State data privacy guide
State health-data privacy and healthcare payment security.
Build a state-specific privacy review around your healthcare payment data, the people it concerns, and the systems that receive it.
By Fluid Financial · Sources reviewed November 5, 2026
Reduce unnecessary payment data, then assess the wider workflow
MedPay+ combines MedToken data privacy technology with merchant processing. MedToken is the privacy technology; MedPay+ is the complete healthcare payment offering.
MedToken is designed to limit unnecessary PHI in the payment package at the transaction processor. That can support a data-minimization strategy. It does not automatically fulfill state-specific consent, notice, consumer-rights, contractual, security, retention, or breach-response duties.
Map your payment data flow before selecting controls.
Four state examples for your review
| State and primary source | What to evaluate |
|---|---|
| California · CCPA, as amended by CPRA | Assess business coverage and sensitive-personal-information duties. Certain medical information is exempt; review other information and the relevant statutory exceptions separately. |
| Washington · My Health My Data Act guidance | The law protects consumer health data outside HIPAA’s scope. Where applicable, review collection and sharing consent, health-data privacy notices, consumer requests, and sale authorization. Check the specific data exemptions. |
| Nevada · NRS 603A.400–603A.550 | Review consumer health-data coverage, entity and data exemptions, collection/sharing conditions, privacy policies, processor contracts, consumer requests, and sale authorization. |
| Florida · Florida Information Protection Act, § 501.171 | Evaluate reasonable security measures, disposal, and breach-notification duties for covered personal information, including qualifying medical information. This is a separate review from Florida’s other consumer privacy provisions. |
Illustrative examples, not a complete list of applicable laws or a determination that each law applies to every provider. Follow the linked official sources and assess exemptions carefully.
Use the same questions across states
- Identify the information. Include patient fields, transaction references, metadata, receipts, and support records.
- Confirm coverage. Review state connections, legal roles, thresholds, exemptions, and data uses.
- Validate minimization. Test what MedToken removes, retains, and sends onward in the proposed configuration.
- Document responsibilities. Allocate notices, permissions, contracts, consumer requests, retention, security, and incident response.
- Review change. Reassess when vendors, payment channels, data uses, or legal requirements change.
State privacy questions
Does HIPAA replace state health-data privacy requirements?
Do not assume it does. State laws differ in coverage and exemptions. Review the organization, the information, the purpose, and the relevant state rather than applying one rule to every workflow.
Does MedToken establish compliance with every state privacy law?
No. MedToken addresses unnecessary PHI in a payment package. State-specific notices, permissions, contracts, consumer requests, security, retention, and breach response require their own evaluation.
Which state laws should a healthcare provider review?
Start with the states where the organization operates and where relevant individuals and data activities are located. The California, Washington, Nevada, and Florida examples here are a starting point, not a complete 50-state assessment.
Connect state privacy with federal requirements
Keep HIPAA, the DOJ Data Security Program, and state law as distinct review topics. Read the HIPAA overview and EO 14117 healthcare payment guide.
General product-evaluation information, not legal advice or a state-law compliance certification. Sources reviewed November 5, 2026.
Discuss your healthcare payment privacy workflow
Bring the states, payment channels, integrations, and data-handling questions relevant to your organization.
Request a Technical Review