Health Information Portability and Accountability Act has been described as floor for health care privacy laws. States, regulators are free to enact more restrictive ones. Washington became first state to codify broad protections for consumer health data going beyond HIPAA.