How do HIPAA and state privacy laws interact for PA psychology practices?

• A. HIPAA governs privacy and security of PHI; psychologists must comply with HIPAA and state privacy laws.
• B. State privacy laws are irrelevant if HIPAA exists.
• C. HIPAA does not apply to mental health records; only other medical fields.
• D. Privacy is not protected in PA psychology practice.

Answer: (A)

Privacy protections for a psychologist’s records come from two sources working together. HIPAA sets the national privacy and security standards for protected health information (PHI), outlining how PHI can be used, when it can be disclosed, and the rights patients have to access and control their information. In Pennsylvania, state confidentiality laws and professional ethics add extra layers of protection, and these state rules can impose stricter limits on disclosures, specific consent requirements, and additional duties around record handling and breach responses.

So, the practice must follow both: HIPAA as the baseline plus any stronger state protections. When state rules are more protective, they strengthen the overall privacy framework; when they align with HIPAA, they reinforce each other. This is why the correct approach is that psychologists must comply with HIPAA and state privacy laws.

Choices suggesting that state laws are irrelevant, that HIPAA doesn’t apply to mental health records, or that privacy isn’t protected in PA are not accurate; HIPAA does cover mental health PHI, and PA has its own confidentiality safeguards in place.