Applicable Privacy Laws, Regulations, and Standards
The legal stack
Place HIPAA within a layered framework. The Privacy, Security, Breach Notification, and Enforcement Rules sit in 45 CFR Parts 160 and 164; HITECH added direct business-associate obligations, breach notification, and stronger penalties. Sector overlays matter: 42 CFR Part 2 governs federally assisted substance use disorder programs and generally requires patient-specific consent for disclosure - including to other treating providers - plus redisclosure limits. Candidates should also be able to place GINA (genetic information), FERPA (education records), ADA confidentiality provisions, state medical-record and breach statutes, state minor-consent laws, and Medicare Conditions of Participation patient-rights requirements.
Preemption
HIPAA is a floor. A contrary state law is preempted unless it is "more stringent" as defined in 45 CFR 160.202–160.203, or a statutory exception applies. "More stringent" is a term of art favoring greater privacy protection or greater individual access - a state law that merely differs is not automatically preempted, and a state law that weakens protection does not survive.
Traps
Assuming a HIPAA authorization satisfies Part 2; assuming HIPAA preempts public health or abuse reporting; assuming state law adds nothing because HIPAA exists. Also common: confusing a security standard with a privacy statute, or treating guidance as if it carried the force of regulation.
Rule of thumb
Identify the data type first, then the governing law: SUD records → Part 2; genetic information → GINA; ePHI → Security Rule; then run the preemption analysis. Worked example: a Part 2 program asked to send records to a specialist still needs Part 2-compliant consent unless a specific exception applies.