CONGRESS MUST pass a medical privacy protection bill by late August or, under the provisions of a 1996 law, lose jurisdiction over the subject to the Department of Health and Human Services. The several bills on the table, though, have repeatedly failed to survive committee markups. One sensitive issue is the rights of minors. Another is whether a federal privacy law would preempt existing privacy protections in the states.

This sticking point -- a common one when federal regulations are contemplated -- has been made stickier still by the absence of any real sense of what states actually do to protect privacy and thus whether a federal law would make protection stronger or weaker. A nonpartisan research group at Georgetown University has now released a huge state-by-state analysis of such privacy laws, offering grist for the debate over preemption while illustrating why the issue has proved hard to wrap into a single package.

The report from the Health Privacy Working Group covers hundreds of laws -- Florida alone has 60 -- all coming at the privacy question in different contexts. Most states offer no overarching protection for sensitive information (Delaware and Wisconsin are exceptions) but instead restrict the handling of particular records by particular entities, from adoption agencies to optometrists. Many are specific to hospitals or doctors but do not mention health maintenance organizations. Similarly, most predate the era of instantaneous, and therefore dangerous, electronic data-sharing. But they address other concerns that have gotten short shrift in federal proposals, such as the right of patients to see their own records and correct them.

Recently states have also taken the lead in protecting people with ailments or conditions that might lead to discrimination. In states that require public health reporting of HIV status, domestic or child abuse, for example, many also have penalties for disclosure of such information. Those are protections that shouldn't be weakened. But the relative dearth of protections that follow private records wherever they are shared -- by hospitals, doctors, insurers, HMOs, motor vehicle bureaus and the rest -- suggests an area where Congress can make a contribution.