HRS §323B-3
When federal health privacy rules override state law
This section says that if a health provider or business partner follows federal privacy rules for using or sharing health information, getting patient permission, or reporting a data breach, they are considered to have followed Hawaii's state laws on those topics. It applies to individually identifiable health information.
The statute, as written — Privacy of individually identifiable health information
(a) Notwithstanding any law to the contrary, any use or disclosure of individually identifiable health information by any covered entity or business associate that is permitted by 45 Code of Federal Regulations part 164, subpart E, shall be deemed to comply with all state laws relating to the use, disclosure, or confidentiality of such information. (b) Notwithstanding any law to the contrary, an authorization for release of individually identifiable health information that complies with 45 Code of Federal Regulations section 164.508 shall be deemed to comply with all state laws relating to individual authorization. (c) Notwithstanding any law to the contrary, any notice of breach of unsecured protected health information that complies with 45 Code of Federal Regulations part 164, subpart D, shall be deemed to comply with all state laws relating to notice of breach of protected health information.
LawTrove is not legal advice. The summary above is a computer-generated restatement — the authoritative text is the official version linked above.