The Nаtiоnаl Gоvernоrs Associаtion, an organization of governors from the 50 states in the U.S., schedules a meeting to discuss medical privacy in light of the recent advances in medical research and the growing privacy concerns related to neurotechnologies. The group plans to discuss state laws providing rights in additional to those provided to patients under HIPAA. Would these state laws be permissible under U.S. law?