HIPAA Authorization Requirements by State: What's Different?
HIPAA sets one federal floor for medical privacy, but it isn't the whole picture. A number of states layer their own, stricter authorization rules on top of the federal baseline, sometimes for medical records generally, and more often for specific categories like mental health, HIV status, or genetic information. When a state law is more protective of privacy than HIPAA, the state law controls for that requirement.
Table of Contents
Why Does HIPAA Allow States to Add Their Own Rules?
HIPAA is a floor, not a ceiling, and federal regulation says so directly. Under 45 CFR § 160.203, a HIPAA standard generally overrides ("preempts") a contrary state law, but § 160.203(b) carves out an exception: a state law is not preempted if it relates to the privacy of health information and is "more stringent" than the HIPAA standard it would otherwise conflict with. A separate provision, 45 CFR § 160.202, defines what "more stringent" means: in practice, a state law qualifies if it gives individuals stronger privacy protections, broader access to their own records, or requires consent in situations where HIPAA alone would not.
This is why a document that fully satisfies HIPAA can still fall short of what a particular state expects. The federal rule tells providers what they must do at minimum. It was never designed to be the only word on the subject, and lawmakers in many states have added their own layer of protection, usually for records they consider unusually sensitive.
The result is that requirements can vary noticeably depending on where you live and what kind of records you're trying to authorize someone to access. Below are the three patterns that variation tends to follow.
Trend 1: States With Their Own General Medical Privacy Law
A handful of states have passed a broad medical privacy statute that applies to health records generally, not just one sensitive category. In these states, that law — not HIPAA alone — sets the baseline for what a valid authorization has to include.
California is the clearest example. Its Confidentiality of Medical Information Act adds requirements that go beyond the federal rule, including specific formatting expectations and a shorter default validity period than many people assume applies everywhere. A HIPAA-only authorization used in California may not, on its own, satisfy the state's additional requirements.
Minnesota takes a similar approach through its Health Records Act, which sets a general written-consent requirement for health records broadly, rather than limiting itself to one type of sensitive information. That's actually somewhat unusual — most states that add extra protection focus on a specific record category rather than covering health records across the board.
What this means for you: if you live in a state with its own general medical privacy law, don't assume a generic form is enough. Look for language confirming the form accounts for your state's specific requirements, not just the federal ones.
Trend 2: States That Single Out Sensitive Record Categories
This is the more common pattern nationally. Rather than one broad statute, most states add extra protection for specific categories of records they consider especially sensitive: most often mental health and psychotherapy notes, HIV and communicable disease status, substance use treatment records, and genetic information.
A few examples of how this plays out:
- Texas has a detailed mental health records statute that covers authorized disclosure, required disclosure, and how someone can revoke consent for mental health records specifically — separate from how the state treats general medical records.
- New York requires a specific, state-approved release for HIV-related information. A general HIPAA authorization is not sufficient on its own to release HIV records in New York; state health officials require the release to meet a distinct format.
- Illinois maintains three separate laws covering mental health records, HIV/AIDS-related information, and genetic information respectively, each with its own consent requirements, rather than relying on one general statute.
Substance use treatment records add another layer on top of this: federal law (a rule separate from HIPAA, found at 42 C.F.R. Part 2) already requires its own specific consent for many federally assisted substance use programs, regardless of what state law says. Where a state also has its own substance use confidentiality rule, that can mean satisfying two separate consent standards at once.
What this means for you: if you're trying to authorize the release of mental health, HIV, substance use, or genetic records, check whether your state calls for a separate, specifically worded authorization rather than a general one.
Trend 3: Fewer States Requiring Extra Signing Formalities
Beyond what has to be authorized, a smaller number of states have addressed how certain sensitive-record authorizations must be signed. This trend is real, but it's narrower than the first two, tied specifically to mental health records in the states that have it, and currently moving toward fewer formalities rather than more.
Illinois offers the clearest, most current example. Its Mental Health and Developmental Disabilities Confidentiality Act required a witnessed signature for mental health record authorizations for years. That requirement was repealed in 2025, reflecting a broader shift toward simplifying consent formalities rather than adding to them.
North Carolina takes a different approach for certain mental health and substance use records: it allows oral consent given in the presence of a witness the client chooses, as an alternative to a written signature — rather than requiring a witness on top of a written form.
What this means for you: don't assume that every state requires a witness or notary for a HIPAA-related authorization. Most don't, and where a formality like this exists, it tends to apply narrowly to mental health records rather than to authorizations in general.
How to Know If Your State Adds Anything Extra
With this much variation, the most reliable approach is usually the simplest one:
- Ask the provider or facility directly whether they require anything beyond a standard HIPAA authorization for the type of record you're trying to release, especially for mental health, HIV, substance use, or genetic information.
- Check whether the record falls into a sensitive category. General medical records are far less likely to need special handling than the categories covered in Trend 2.
- Default to a form built to meet the stricter standard. A form designed to accommodate both the federal baseline and common state-level additions is more likely to be accepted without a second round of paperwork.
What This Means for Filling Out Your Form
The safest approach is a HIPAA authorization form that adjusts to the state you select, rather than a one-size-fits-all template. LegalNature's HIPAA authorization form is built to reflect state-specific requirements based on the state you choose, so you're not left guessing whether a generic form covers what your state expects.
If what you actually need is the authority to make medical decisions on someone's behalf — not just access to their records — that's a different document. A medical power of attorney covers decision-making authority, while a HIPAA authorization only covers information sharing.
Frequently Asked Questions
Is HIPAA the same in every state?
No. HIPAA sets a federal minimum, but states can — and many do — pass stricter privacy laws. Where a state law offers more protection than HIPAA, the state law applies for that specific requirement.
What happens if a state law is stricter than HIPAA?
The stricter state law controls for that requirement. Providers and patients in that state need to follow the state standard, not just the federal minimum, when it comes to that particular rule.
Conclusion
HIPAA gives every state the same starting point, but plenty of states have built on top of it — whether through a broad state privacy law, sensitive-category carve-outs for records like mental health and HIV status, or occasional signing formalities that are becoming less common, not more. The safest way to navigate this is to treat HIPAA as the floor, not the finish line, and to use a form built to reflect your state's specific requirements. LegalNature's HIPAA authorization form adjusts automatically based on the state you select, so you can create a document built for where you actually live.