This section describes the interplay between state and federal information sharing laws. Click here to download a PDF of this section.

State Laws Generally

Federal laws allow states some latitude in regulating certain aspects of information sharing; laws on this topic vary from state to state.

For example, while HIPAA establishes a minimum level of privacy protection for health care records, [1] states are free to enact laws that provide greater protections for such records. For example, if a health care provider receives a subpoena for a patient’s records, HIPAA allows the provider to release the records without the patient’s consent if the person seeking the records demonstrates having made a reasonable effort to notify the patient—or if that person obtains a court protective order. [2] However, a state may enact laws or regulations that prohibit health care providers from releasing records upon receipt of a subpoena that is not accompanied by a court order. That is the case in Pennsylvania, where mental health care providers cannot disclose records in response to a subpoena alone. [3]

Both HIPAA and federal drug and alcohol regulations defer to state law concerning the age when a minor (as opposed to the minor’s parent or guardian) controls release of the minor’s records. [4] This deference exists because control of records depends on consent, and consent is dictated by state laws. For example, one state may allow 14-year-olds to consent to records on testing for sexually transmitted diseases and control those records, while another state may limit consent and control to youth who are older than 14.

In addition to deferring to states to determine the age of consent, federal privacy laws apply only to specific entities. For example, the federal drug and alcohol regulations only apply to “federally assisted” programs, which are defined in 42 CFR. § 2.12(b). As a result, states may implement their own laws and regulations to cover non-federally assisted drug and alcohol treatment programs.


Resources on State Laws

[1] 45 C.F.R. § 160.203.

[2] 45 C.F.R. § 164.512(e)(1)(ii) and (v).

[3] 55 Pa. Code § 5100.35(b)(1).

[4] 45 C.F.R. § 164.502(g)(3); 42 U.S.C. § 290dd-2(b); 42 C.F.R. § 2.14(a) and (b).