryimage"},"image":{"@id":"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/#primaryimage"},"thumbnailUrl":"https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/10\/red-padlock-on-black-computer-keyboard-hipaa-compliance-patient-data-security-safeguards.jpg","datePublished":"2026-10-06T11:32:50+00:00","dateModified":"2026-10-06T11:44:41+00:00","breadcrumb":{"@id":"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/#primaryimage","url":"https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/10\/red-padlock-on-black-computer-keyboard-hipaa-compliance-patient-data-security-safeguards.jpg","contentUrl":"https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2026\/10\/red-padlock-on-black-computer-keyboard-hipaa-compliance-patient-data-security-safeguards.jpg","width":1080,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/savethevideo.net\/blog\/hipaa-laws-hhs-hipaa-rules-vs-state-privacy-laws-for-healthcare-compliance\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/savethevideo.net\/blog\/"},{"@type":"ListItem","position":2,"name":"HIPAA Laws: HHS HIPAA Rules vs State Privacy Laws for Healthcare Compliance"}]},{"@type":"WebSite","@id":"https:\/\/savethevideo.net\/blog\/#website","url":"https:\/\/savethevideo.net\/blog\/","name":"Save the Video Blog","description":"Everything you need to know about videos","publisher":{"@id":"https:\/\/savethevideo.net\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/savethevideo.net\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/savethevideo.net\/blog\/#organization","name":"Save the Video Blog","url":"https:\/\/savethevideo.net\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/savethevideo.net\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2021\/02\/cropped-stv-logo.png","contentUrl":"https:\/\/savethevideo.net\/blog\/wp-content\/uploads\/2021\/02\/cropped-stv-logo.png","width":500,"height":119,"caption":"Save the Video Blog"},"image":{"@id":"https:\/\/savethevideo.net\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/savethevideo.net\/blog\/#\/schema\/person\/7af40201b760c80578ce2da4a3adf274","name":"Jonathan Dough","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/9afc32c64534e0fac8123f418680cd8c214b1c82b9a0e765b34eddf7636ede6d?s=96&d=monsterid&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/9afc32c64534e0fac8123f418680cd8c214b1c82b9a0e765b34eddf7636ede6d?s=96&d=monsterid&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9afc32c64534e0fac8123f418680cd8c214b1c82b9a0e765b34eddf7636ede6d?s=96&d=monsterid&r=g","caption":"Jonathan Dough"},"url":"https:\/\/savethevideo.net\/blog\/author\/jonathand\/"}]}},"_links":{"self":[{"href":"https:\/\/savethevideo.net\/blog\/wp-json\/wp\/v2\/posts\/15756","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savethevideo.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savethevideo.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savethevideo.net\/blog\/wp-json\/wp\/v2\/users\/88"}],"replies":[{"embeddable":true,"href":"https:\/\/savethevideo.net\/blog\/wp-json\/wp\/v2\/comments?post=15756"}],"version-history":[{"count":1,"href":"https:\/\/savethevideo.net\/blog\/wp-json\/wp\/v2\/posts\/15756\/revisions"}],"predecessor-version":[{"id":15788,"href":"https:\/\/savethevideo.net\/blog\/wp-json\/wp\/v2\/posts\/15756\/revisions\/15788"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/savethevideo.net\/blog\/wp-json\/wp\/v2\/media\/15758"}],"wp:attachment":[{"href":"https:\/\/savethevideo.net\/blog\/wp-json\/wp\/v2\/media?parent=15756"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savethevideo.net\/blog\/wp-json\/wp\/v2\/categories?post=15756"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savethevideo.net\/blog\/wp-json\/wp\/v2\/tags?post=15756"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}