If there is no HIPAA law on a specific subject – some states have laws specifically for medical privacy, patient access, and other subjects that are either more broadly covered or not regulated at all under HIPAA. The state law is more stringent than federal HIPAA laws.