"Question-and-answer guidance issued by the OCR indicates that auditors will not be looking at state-specific privacy and security rules; they will only be looking at an entity's compliance with HIPAA. However, HIPAA provides that more stringent state laws will preempt HIPAA, so it is important to confirm that the entity complies with the more stringent state laws if applicable."  MORE >>