When state law protects you more than HIPAA does
HIPAA is a floor, not a ceiling. A state is free to give you more protection, and many do — particularly for mental health information, which several states treat more strictly than HIPAA requires. Where the two conflict, the more protective rule generally governs.
The layers
Three sources of protection, stacked
Applies nationwide to covered entities and their business associates. Sets the minimum standard everywhere.
Several states impose stricter rules on mental health records specifically — tighter disclosure limits, narrower exceptions, or a requirement for written consent where HIPAA would not.
California, Colorado, Virginia, Connecticut and a growing list of others. These generally exempt HIPAA-covered information, so they matter for data held outside your clinical record.
The exemption that surprises people
Most state consumer privacy acts contain a HIPAA carve-out. If a record is already protected health information, the state act generally steps aside rather than layering a second regime on top.
The practical consequence: a Californian who asks an ESA provider to delete their clinical record under the CCPA will usually be told the exemption applies. The deletion right is real, but it does not reach a record that HIPAA and state licensing law require to be retained.
Where state consumer law still reaches
Marketing lists and email preferences
Website analytics and advertising identifiers
Support tickets not part of the clinical record
Account data held for convenience
Anything collected before you became a patient
Where state law is genuinely stricter
These are the situations in which knowing your state law is worth more than knowing HIPAA.
Mental health specifically
Several states require written consent for disclosures that HIPAA would permit under treatment, payment or operations.
Minors and independent consent
State law decides when a minor controls their own mental health record, and it varies considerably by age and service.
Retention periods
Set by state licensing law rather than HIPAA, which is why the answer to “how long is it kept” depends on where your clinician is licensed.
Private rights of action
HIPAA gives you none. Some state statutes do, which is the route to compensation where HIPAA offers only a regulatory complaint.
Frequently asked
Does my state give me more privacy protection than HIPAA?
Possibly. HIPAA is a federal floor, and states may impose stricter rules. Several are notably stricter about mental health information in particular.
Can I use the CCPA to delete my ESA record?
Usually not. Most state consumer privacy acts exempt HIPAA-covered information, so the deletion right does not reach a clinical record that must be retained.
Which law wins where they conflict?
Generally the more protective of the two. HIPAA sets a minimum rather than a ceiling, so a stricter state rule is not displaced by it.
Can I sue under state privacy law?
Some state statutes provide a private right of action where HIPAA does not. This is often the only route to compensation rather than a regulatory outcome.
Does state law decide how long my record is kept?
Typically yes. Clinical retention periods are set by state licensing law, which is why the answer varies depending on where your clinician is licensed.
What if I moved states after my evaluation?
The law applying to the clinician who holds the record is generally the relevant one. A new letter for a new state would be governed by that state’s rules.
Your privacy is not an afterthought here
Start a free evaluation and see exactly what your landlord will — and will not — receive.
Start free evaluation All privacy topics