Under what condition can state law allow the disclosure of PHI without individual consent?

The correct answer highlights that state law can permit the disclosure of protected health information (PHI) without individual consent when it is more permissive than HIPAA in specific situations. This situation arises because HIPAA sets a baseline for protecting individuals' health information, but states have the authority to enact laws that can provide broader protections or allow for different circumstances under which PHI can be disclosed.

If a state law allows for certain disclosures of PHI that are not restricted by HIPAA—for example, in cases where there's a public health concern or mandatory reporting requirements—then those state provisions can take precedence over HIPAA regulations, allowing for such disclosures without requiring individual consent. This principle enables states to tailor their privacy protections to better fit their specific legal or public health frameworks while still adhering to the overarching requirements established by HIPAA.

This understanding underscores the importance of knowing both federal and state laws regarding PHI disclosures, as they can interact and result in different legal obligations for healthcare providers.