241

Preemption decision work sheet

How can you deal with the needed crosswalking of HIPAA with local laws? There are only two ways I can
see. First, the Practice Organization of the American Psychological Association and APAs insurance sales
arm, APAIT, sell an online continuing education program which allows you to print out state-specific HIPAA
forms. See <http://www.apapractice.org/>. This is the result of an extensive crosswalking effort and was created by
lawyers and psychologists but still contains a strong disclaimer. Pricing begins at $175 for those members of
APA who pay the clinicians special assessment and rise from there to $575 for others. Second, consider my
approach in which I have made two simplifying assumptions which seem justified:
1.
You already know a great deal about your local laws since you were trained there, have attended
ethics and legal issues continuing education programs, and had lively discussions with your colleagues.
2.
You are already in compliance with your local rules. Your procedures and client education materials
follow your rules.
Therefore, you can read the HIPAA rules and compare them with your current practices and make
preemption decisions.
This form is not meant to be the definitive method for evaluating the circumstances of a conflict between
state laws and HIPAA nor a way to assure an absolutely correct conclusion. It is meant to help you collect the
necessary information and then think through the issues. As you proceed take all the time and writing space
you need.
Preemption decision work sheet for therapists
1.

Background
a.

What is the issue in conflict? Summarize and clarify.

b.

What has been the procedure in the past in this office or agency (if relevant)?

c.
What does the HIPAA privacy rule say about the issue? (Include citation(s) to a section(s) of
HIPAA.) Note: HIPAA applies only to CEs (Covered Entities) and state law may apply to all kinds of
clinicians, non-CEs (such as all psychologists) or non-CE parts of a hybrid entity.
d.
What does the state law or regulation say? (Include citation(s) as necessary) You may need to
look at each part, section, or even sentence. Some examples are laws and regulations on medical records,
genetic testing, HIV, mental health/substance abuse, pharmacy, and workers compensation. Also look at
your states licensing law for your profession.
e.
What does your professions Code of Ethics say about this issue? (where relevant). The
American Psychological Associations code has been revised for June 2003 and is online at
<http://www.apa.org/ethics/> The code of the National Association of Social Workers is at
<http://www.socialworkers.org/pubs/code/default.asp> and the code of the American Counseling Association is at

<http://www.counseling.org/resources/ethics.htm>

2.

Exceptions to preemption

Generally, HIPAA is seen as preempting state law but there are exceptions (restated here for therapists). Does
this issue fit any of these four?
a.
The issue relates to some kind of public health activities such as reporting, surveillance,
investigation, intervention or compliance/enforcement of health plans or other CEs.
q
No, the issue doesnt and so HIPAA does not apply, local laws do.
Note: The exception below is very like the one above but is subtly legally different.
b.
The Secretary of Health and Human Services has granted an exception and so you should
follow the state law. These exceptions include when it's necessary to prevent fraud and abuse; ensure state
regulation of insurance; permit state reporting of health care delivery or costs; serve compelling public
health, safety or welfare needs; address a compelling reason that outweighs the privacy intrusion; or
regulate controlled substances.
q
No exception has been made and so HIPAA does not apply, local laws do.
c.

The state laws and HIPAA are contrary in that:

q
it is not possible to comply with both OR
q
the state law is an obstacle to achieving the purposes and intent of HIPAA.
q
They are not contrary and so HIPAA applies.

d.
State law or regulation is more stringent (more protective) than the Privacy Rule.
Does the state law do any of these six things?
1.
Prohibits or restricts the use or disclosure of PHI in circumstances where HIPAA would
allow such use or disclosure?
q Yes q No
Note that this rule does not apply when disclosure is to the client or where the Secretary of
DHHS has decided the disclosure is necessary for HIPAA.
2.
Gives greater rights of access or amendment to the client?
q Yes q No
Note that this does not apply to state laws that require you to release information about a
minor to parents. For example, if your local laws require you to notify a parent before providing treatment to
a minor, HIPAA does not take precedence.
3.
Provides more information to the client about the use or disclosure of PHI or the clients
rights and remedies concerning such use or disclosure?
q Yes q No

4.
When it concerns the release of information through consent or authorizing the
disclosure, the local law does one or more of these:
q
specifies a narrower scope or duration of the release.
q
reduces the coercion involved in obtaining the consent or authorization.
q
erects a barrier or obstacles to others attempts to obtain PHI.
q
increases privacy protection for individuals in this area.
q Yes q No
5.
Requires more detailed information to be included in the records or that you maintain
them for a longer period?
q Yes q No

6.
Provide greater privacy protection to the individual in some other ways?
q Yes q No
If any of these six are true - you answered yes - HIPAA does not apply.
3.

Decision or Disposition
q

This issue does fit one or more of the exceptions so state law applies.

This issue does not meet one of the exceptions so HIPAA applies.

q
issue to:
q
q
q
q

I cannot meet both HIPAA and state law and I cannot decide what to do so I am referring the
My legal counsel
My professional organization
My state agency:
Other: _____________________________________________

_________________________________

__________________________

Privacy officer - Name

Date

Follow up:
_________
Date

_________
Date

_________
Date

_____________________________ __________________________
Procedure or Decision

Signature

_____________________________ __________________________
Procedure or Decision

Signature

_____________________________ __________________________
Procedure or Decision

Signature