You said a mouthful.
The answer depends on what type of covered entity you are talking about. This being a benefits board, I assume you are referring to an employer-sponsored health plan. The answer will differ significantly if you are talking about an insurer, provider or clearinghouse.
First, HIPAA's preemption is completely different from ERISA's. HIPAA sets a floor, but does not preempt any state laws that are more restrictive (there are many). A great database of health privacy laws by state can be found at:
http://www.healthprivacy.org/info-url_noca...o-url_nocat.htm
There are differing opinions as to whether a state privacy law may be made applicable to an employee benefit plan by HIPAA's almost "reverse preemption". The preamble to the final privacy rule says that HIPAA does not affect ERISA preemption, so I am of the opinion that state privacy laws will continue to be inapplicable to employer sponsored benefit plans. There are firms who have reached the opposite conclusion.
Feel free to drop me an email if you want to discuss specific state laws.