Which statement best describes the relationship between state and federal privacy laws?

Which statement best describes the relationship between state and federal privacy laws?

• A. State privacy laws always supersede federal privacy laws
• B. Federal privacy laws always supersede state laws
• C. State and federal privacy laws may both apply, with preemption in some areas
• D. There is no interaction between state and federal privacy laws

Answer: (C)

State and federal privacy laws interact in a layered system. Federal laws set nationwide protections for certain data (for example, HIPAA governs protected health information held by covered entities). States can also enact their own privacy protections or regulate data beyond what federal law covers. When both levels apply, you must comply with both, and in areas where a federal rule conflicts with a state rule, federal preemption can occur. Because dual application is common and preemption happens only in certain overlapping areas, the description that both may apply with preemption in some areas is the most accurate.

State and federal privacy laws interact in a layered system. Federal laws set nationwide protections for certain data (for example, HIPAA governs protected health information held by covered entities). States can also enact their own privacy protections or regulate data beyond what federal law covers. When both levels apply, you must comply with both, and in areas where a federal rule conflicts with a state rule, federal preemption can occur. Because dual application is common and preemption happens only in certain overlapping areas, the description that both may apply with preemption in some areas is the most accurate.