Cosmetic care, online reviews and patient privacy: a U.S. guide

State comparison

All 255 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.

Key review-response cases

Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.

Frequently asked questions

Can a practice sue or use HIPAA to make a patient delete a negative review?

HIPAA does not restrict what patients say about their own care, and using groundless legal threats or intimidation to get a review removed is unlawful under the FTC's reviews rule. Defamation claims remain possible in principle, but this guide does not assess them. [F-033, F-007, F-032]

Can we ask patients to sign an agreement not to post negative reviews?

Generally no. A form-contract term that restricts or penalizes reviews is void under the Consumer Review Fairness Act, and the FTC and state attorneys general can enforce it. [F-032]

If a patient reveals their own procedure in a review, can we discuss it in our reply?

Not for a HIPAA covered practice: the patient's own disclosure does not give the practice permission to disclose health information. OCR has resolved several matters over exactly this kind of reply. [F-007, F-024]

Does HIPAA apply to a med spa or an esthetics studio?

Only if the business is a covered entity, which for providers means conducting standard electronic transactions such as insurance claims. Many cash-only med spas and most nonmedical studios are not covered, but state confidentiality, consumer protection and likeness laws can still apply. Some state laws are broader than HIPAA: in Texas, a studio that receives a physician's records about a client may be covered by the state medical records privacy law even though HIPAA does not apply, and whether a studio's own health intake questions bring it under that law is unresolved. [F-001, F-002, TX-001, TX-014]

Do we need written permission to post before-and-after photos?

For a HIPAA covered practice, marketing uses of identifiable photos generally require a written authorization with specific elements. Many state likeness laws also require consent for commercial use of a person's image. [F-005, F-006, F-004, CA-008, OH-008]

Is every privacy mistake a reportable breach?

No. Under HIPAA an impermissible disclosure is presumed to be a breach unless a documented risk assessment shows a low probability of compromise, and state breach laws often do not cover medical information at all. [F-010, KY-003]

What penalties are realistic?

Published maximums are ceilings. The four OCR review-response matters this research located ranged from $10,000 to $50,000; state and board outcomes vary. Past results do not predict any particular case. [F-024, F-014]

Can patients sue a practice over a privacy breach?

HIPAA itself gives patients no right to sue, but many states allow lawsuits under state statutes or court-recognized privacy claims; see each state summary. [AZ-014, CA-005, WI-002]

Can a practice make a review site take a review down?

Generally not by the practice. Review sites are generally not liable for users' reviews and decide removals under their own policies, which you can ask them to apply. Nothing in this guide promises that any review will be removed. [F-034, F-032]

Are the pending privacy bills mentioned here law?

No. A bill becomes law only when enacted; this guide labels proposals as not law. [NY-010, PA-005, F-023] Bracketed codes are reference numbers for the sources listed in the research claim register; "research gap" codes point to logged open research issues.

States, topics and glossary

Sources

1. F-001. 45 CFR 160.103

   A health care provider is a HIPAA covered entity only if it transmits health information electronically in connection with a HIPAA standard transaction (e.g., claims, eligibility).

   Regulation · Explicit · High · Cash-only practices that never conduct standard transactions (directly or via a billing agent) are generally not covered; facts must be checked practice-by-practice.

   https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103

2. F-002. 45 CFR 160.103

   'Health care' includes services affecting the structure or function of the body, so elective cosmetic procedures performed by providers are health care.

   Regulation · Explicit (definition); application to cosmetic care inferred · High · Inference that cosmetic injectables/surgery fall within 'structure or function' is strong but OCR has not issued cosmetic-specific guidance located in this research.

   https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103

3. CA-001. Cal. Civ. Code 56.10(a)

   CMIA prohibits a provider of health care from disclosing medical information without authorization except as compelled or permitted by 56.10(b)-(c).

   Statute · Explicit · High · Official text from the California Legislative Counsel bulk database (pubinfo, data as of 2026-10-18), read 2026-10-22 (U-11 closed for this section). [Audit D 2026-10-22: reader link changed from the official bulk-data zip (where the text was read) to the official section page]

   https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10

4. AZ-001. A.R.S. 12-2292(A)

   Medical and payment records are privileged and confidential; a health care provider may disclose them only as authorized by state or federal law or written authorization.

   Statute · Explicit · High · Applies to title-32 licensees who maintain medical records and to licensed health care institutions (12-2291(5)), regardless of HIPAA status.

   https://www.azleg.gov/ars/12/02292.htm

5. MD-001. Md. Code, Health-Gen. 4-301(g), (h), (k); 4-302(a)

   Confidentiality of Medical Records Act: a health care provider must keep the medical record confidential and disclose it only as the subtitle or other law allows. 'Provider' covers anyone licensed, certified or otherwise authorized under the Health Occupations Article, plus facilities and their agents and employees; 'health care' includes services affecting the structure or any function of the body; 'medical record' includes oral information entered in the record.

   Statute · Explicit · High · Applies regardless of HIPAA status; cosmetic services fall within 'health care' (structure/function language). 4-305 permits disclosure to counsel or insurer for a claim; no general reputation exception.

   https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg&section=4-302

6. F-021. 15 U.S.C. 45; FTC consent orders

   Section 5 of the FTC Act (unfair or deceptive practices) reaches health-data practices of non-HIPAA businesses, including broken privacy promises; FTC orders against GoodRx ($1.5M), BetterHelp ($7.8M), Premom ($100,000) are settlements, not adjudicated findings.

   Statute / Settlements · Explicit (orders); Inferred (application to aesthetics) · Medium-High · No FTC action against a med spa or cosmetic practice for privacy located.

   https://www.ftc.gov/legal-library/browse/cases-proceedings/2023090-goodrx-holdings-inc

7. TX-001. Tex. Health & Safety Code 181.001(b)(2)

   Texas Medical Records Privacy Act 'covered entity' is far broader than HIPAA: any person who for commercial, financial, or professional gain (or nonprofit) assembles, collects, analyzes, uses, evaluates, stores, or transmits PHI, including providers and website operators.

   Statute · Explicit · High · Whether a business's client data is 'PHI' (HIPAA meaning per 181.001(a), fixed as of 2011 by 181.001(b)(3)) turns on who created or received it; see TX-014. A license alone neither establishes nor excludes coverage.

   https://statutes.capitol.texas.gov/Docs/HS/htm/HS.181.htm

8. TX-014. Tex. Health & Safety Code 181.001(a), (b)(2)-(3), 181.005(b); 45 CFR 160.103 (2011 ed.) ('health care', 'health care provider', 'health information', 'individually identifiable health information', 'protected health information')

   Ch. 181 reach to nonmedical aesthetic businesses (U-21, LR-01): coverage is conditional, not automatic from a cosmetology or esthetics license. 181.001(a) gives undefined ch. 181 terms their HIPAA meaning, and 181.001(b)(3) ties that meaning to the federal privacy standards as of September 1, 2011 (later federal amendments apply only if adopted under 181.005(b)). Under 45 CFR 160.103 (2011 ed.), 'protected health information' is individually identifiable health information, which must be (1) created or received by a health care provider, health plan, employer or health care clearinghouse and (2) relate to an individual's physical or mental health or condition, the provision of health care, or payment for it, and identify the individual. Applied (interpretation): (a) records a salon or studio receives from a physician or other health care provider are already PHI, so possessing them can make the business a ch. 181 covered entity under 181.001(b)(2)(B) ('comes into possession of protected health information'); (b) a salon's own intake answers about medications, allergies, conditions or treatment history are PHI only if the business is itself a HIPAA-defined 'health care provider', i.e. furnishes 'health care', which includes services or procedures that affect the structure or function of the body; whether facials, waxing or similar esthetic services meet that definition is unresolved, and invasive esthetic procedures are more arguable; (c) an appointment list kept by a business that is not a health care provider is not PHI on its own. No Texas court decision, formal AG opinion or AG enforcement action applying ch. 181 to a nonmedical aesthetic business was located.

   Statute + federal regulation (definitions); application is interpretation · Explicit (definitions); inferred (application to aesthetic businesses) · Medium · LR-01 review (2026-10-22). Official ch. 181 text read on statutes.capitol.texas.gov and on the Legislature's tcss.legis.texas.gov mirror (texts match); 2010 and 2011 CFR editions of 160.103 read on govinfo (identical). The earlier caveat that the official statutes site could not be read is withdrawn. The definitions are binding; their application to esthetic services is not settled by any Texas authority located and needs Texas counsel. 'Health care' is not limited to licensed medical practitioners, but no source located decides whether cosmetic esthetic services 'affect the structure or function of the body' in the HIPAA sense.

   https://statutes.capitol.texas.gov/Docs/HS/htm/HS.181.htm

9. F-032. 15 U.S.C. 45b

   Consumer Review Fairness Act: a provision of a form contract is void if it prohibits or restricts an individual's ability to post a review, imposes a penalty or fee for doing so, or takes the reviewer's intellectual property in the review (other than a non-exclusive license). It does not affect legal duties of confidentiality, defamation claims, or a business's right to remove from its own website content that contains another person's personal information, is unlawful or abusive, unrelated, or clearly false. The FTC and state attorneys general enforce it.

   Statute · Explicit · High · Med spa pass, final phase part 2 (2026-10-22). Read on GovInfo U.S. Code (2024 ed.) (V-071). Bars patient 'gag clauses' in form contracts; does not authorize removal of reviews on third-party platforms.

   https://www.govinfo.gov/link/uscode/15/45b?type=usc&year=mostrecent&link-type=html

10. F-033. 16 CFR 465.7; 465.4 (89 FR 68034, Aug. 22, 2024)

    FTC Consumer Reviews and Testimonials Rule: it is unlawful (a) to use an unfounded or groundless legal threat, a physical threat, intimidation, or a knowingly or recklessly false public accusation in an attempt to prevent a review or have one removed, and (b) for a business to misrepresent that the reviews it displays represent most or all reviews while suppressing reviews because of rating or negative sentiment (neutral content criteria are allowed). The rule also bars buying reviews conditioned on positive or negative sentiment.

    Regulation · Explicit · High · Med spa pass, final phase part 2 (2026-10-22). Read on eCFR (V-072). Civil penalties attach to knowing violations of trade regulation rules; amounts not stated here.

    https://www.ecfr.gov/current/title-16/chapter-I/subchapter-D/part-465

11. F-007. 45 CFR 164.502(a)

    Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.

    Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502

12. F-024. HHS OCR resolution agreements

    OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).

    Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).

    https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html

13. TX-012. HHS OCR

    Elite Dental Associates (Dallas) paid $10,000 to OCR over Yelp replies disclosing patient information.

    Enforcement (federal resolution agreement) · Explicit · High · Federal OCR action, not Texas state enforcement.

    https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/elite/index.html

14. NY-001. N.Y. Educ. Law 6530(23)

    Professional misconduct for physicians (and PAs/specialist assistants): revealing personally identifiable facts, data, or information obtained in a professional capacity without the patient's prior consent, except as authorized or required by law.

    Statute · Explicit · High · Applies to licensees regardless of HIPAA status.

    https://legislation.nysenate.gov/pdf/laws/EDN6530

15. F-034. 47 U.S.C. 230(c)(1)-(2)

    Section 230: no provider or user of an interactive computer service may be treated as the publisher or speaker of information provided by another information content provider, and platforms are protected for good-faith moderation decisions. Review sites generally decide removal under their own policies; they are generally not liable for patients' reviews.

    Statute · Explicit (text); 'generally decide under their own policies' is an inference · High · Med spa pass, final phase part 2 (2026-10-22). Read on GovInfo (V-073). Exceptions in 230(e) (federal criminal law, IP, etc.) not analyzed. Statements about platform policies are inference, not law.

    https://www.govinfo.gov/link/uscode/47/230?type=usc&year=mostrecent&link-type=html

16. F-003. 45 CFR 160.103

    PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.

    Regulation · Explicit · High

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103

17. F-005. 45 CFR 164.508(a)(3)

    A covered entity must obtain an authorization for any use or disclosure of PHI for marketing, except face-to-face communications or promotional gifts of nominal value; authorizations must disclose remuneration from third parties.

    Regulation · Explicit · High · Whether posting a before/after photo on the practice's own social media is 'marketing' under 164.501 vs. another non-permitted disclosure, either way an authorization is required absent a listed permission; inferred.

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508

18. F-006. 45 CFR 164.508(b)(5),(c)(1)-(2)

    A valid HIPAA authorization must contain core elements (description of information, who discloses, recipient, purpose, expiration, signature/date) and required statements; it may be revoked in writing except to the extent of reliance.

    Regulation · Explicit · High · Generic 'consent' clauses in intake forms often lack required elements; HIPAA 'consent' (164.506(b)) is not an authorization.

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508

19. F-004. 45 CFR 164.514(b)(2)(i)(Q),(R)

    Full-face photographs and comparable images are a de-identification identifier; any other unique identifying characteristic is also listed.

    Regulation · Explicit · High · Cropped body photos may still be identifiable (tattoos, birthmarks, metadata, context) under (R) and the 'actual knowledge' condition in (b)(2)(ii); case-by-case.

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514

20. F-031. HHS OCR, Cadia Healthcare Facilities Resolution Agreement (2025-04-22; announced 2025-09-30)

    OCR resolved a website testimonial case: Cadia Healthcare Facilities (five Delaware rehabilitation and nursing providers) posted 150 patients' names, photographs and treatment and recovery details as 'success stories' without valid written HIPAA authorizations. OCR determined impermissible disclosures, inadequate safeguards and failure to give breach notice; Cadia paid $182,000 and agreed to a 2-year corrective action plan that includes training marketing staff and notifying every patient posted without authorization. OCR stated that a valid written authorization is generally necessary before posting PHI in a website testimonial or social media campaign.

    Federal enforcement (resolution agreement) · Explicit · High · Settlement, no admission stated in the release. Not a cosmetic practice, but the conduct (testimonial posts with photos) maps directly to before/after and testimonial marketing (application inferred). Unauthorized posting was treated as a breach requiring notice. Added 2026-10-22 (V-049, V-050).

    https://www.hhs.gov/press-room/ocr-settles-hipaa-with-cadia-healthcare-facilities.html

21. CA-008. Cal. Civ. Code 3344

    Knowing use of another's name, voice, signature, photograph or likeness for advertising or selling without prior consent: liability for the greater of $750 or actual damages, plus attributable profits, punitive damages, and attorney's fees and costs to the prevailing party. Since 2026-01-01 (SB 683) a court may issue an injunction or TRO, and a respondent ordered to remove the likeness must do so within two business days of service.

    Statute · Explicit · High · Verified 2026-10-22 (V-036). Applies to any business, including nonmedical aesthetics. Official text from the California Legislative Counsel bulk database (pubinfo, data as of 2026-10-18), read 2026-10-22 (U-11 closed for this section). [Audit D 2026-10-22: reader link changed from the official bulk-data zip (where the text was read) to the official section page]

    https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=3344

22. NY-006. N.Y. Civ. Rights Law 50, 51

    Use of a living person's name, portrait, picture, likeness or voice for advertising or trade without prior written consent is a misdemeanor (50) and supports an action for injunction and damages, with exemplary damages for knowing use (51).

    Statute · Explicit · High · Written consent required; key for patient before/after photos and testimonials.

    https://legislation.nysenate.gov/pdf/laws/CVR51

23. OH-008. ORC 2741.02(A)-(B); 2741.07(A)(1)

    Right of publicity: no one may use any aspect of an individual's persona for a commercial purpose during life (and 60 years after death) without prior written consent (ORC 2741.02). A violator is liable for actual damages including attributable profits or, at the plaintiff's election, statutory damages of $2,500 to $10,000, plus possible punitive damages (2741.07).

    Statute · Explicit · High · Applies to any business, including nonmedical aesthetics and med spas using client images in advertising (application inferred). Exceptions in 2741.02(D) and 2741.09 not read. Added 2026-10-22 (V-051).

    https://codes.ohio.gov/ohio-revised-code/section-2741.02

24. F-010. 45 CFR 164.402

    An impermissible use or disclosure of unsecured PHI is presumed a breach unless a documented four-factor risk assessment shows a low probability of compromise; three narrow exclusions apply.

    Regulation · Explicit · High · A public review reply disclosing PHI is a privacy violation and generally also a breach requiring notification unless the assessment supports low probability; OCR's New Vision CAP required breach notices (from resolution agreement).

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.402

25. F-011. 45 CFR 164.404(b), 164.406, 164.408

    Individual breach notice must be without unreasonable delay and no later than 60 calendar days after discovery; media notice if >500 residents of a State; HHS notice contemporaneously for 500+, annual log for <500.

    Regulation · Explicit · High · State laws may impose shorter deadlines (e.g., FL 30 days, WA 30 days, CA 30 days for 1798.82 where applicable).

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D

26. CA-010. Cal. Civ. Code 1798.82

    Breach notice (1798.82) as amended by SB 446 (Stats. 2025, ch. 319, chaptered 2025-10-03): consumer notice within 30 calendar days of discovery or notification (delay allowed for law enforcement or to determine scope and restore integrity); AG sample copy within 15 calendar days of consumer notice if >500 residents; HIPAA covered entities complying with HITECH are deemed compliant only with the notice-content requirements of subdivision (d).

    Statute · Explicit (bill text via search) · High · Verified from official Legislature bulk bill text (chaptered version). Closes U-12.

    https://downloads.leginfo.legislature.ca.gov/ (pubinfo bulk data: SB 446 chaptered text)

27. TX-007. Tex. Bus. & Com. Code 521.002, 521.053, 521.151

    Breach law covers health condition, provision of care, and payment information; individual notice within 60 days; AG notice within 30 days if 250+ Texans; penalties $2,000-$50,000 per violation and up to $100/individual/day for failure to notify (max $250,000).

    Statute · Explicit · High

    https://statutes.capitol.texas.gov/Docs/BC/htm/BC.521.htm

28. KY-003. KRS 365.732(1)(c), (2), (7), (8)

    Breach law: 'personally identifiable information' = name plus SSN, driver's license, or financial account/card with code; medical information is NOT covered; notice in the most expedient time possible; consumer reporting agencies if more than 1,000; the section does not apply to persons subject to HIPAA.

    Statute · Explicit · High · HIPAA practices excluded entirely.

    https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326

29. WA-001. RCW 19.373.010, .030

    My Health My Data Act: 'consumer health data' includes information on health-related surgeries or procedures and inferred health data; regulated entities need consent to collect and separate consent to share, beyond what is necessary to provide the requested product/service.

    Statute · Explicit · High · Applies to non-HIPAA aesthetic businesses, med spas, cash practices.

    https://app.leg.wa.gov/RCW/default.aspx?cite=19.373

30. WA-002. RCW 19.373.100(1)

    MHMDA exemptions are data-level: HIPAA PHI and health care information governed by RCW 70.02 are exempt, not entities.

    Statute · Explicit · High · A HIPAA-covered practice's website/marketing data that is not PHI may still be consumer health data (inferred).

    https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.100

31. NV-002. NRS 603A.490(1)(a)

    Unlike Washington, Nevada's exemption is entity-level: any person or entity subject to HIPAA is exempt.

    Statute · Explicit · High · A HIPAA-covered practice's non-PHI web data appears exempt in NV but not WA (inferred contrast).

    https://www.leg.state.nv.us/NRS/NRS-603A.html

32. TX-008. Tex. Bus. & Com. Code 541.002, .003, .107

    Texas Data Privacy and Security Act exempts HIPAA covered entities (entity-level) and PHI (data-level), and applies only to non-small businesses except the sale-of-sensitive-data consent rule, which applies to small businesses too.

    Statute · Explicit · High · Health data is 'sensitive data' requiring consent for non-exempt businesses.

    https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm

33. MD-006. Md. Code, Com. Law 14-4702; 14-4703(b)(1), (b)(6)(ii)

    MODPA applies at 35,000 consumers (or 10,000 with 20%+ revenue from data sales); exemptions are DATA-level only (PHI; MCMRA records held by a CE/BA applying HIPAA standards); no entity-level covered-entity exemption.

    Statute · Explicit · High · Non-PHI marketing data of a covered cosmetic practice can be in scope if thresholds are met (inference).

    https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4703

34. F-014. 45 CFR 102.3; 91 FR 3665

    2026 inflation-adjusted HIPAA CMP amounts: Tier 1 $145-$73,011; Tier 2 $1,461-$73,011; Tier 3 $14,602-$73,011; Tier 4 $73,011-$2,190,294; CY cap $2,190,294.

    Regulation · Explicit · High · These are statutory/regulatory maxima. OCR resolution amounts in review-response cases ranged $10,000-$50,000 (see cases.csv); maxima are not typical outcomes. Inflation-adjusted values of the enforcement-discretion caps were not verified from a primary source.

    https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment

35. F-016. 42 U.S.C. 1320d-5(d)

    State attorneys general may sue in federal court for HIPAA violations: injunction or damages up to $100 per violation, capped at $25,000 per identical requirement per calendar year, plus fees.

    Statute · Explicit · High · HIPAA itself has no private right of action (well established; individual courts not separately cited here). [Audit D 2026-10-22: URL changed from LII (unofficial) to govinfo; subsection (d) text re-read]

    https://www.govinfo.gov/link/uscode/42/1320d-5?type=usc&year=mostrecent&link-type=html

36. IN-006. State of Indiana ex rel. Rokita v. Westend Dental LLC, No. 1:24-cv-02255 (S.D. Ind.)

    Indiana AG suit against a dental group ALLEGED, among other things, that public replies to online patient reviews on Google and Facebook posts disclosed patients' PHI (including minors and x-rays) without authorization, pleaded under HIPAA (42 U.S.C. 1320d-5(d)), the breach law and the Deceptive Consumer Sales Act. A consent judgment entered 2025-01-02 (no admission) bars disclosing PHI 'in response to online reviews' or in ads without patient authorization, requires social-media and review policies, and requires a $350,000 payment.

    Enforcement (state AG; federal-court consent judgment) · Explicit (complaint and proposed judgment read; entered version not read) · High · Settlement, not a finding. Dental practice (cosmetic status not stated). State AG HIPAA enforcement against review replies; the payment also resolves breach claims.

    https://storage.courtlistener.com/recap/gov.uscourts.insd.218861/gov.uscourts.insd.218861.1.0.pdf

37. NY-012. NY AG press releases

    NY AG data-security settlements with physician practices: Albany ENT & Allergy ($500,000 penalties + $2.25M security investment, 2024-10-29) and OrthopedicsNY ($500,000, 2025-12-26).

    Enforcement (state AG settlements) · Explicit · High · Specialty physician practices (not cosmetic). Settlements, not findings.

    https://ag.ny.gov/press-release/2025/attorney-general-james-secures-500000-capital-region-health-care-provider

38. NC-004. In re Sean Michael Lynch, M.D. (NCMB Consent Order)

    NC Medical Board consent order (findings and admissions): an OB/GYN showed a bar patron a graphic photo of an unconscious patient (no face or identifiers) taken without her knowledge, not in her record, shown without consent and with no medical purpose; unprofessional conduct under 90-14(a)(6); reprimand and indefinite suspension, stayed on conditions (NCPHP contract, 16-hour CME).

    Enforcement (licensing; consent order with findings) · Explicit (order read) · High · Not cosmetic, not online. Notable: a de-identified photo still supported discipline.

    https://portal.ncmedboard.org/file/fileDisplay.aspx?FileID=hBB4qrGkpiI%3D&TYPE=DISCLIC

39. CT-009. Conn. Gen. Stat. 19a-903c (P.A. 14-119; P.A. 15-242)

    Med spa statute: a medical spa must employ or contract with a physician, PA or APRN (medical director duties); a licensed provider must perform an initial in-person assessment before cosmetic medical procedures; procedures may be performed only by those providers or by a supervised RN as allowed; the names of the medical director and providers must be posted on site, on the website and in advertising. No DPH med spa regulations were located.

    Statute · Explicit (OLR summary); statute text read on Justia (secondary) · Medium · Med spa pass, final phase part 2 (2026-10-22). Statute text from Justia (secondary host); summary confirmed in the official OLR report 2025-R-0159. Official CGS page not read (cga.ct.gov timeouts earlier) (V-055, U-99).

    https://cga.ct.gov/2025/rpt/pdf/2025-R-0159.pdf

40. RI-006. P.L. 2025 ch. 309; R.I. Gen. Laws 23-105-3 et seq.

    Medical Spas Safety Act (P.L. 2025 ch. 309, S 0976 Sub A), R.I. Gen. Laws ch. 23-105, effective on passage (2025-06-30): med spas need a trained medical director (physician or CNP); initial assessment, written treatment plan, documented consent and records; non-physicians may perform only trained, delegated procedures; ablative lasers and energy devices limited to physicians, PAs and CNPs; RIDOH must adopt rules (including facility licensing) by 2026-07-01.

    Statute · Explicit · High · No implementing rule located on the RI SOS rules site as of 2026-10-22 (search); statutory duties apply now (U-86).

    https://webserver.rilegislature.gov/PublicLaws/law25/law25309.htm

41. TN-006. Tenn. Code 63-1-153(a)-(c); 63-6-105(a)-(b)

    Medical spa law: a 'medical spa' is any entity offering or performing cosmetic medical services (any service using a biologic or synthetic material, chemical, mechanical device or displaced energy that alters or is capable of altering living tissue to improve appearance), excluding a physician-owned practice; it must display the medical director's name and board-certification status at the site and in advertising. The Board of Medical Examiners maintains an online registry that also includes physician-owned practices holding themselves out as med spas or primarily performing elective cosmetic services.

    Statute · Explicit · Medium-High · Secondary host for statute text; implementing rule read from the official Secretary of State PDF (TN-007).

    https://law.justia.com/codes/tennessee/title-63/chapter-1/part-1/section-63-1-153/

42. IN-007. Ind. Code 25-22.5-12.5-1 to -6

    Medical spa registration statute (added 2026): a 'medical spa' is a facility or practice offering medical services, using prescription drugs by IV, IM or subcutaneous delivery, and holding itself out as cosmetic or lifestyle focused (weight loss, wellness, botulinum toxin and fillers, hormones, cosmetic laser or energy devices including hair removal); physician offices and otherwise state-licensed facilities are excluded. Registration is required from January 1, 2027 (fine up to $5,000 for unregistered operation); each spa must designate a responsible practitioner with prescriptive authority and relevant training who is physically present enough to ensure compliance and that every worker is licensed for and trained in their services; serious adverse events must be reported; the public database must redact personally identifying health information.

    Statute · Explicit · High · Binding, but the registration duty is future-dated. Board implementing procedure (due 2026-10-01) not read (U-64).

    https://iga.in.gov/ic/2026/Title_25/Article_22.5.pdf

43. NM-005. 16.10.13.8-.9 NMAC

    Med spa: Medical Board rule 16.10.13 NMAC states that using medical therapeutic or cosmetic devices is the practice of medicine; medical assistants may use only non-incisive, non-ablative devices, when certified and with the supervising physician immediately available on the premises (16.10.13.8); injecting cosmetic or aesthetic substances is the practice of medicine and may not be delegated to medical assistants (16.10.13.9). A Medical Board medical spa policy (guidance) restates these limits.

    Regulation · Explicit · High · Med spa pass, final phase part 2 (2026-10-22). Official SRCA text read 2026-10-22 (V-063).

    https://www.srca.nm.gov/parts/title16/16.010.0013.html

44. F-023. 90 FR (2025-01-06, FR Doc 2024-30983); 91 FR 1481

    Pending/proposed, not law: HIPAA Security Rule NPRM (Jan 6, 2025) and 2021 Privacy Rule NPRM (RIN 0945-AA00, tribal consultation notice Jan 14, 2026).

    Proposed rule · Explicit · High (status as of 2026-10-22 FR search) · Not binding.

    https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information

45. NY-010. S929 (2025); S9269/A10357 (2026)

    New York Health Information Privacy Act (S929) was vetoed on 2025-12-19 (Veto No. 135). A revised bill (S9269/A10357) passed the Senate (2026-06-03) and Assembly (2026-06-04) but the official page shows no signature; it is NOT law as of 2026-10-22.

    Legislative history · Explicit · Medium-High · Re-checked on the official Assembly status page 2026-10-22 (V-026): returned to Senate 2026-06-04; no delivery to or action by the Governor shown. Not law; re-check before publication.

    https://legislation.nysenate.gov/pdf/bills/2025/S929

46. PA-005. n/a

    Pennsylvania has no comprehensive consumer privacy law in force as of 2026-10-22. HB 78 (Consumer Data Privacy Act) passed the House on 2025-10-01 and, in the Senate, was re-reported as amended on 2026-06-24, given second consideration on 2026-06-25, and laid on and removed from the table on 2026-10-06; it has not passed the Senate or reached the Governor. Pending bills are not law.

    Search result (negative) · Inferred from search · High · Official bill history read 2026-10-22 (V-028). Live bill late in session: re-check before publication.

    https://www.palegis.us/legislation/bills/2025/hb78

47. AZ-014. Shepherd v. Costco Wholesale Corp., 250 Ariz. 511, 482 P.3d 390 (2021)

    Arizona Supreme Court: HIPAA creates no private right of action, but it does not bar a state-law negligence claim for negligent disclosure of medical information; HIPAA, professional regulations and the provider's own privacy policy may inform (but not by themselves establish) the standard of care. The 12-2296 good-faith immunity is an affirmative defense; the plaintiff need not plead around it but must ultimately rebut the presumption of good faith by clear and convincing evidence.

    Case law · Explicit · High · Pharmacy facts (E.D. prescription disclosed to ex-wife). Supports a negligence claim against a provider whose review reply or post discloses patient information (application inferred). Whether A.R.S. 12-2292 itself creates a private action remains undecided (U-07). Added 2026-10-22 (V-047).

    https://www.azcourts.gov/Portals/0/OpinionFiles/Supreme/2021/ASC-CV190144%20-%203-8-2021%20-%20FILED%20-%20OPINION.pdf

48. CA-005. Cal. Civ. Code 56.35; 56.36(b), (e)

    CMIA private actions: (1) under 56.35, a patient whose medical information was used or disclosed in violation of 56.10 (and listed sections) AND who sustained economic loss or personal injury may recover compensatory damages, punitive damages up to $3,000, attorney's fees up to $1,000 and costs; (2) under 56.36(b), anyone whose information was NEGLIGENTLY released may recover $1,000 nominal damages without proving actual damages, plus any actual damages. Under 56.36(e), nominal damages are unavailable if a HIPAA covered entity or business associate shows the release went only to another covered entity or business associate, required notices were given, and it was not medical identity theft.

    Statute · Explicit · High · CORRECTED 2026-10-22 (V-034): earlier text omitted the economic-loss condition in 56.35 and the 56.36(e) defense. Courts have required that information actually be viewed for 56.36 claims (secondary; not re-verified). Official text from the California Legislative Counsel bulk database (pubinfo, data as of 2026-10-18), read 2026-10-22 (U-11 closed for this section). [Audit D 2026-10-22: reader link changed from the official bulk-data zip (where the text was read) to the official section page]

    https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.35

49. WI-002. Wis. Stat. 146.84(1)(b)-(c), (2)

    Private action: a knowing and willful violation of 146.82 makes the violator liable for actual damages, exemplary damages up to $25,000, costs and reasonable actual attorney fees; a negligent violation, actual damages, exemplary damages up to $1,000, costs and fees; injunctions available. Criminal fines up to $25,000 (knowing unlawful disclosure) or $100,000 (for pecuniary gain); negligent disclosure forfeiture up to $1,000 per violation.

    Statute · Explicit · High · Maximums, not typical. Annotation notes class certification is not precluded.

    https://docs.legis.wisconsin.gov/statutes/statutes/146/84