The HIPAA privacy rules have a number of disclosure exceptions, but those exceptions are only effective when state law also allows the disclosure. When there is no state-law exception, it is irrelevant that HIPAA would allow the disclosure. One such common situation involves crimes against patients. Continue reading →