Beyond HIPAA: Navigating the ‘more stringent’ standard

In light of the February 16, 2026, deadline for covered entities to update their notice of privacy practices (NPP), covered entities should consider “more stringent” state laws that may apply to these updated forms and require compliance. The federal Health Insurance Portability and Accountability Act (HIPAA) privacy rule sets the floor for privacy protections and individuals’ rights when it comes to their individually identifiable health information but allows for states to enact stronger or more stringent requirements regarding the privacy of patient health information.

Employers’ obligations

When federal law sets the ground floor for compliance and allows states to set more demanding requirements—as in the case with HIPAA—it’s commonly known as “floor preemption.” So, HIPAA leaves the door open for state law to impose more demanding standards in certain circumstances. (This also stands in contrast to “ceiling preemption,” when federal law sets the maximum standards and precludes any more restrictive—or differently restrictive—state laws from having effect.)