State law guide
HIPAA and state health privacy laws, state by state
HIPAA is the federal floor for protecting patient information. Many states add their own rules on top: broader definitions, shorter breach deadlines, attorney general reporting and their own penalties. When a state law is more protective than HIPAA, you generally have to follow both.
01 / COMPARE
State breach rules at a glance
How each state's breach notification law treats health data, how fast individuals must be told, and when the attorney general must be notified. HIPAA's own rules apply in every state.
| State | Health data in breach law | Notice to individuals | Attorney general notice |
|---|---|---|---|
| Oklahoma | Not listed (biometrics and ID numbers are) | Without unreasonable delay | 500+ residents, within 60 days of notifying residents |
| Texas | Yes, plus Chapter 181 (HB 300) | Within 60 days | 250+ residents, within 30 days |
| California | Yes, plus CMIA and 15-business-day facility rule | Most expedient time, without unreasonable delay | Sample notice if 500+ residents |
| Arkansas | Yes, including biometrics | Most expedient time, without unreasonable delay | 1,000+ individuals, within 45 days |
| Kansas | Not listed | Most expedient time, without unreasonable delay | Not required (credit bureaus if 1,000+) |
| Missouri | Yes, medical and health insurance | Without unreasonable delay | 1,000+ consumers, without unreasonable delay |
| Florida | Yes, medical and health insurance | Within 30 days | 500+ residents, within 30 days |
| Colorado | Yes, medical and health insurance ID | Within 30 days | 500+ residents, within 30 days |
| Illinois | Yes, plus BIPA and mental health law | Most expedient time, without unreasonable delay | 500+ residents; HIPAA entities within 5 business days of HHS report |
| New York | Yes, since March 2025 | Within 30 days | Any resident notified; HIPAA entities within 5 business days of HHS report |
General information as of November 2026, not legal advice. More states are being added.
02 / STATE GUIDES
Pick your state
Oklahoma
SB 626 update, attorney general reporting and the reasonable safeguards defense.
Read the guide →Texas
HB 300 training, a broader covered entity definition and a 30-day AG deadline.
Read the guide →California
CMIA lawsuits, the 15-business-day facility rule and AG notice.
Read the guide →Arkansas
Medical and biometric data covered, 45-day AG notice and record keeping.
Read the guide →Kansas
Why HIPAA drives patient record breaches, and what Kansas still covers.
Read the guide →Missouri
Medical and insurance data covered, AG notice and penalties up to $150,000.
Read the guide →Florida
30-day notice, state reporting for 500+ and the offshore storage ban.
Read the guide →Colorado
30-day deadlines, AG notice even under HIPAA and biometric rules.
Read the guide →Illinois
BIPA lawsuits, mental health confidentiality and a 5-business-day AG rule.
Read the guide →New York
The new 30-day deadline and AG notice after every HHS report.
Read the guide →03 / FAQ
Frequently asked questions
Does HIPAA override state privacy laws?
HIPAA preempts state laws that conflict with it, except when the state law is more stringent, meaning it gives patients more privacy protection or more rights. In that case you follow both, which in practice means meeting the stricter rule.
Which state's law applies after a breach?
Breach notification laws generally follow where the affected people live. A practice in one state can owe notices under several state laws if it has patients from other states.
Do we have to notify both HHS and the state?
Often, yes. HIPAA breaches go to HHS and affected individuals, and many states also require notice to their attorney general or other agencies on their own timelines.
What is the best way to prepare?
Keep a current HIPAA risk analysis, encrypt devices and email, train staff, and have an incident response plan that lists every federal and state deadline that could apply to you.
Federal and state rules, handled
Start with the free HIPAA risk assessment, or talk to an analyst about the states you operate in.
