In addition, the Health Insurance Portability and Accountability Act (HIPAA) does not preempt the state law and regulation, because they are more stringent. HIPAA doesn’t require patient consent for disclosures made by a health provider to an external entity such as a managed care company "for the purposes of payment, treatment, or health care operations," according to the letter.