Is it just me that finds it infuriating that we are expected to comply with complex laws and statutes, but the legislators and regulatory bodies make it so damn hard to decipher what they mean when they speak in legalese? I'm a big proponent of following rules (okay, okay... most of the time... 🤭), but how are we supposed to follow them if we can't even understand what they are asking of us? And if there are multiple laws on the same subject, how the hell do we know which one applies?
When it comes to the interaction between federal and state laws, things can get a bit ~confusing~ to say the least. And this is where preemption comes into play.
So what does this have to do with your private practice? The most striking example is the interaction of HIPAA legislation and the state laws where you practice. HIPAA is federal law, while your state's laws are, well... duh, state law.
Do you know if your state's laws are more strict or more relaxed than HIPAA requirements? (Does your state even have separate laws on the same subject in question?) In any case, which one applies? In a nutshell, the answer is both. This is where a lot of heads start spinning for private practice owners who are new to HIPAA compliance or compliance + policy writing in general. So let's simplify the decision-making tree here:
Federal law = the ground floor
State law = the ceiling
(If you're looking at your screen like I just spoke gibberish and are now thinking, "Leigh, you said you would simplify it, not make it more confusing by talking about floors and ceilings..." Just stick with me for a sec!)
Given the general logic that your beautiful brain is capable of dishing out, we know that the ceiling can't be under the ground floor, right?? So think of it this way... Federal law is the ground floor. The state law, aka the ceiling, can't be lower than the ground floor, aka federal law.
BUT, it can be higher!! Our logical brains also reassure us that the ground floor can't be above the ceiling...
So if state law/ceiling is lower than the federal law/ground floor, we have to use the federal law/ground floor as the reference point. That is the law with which our policies and procedures must comply.
Buuuut, if the state law/ceiling is higher than the federal law/ground floor, we are going to use the ceiling as our reference point and ensure that our policies and procedures comply with the state law.
BOTTOM LINE: Your compliance must at least meet the federal standards, regardless of the state in which you practice. But if state law is more stringent, we are required to meet the higher of the two standards in that state.