When does a state or federal law or regulation preempt HIPAA? When it gives the individual more access to their PHI When it gives the individual less access to their PHI When it protects the organization instead of the individual When it protects the individual instead of the organization