When does state privacy law supersede HIPAA?

State privacy laws can supersede HIPAA when they provide greater protection for individuals' health information. For instance, if a state law grants patients more rights regarding their medical records or imposes stricter requirements on the disclosure of health information, that law takes precedence over HIPAA. Additionally, certain states may have specific laws related to mental health or substance abuse records that exceed HIPAA's protections. However, if a state law is less stringent than HIPAA, HIPAA's provisions apply.