Can I just follow state laws regarding physician-patient confidentiality?
No. The HIPAA privacy rule is much more formal than the patient confidentiality laws physicians have traditionally adhered to. State law should only be followed when it is more stringent than federal law. You will undoubtedly want to consult with your state medical society, if not a health care lawyer, to determine which rules are stronger.