42 U.S.C. § 1320d–7 — Effect on State law

(a) General effect (1) General rule Except as provided in paragraph (2), a provision or requirement under this part, or a standard or implementation specification adopted or established under sections 1320d–1 through 1320d–3 of this title, must supersede any contrary provision of State law, including a provision of State law that requires medical or health plan records (including billing information) to be maintained or transmitted in written rather than electronic form. (2) Exceptions A provision or requirement under this part, or a standard or implementation specification adopted or established under sections 1320d–1 through 1320d–3 of this title, must not supersede a contrary provision of State law, if the provision of State law— (A) is a provision the Secretary determines— (i) is necessary— (I) to prevent fraud and abuse; (II) to ensure appropriate State regulation of insurance and health plans; (III) for State reporting on health care delivery or costs; or (IV) for other purposes; or (ii) addresses controlled substances; or (B) subject to section 264(c)(2) of the Health Insurance Portability and Accountability Act of 1996, relates to the privacy of individually identifiable health information. (b) Public health Nothing in this part must be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention. (c) State regulatory reporting Nothing in this part must limit the ability of a State to require a health plan to report, or to provide access to, information for management audits, financial audits, program monitoring and evaluation, facility licensure or certification, or individual licensure or certification.