When your state law beats HIPAA

A clinic owner who has done the work reads the whole Privacy Rule, builds the program, and concludes they are compliant. Then they open a second location across a state line, and a family in the new state asks for records, and the timeline they have trained everyone on is wrong. ABAWiser publishes the state facility and HIPAA rules behind this in its state by state facility and HIPAA guides.

HIPAA is a floor, not a ceiling, and a clinic that has only ever read the floor does not know how high the walls are in the states it operates in.

The rule, in one paragraph

A standard, requirement, or implementation specification of the HIPAA rules that is contrary to a provision of state law preempts that state law (45 CFR 160.203). “Contrary” has a definition: it would be impossible to comply with both, or the state law stands as an obstacle to the federal purpose (45 CFR 160.202).

“HIPAA is a floor, not a ceiling, and a clinic that has only ever read the floor does not know how high the walls are in the states it operates in”

But the preemption has exceptions, and the one that matters most is this: state law that is more stringent than the federal requirement is not preempted. It controls (45 CFR 160.203(b)).

“More stringent” also has a definition (45 CFR 160.202), and it is worth reading rather than summarizing loosely: broadly, a state provision is more stringent where it prohibits or restricts a use or disclosure that HIPAA would permit, gives individuals greater rights of access or amendment or more information about uses and disclosures, requires more from an authorization or consent, keeps records or produces reports that are more extensive, or otherwise provides greater privacy protection for the individual.

So the operating rule for a clinic is short: where state law protects the client more, follow the state. Where HIPAA protects them more, follow HIPAA. You do not choose between the rulebooks; you obey the stricter of the two, requirement by requirement. HHS’s own plain-language answer to “how do I know if a state law is more stringent” lands on the same test: greater protection, or greater rights, for the individual.

Two other exceptions exist for completeness: state laws HHS has granted an exception to, and state laws about public health reporting, oversight of health plans, and certain regulatory needs (45 CFR 160.203(a), (c), (d)).

Why ABA clinics are unusually exposed

Plenty of health care businesses can get away with reading HIPAA once and calling it done. ABA clinics are a worse bet for that approach, for reasons specific to the service:

The clients are children. Almost everything about who can consent, who can see the record, and who can speak for the client runs through state law governing minors, not through HIPAA’s own text. HIPAA defers to the state on exactly this question (45 CFR 164.502(g)), which is the subject of a dedicated article in this cluster.

Sessions happen in homes, not just clinics. Home-based ABA puts session notes, recordings, and sometimes live video in rooms the clinic does not control, often with other household members present. States vary in how they treat recording consent and who else in that home has a stake in what gets documented.

Supervision runs over video. BCBA oversight of RBTs frequently happens by video review or live video supervision, which raises its own state-by-state questions about consent to record and who may be present on either end of the call.

Clinics expand across state lines faster than their paperwork does. ABA groups grow by adding locations and telehealth clients in new states, and the growth usually outruns the compliance review. The program that was correct on day one quietly becomes wrong for a new state on day two hundred.

Any one of these would be a reason to check state law. All four together make it a standing exposure, not a one-time question to close out.

Where states actually go further

This page will not tell you your state’s answer, and you should be suspicious of any page that claims to, because these change and they change unevenly. What it can give you is the map of where to look, because the categories are consistent.

Breach notification. This is the one that bites hardest and fastest. HIPAA gives you up to 60 days to notify individuals (45 CFR 164.404). Some states are considerably shorter, some require notification to the state attorney general, and some define breach and personal information differently than HIPAA does, which means an event that is not a HIPAA breach can still be a state-reportable one. A multi-state operator that has trained its team on “60 days” has trained them on the federal floor, which is the wrong number in some of their states. A growing, verified table of each state’s actual deadline and regulator duty lives here; this page will not restate any of those figures, so they only ever have one home.

Minor consent and parental access. The heart of it for ABA. HIPAA generally treats a parent as the personal representative of an unemancipated minor, but it explicitly defers to state law in defined situations (45 CFR 164.502(g)), and state law is where the actual answer lives: at what age a minor may consent to certain care themselves, and what that does to the parent’s access to those records. This varies enormously, it interacts with custody, and it is exactly the question that arrives on a bad afternoon. A dedicated article covers this one in depth, including the three situations where a parent is not automatically in charge of the record and worked examples from four states.

Mental and behavioral health records. Many states impose heightened protections on mental health information beyond HIPAA’s baseline (HIPAA’s own special category, psychotherapy notes, is narrow and, as we have covered, almost never reaches ABA session notes). State law may reach further and cover behavioral health records more broadly, which is directly relevant to your file.

Records retention. HIPAA’s six-year rule (in 164.316 and 164.530(j)) governs compliance documentation, not clinical records. How long you keep the clinical chart is a state and payer question, and states commonly require longer for minors, often measured from the age of majority rather than the date of service.

Right of access timelines and fees. HIPAA says 30 days with one 30-day extension (45 CFR 164.524). Some states are faster, and some cap copying fees below what HIPAA’s reasonable cost-based standard would allow. Faster and cheaper are more protective, so the state wins.

State privacy statutes generally. A growing number of states have consumer or health privacy laws with their own reach, and some cover health data that HIPAA does not, held by entities HIPAA does not cover. Whether any of them touch a covered ABA clinic is a state-specific question, and the answer changes.

State recording-consent law, the question of who has to agree before a session can be recorded, now has its own article. State consumer health data law, and what it adds on top of HIPAA for data your website collects before someone is a patient, is covered here.

What multi-state actually means for your program

The instinct of a growing operator is to run one program: one policy set, one training, one breach procedure. That instinct is right about structure and wrong about content.

Build one program, with the strictest applicable rule per requirement, per state, written into the policies. Where the difference is trivial (a shorter access timeline), adopt the strictest rule everywhere; a clinic that answers every records request in 15 days is compliant in all fifty states and has one number to train. Where the difference is substantive (minor consent rules that genuinely differ, breach notification to a specific attorney general), the policy has to branch, and the branch has to be written down rather than living in someone’s memory of what a lawyer once said.

And keep a state register: for each state you operate in, the breach timeline and recipients, the minor consent posture, the records retention period, and the access timeline. Four rows per state. That document costs an afternoon with a local lawyer and it is the difference between an answer and a guess on the day it matters.

The honest limits of this page

We will not tell you what your state requires, because a page that tried would be wrong somewhere and would be wrong quietly, which is the worst way to be wrong. Two states change a rule and the page becomes a trap for the clinics that trusted it.

What we can tell you is the shape of the problem: HIPAA is the floor, more protective state law controls, and four or five categories are where states routinely climb higher. Take that list to a lawyer in each state you operate in, ask those specific questions, write the answers down, and you will have spent a few hours to close the single largest blind spot in a growing ABA operation.