What a provider can and can't say in Alabama
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | Horne duty (tort/contract); no board order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Partly: Horne addresses physicians; dental grounds not read | Horne duty (tort/contract); no board order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | Horne duty (tort/contract); no board order located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | Horne duty (tort/contract); no board order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | Horne duty (tort/contract); no board order located |
- Consumer privacy and health data law: Alabama has enacted a consumer privacy law that is not yet in effect (APDPA (HB 351, 2026), eff. 2027-05-01); it binds no one until its effective date. Once effective, it exempts HIPAA-covered practices as a whole (an entity-level exemption). [AL-001]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general if more than 1,000 residents affected; HIPAA entities must copy attorney general. [AL-002, AL-003]
- Patient confidentiality duties: Patient confidentiality duties come mainly from court-recognized privacy claims (Horne).† [AL-004]
- Research notes and gaps: A specific board confidentiality ground was not read or not located (Ala. Code 34-24-360 was not read in full); this is a research gap, not a finding that none exists. [U-98]
- Lawsuits by individuals: Court decisions recognize patient privacy or confidentiality lawsuits in some situations (Horne).† [AL-004]
- Research notes and gaps: Alabama has a reported likeness statute (Ala. Code 6-5-770 and following), but its text was not read in this research (a gap). [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures. [AL-005]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2). Not finding enforcement does not mean none exists. [AL-006]
- Research notes and gaps: A 2026 settlement with an IV-therapy business concerned deceptive marketing, not privacy; a settlement is not a finding. [AL-006]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [AL-001] Ala. HB 351 (2026), secs. 3, 4(a)(6)-(8), 11, 12 (https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf)
- [AL-002] Ala. Code 8-38-2(6); 8-38-3; 8-38-5; 8-38-6 (https://acua.alabama.gov/PDF/law/AlabamaDataBreachNotificationAct.pdf)
- [AL-003] Ala. Code 8-38-9; 8-38-11 (https://acua.alabama.gov/PDF/law/AlabamaDataBreachNotificationAct.pdf)
- [AL-004] Horne v. Patton, 291 Ala. 701, 287 So. 2d 824 (1973) (https://law.justia.com/cases/alabama/supreme-court/1973/287-so-2d-824-1.html)
- [AL-005] Ala. Admin. Code r. 540-X-11-.02(5)-(9), -.04 (https://admincode.legislature.state.al.us/api/chapter/540-X-11)
- [AL-006] State v. Aurora IV and Wellness (Cullman Cty. Cir. Ct.) (https://www.alabamaag.gov/attorney-general-steve-marshall-files-suit-against-cullman-iv-infusion-clinic-for-administering-dangerous-unapproved-weight-loss-drugs/)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Alabama (AL) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Horne v. Patton duty of confidentiality (tort + implied contract); 34-24-360 unprofessional conduct (not read in full) | Yes - applies to licensed providers regardless of HIPAA status | APDPA (HB 351, 2026): enacted, NOT yet effective (2027-05-01); ENTITY-level HIPAA CE/BA and <500-employee non-seller exemptions | 8-38: medical info COVERED; 45 days; AG notice >1,000; HIPAA-regulated exempt only if AG gets copy (>1,000) | Horne duty (tort/contract); no board order located | HIPAA if covered; Horne; Right of Publicity Act 6-5-770 et seq. (not read) | Alabama Right of Publicity Act, Ala. Code 6-5-770 et seq. (per secondary; not read) | Yes: Horne breach-of-confidence and privacy claims; none under breach law | Board of Medical Examiners / Medical Licensure Commission, Board of Dental Examiners, Board of Nursing, AG | Breach: DTPA up to $500,000/breach + $5,000/day; APDPA up to $15,000/violation (from 2027) | E4 privacy; E2 med spa (AG v. Aurora IV: TRO Nov. 2025; settled 2026-01-12 without adjudicated findings; deceptive-trade-practices, not privacy) | Medium-High | 2026-10-22 |
| Alabama (AL) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Horne v. Patton duty of confidentiality (tort + implied contract); 34-24-360 unprofessional conduct (not read in full) | Partly: Horne addresses physicians; dental grounds not read | APDPA (HB 351, 2026): enacted, NOT yet effective (2027-05-01); ENTITY-level HIPAA CE/BA and <500-employee non-seller exemptions | 8-38: medical info COVERED; 45 days; AG notice >1,000; HIPAA-regulated exempt only if AG gets copy (>1,000) | Horne duty (tort/contract); no board order located | HIPAA if covered; Horne; Right of Publicity Act 6-5-770 et seq. (not read) | Alabama Right of Publicity Act, Ala. Code 6-5-770 et seq. (per secondary; not read) | Yes: Horne breach-of-confidence and privacy claims; none under breach law | Board of Medical Examiners / Medical Licensure Commission, Board of Dental Examiners, Board of Nursing, AG | Breach: DTPA up to $500,000/breach + $5,000/day; APDPA up to $15,000/violation (from 2027) | E4 privacy; E2 med spa (AG v. Aurora IV: TRO Nov. 2025; settled 2026-01-12 without adjudicated findings; deceptive-trade-practices, not privacy) | Medium-High | 2026-10-22 |
| Alabama (AL) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Horne v. Patton duty of confidentiality (tort + implied contract); 34-24-360 unprofessional conduct (not read in full) | Yes - applies to licensed providers regardless of HIPAA status | APDPA (HB 351, 2026): enacted, NOT yet effective (2027-05-01); ENTITY-level HIPAA CE/BA and <500-employee non-seller exemptions | 8-38: medical info COVERED; 45 days; AG notice >1,000; HIPAA-regulated exempt only if AG gets copy (>1,000) | Horne duty (tort/contract); no board order located | HIPAA if covered; Horne; Right of Publicity Act 6-5-770 et seq. (not read) | Alabama Right of Publicity Act, Ala. Code 6-5-770 et seq. (per secondary; not read) | Yes: Horne breach-of-confidence and privacy claims; none under breach law | Board of Medical Examiners / Medical Licensure Commission, Board of Dental Examiners, Board of Nursing, AG | Breach: DTPA up to $500,000/breach + $5,000/day; APDPA up to $15,000/violation (from 2027) | E4 privacy; E2 med spa (AG v. Aurora IV: TRO Nov. 2025; settled 2026-01-12 without adjudicated findings; deceptive-trade-practices, not privacy) | Medium-High | 2026-10-22 |
| Alabama (AL) | Medical med spa | Depends; cash-only med spas often not covered | Horne v. Patton duty of confidentiality (tort + implied contract); 34-24-360 unprofessional conduct (not read in full) | Yes - applies to licensed providers regardless of HIPAA status | APDPA (HB 351, 2026): enacted, NOT yet effective (2027-05-01); ENTITY-level HIPAA CE/BA and <500-employee non-seller exemptions | 8-38: medical info COVERED; 45 days; AG notice >1,000; HIPAA-regulated exempt only if AG gets copy (>1,000) | Horne duty (tort/contract); no board order located | HIPAA if covered; Horne; Right of Publicity Act 6-5-770 et seq. (not read) | Alabama Right of Publicity Act, Ala. Code 6-5-770 et seq. (per secondary; not read) | Yes: Horne breach-of-confidence and privacy claims; none under breach law | Board of Medical Examiners / Medical Licensure Commission, Board of Dental Examiners, Board of Nursing, AG | Breach: DTPA up to $500,000/breach + $5,000/day; APDPA up to $15,000/violation (from 2027) | E4 privacy; E2 med spa (AG v. Aurora IV: TRO Nov. 2025; settled 2026-01-12 without adjudicated findings; deceptive-trade-practices, not privacy) | Medium-High | 2026-10-22 |
| Alabama (AL) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Horne v. Patton duty of confidentiality (tort + implied contract); 34-24-360 unprofessional conduct (not read in full) | No | APDPA (HB 351, 2026): enacted, NOT yet effective (2027-05-01); ENTITY-level HIPAA CE/BA and <500-employee non-seller exemptions | 8-38: medical info COVERED; 45 days; AG notice >1,000; HIPAA-regulated exempt only if AG gets copy (>1,000) | Horne duty (tort/contract); no board order located | HIPAA if covered; Horne; Right of Publicity Act 6-5-770 et seq. (not read) | Alabama Right of Publicity Act, Ala. Code 6-5-770 et seq. (per secondary; not read) | Yes: Horne breach-of-confidence and privacy claims; none under breach law | Board of Medical Examiners / Medical Licensure Commission, Board of Dental Examiners, Board of Nursing, AG | Breach: DTPA up to $500,000/breach + $5,000/day; APDPA up to $15,000/violation (from 2027) | E4 privacy; E2 med spa (AG v. Aurora IV: TRO Nov. 2025; settled 2026-01-12 without adjudicated findings; deceptive-trade-practices, not privacy) | Medium-High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Northcutt Dental-Fairhope LLC
HHS OCR · AL (federal action) · 2022-03-28
- Provider type
- Dental
- Relevant facts
- Patient names/addresses given to a political campaign; emails sent via marketing vendor
- Legal issues
- Impermissible disclosure; no privacy official designated until Nov 2017 (see OCR page; section list not re-verified)
- Holding, findings, allegations or settlement terms
- Settlement (no admission); admission of liability: No
- Consequences recorded
- $62,500; 2-year CAP
- Procedural status
- Closed: resolution agreement; CAP monitoring period (status not re-checked)
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Patient-list marketing/third-party use (NOT review response)
Horne v. Patton
Supreme Court of Alabama · AL · 1973
- Provider type
- Physician
- Relevant facts
- Physician disclosed a patient's medical information to the patient's employer without consent
- Legal issues
- Breach of confidence (tort and implied contract); invasion of privacy
- Holding, findings, allegations or settlement terms
- Judicial holding (per summaries): complaint stated claims; physician has a duty not to make extra-judicial disclosures
- Consequences recorded
- n/a (reversal of dismissal)
- Procedural status
- Final (precedent)
- Precedential?
- Yes (state supreme court)
- Why it is in this research
- Private claims for unauthorized disclosure, e.g., in review replies (application inferred)
State of Alabama v. Aurora IV and Wellness (TRO)
Cullman County Circuit Court (Alabama AG plaintiff) · AL (state AG) · TRO signed 2025-11 (press release 2025-11-10)
- Provider type
- IV and wellness clinic
- Relevant facts
- ALLEGED: injected research-grade tirzepatide/semaglutide advertised as pharmaceutical-grade without patients' knowledge
- Legal issues
- Alabama Deceptive Trade Practices Act
- Holding, findings, allegations or settlement terms
- Settlement (no adjudicated findings), 2026-01-12, after a November 2025 TRO with asset freeze; Deceptive Trade Practices Act case over research-grade GLP-1 drugs (not a privacy case)
- Consequences recorded
- $17,267.50 to complaining consumers; $7,000 penalties and fees to the State; clinic permanently closed; owners barred from direct-patient health care work; nursing license surrendered
- Procedural status
- Closed (settlement announced 2026-01-12; V-019). CORRECTED from 'Pending/unknown'.
- Precedential?
- No
- Why it is in this research
- AG consumer-protection action against a wellness/aesthetic-adjacent clinic
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
AL-001. Ala. HB 351 (2026), secs. 3, 4(a)(6)-(8), 11, 12
Alabama Personal Data Protection Act (HB 351, 2026 Regular Session), enacted; NOT YET EFFECTIVE (effective May 1, 2027). Applies to controllers of more than 25,000 consumers (excluding payment-only data) or deriving more than 25% of revenue from selling personal data. Exempts at ENTITY level HIPAA covered entities and business associates (45 CFR 160.103), businesses with fewer than 500 employees that do not sell personal data, and small nonprofits; PHI is exempt data. Sensitive data (mental or physical health condition or diagnosis; biometric data) requires consent. AG enforces with a 45-day notice-and-cure; up to $15,000 per violation; no rulemaking.
Statute (enrolled act) · Explicit (enrolled text) · High · Act number (2026-552 per a secondary tracker) not verified. Act is silent on private actions. Small-business exemption likely removes most med spas (inference).
https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf
AL-002. Ala. Code 8-38-2(6); 8-38-3; 8-38-5; 8-38-6
Alabama Data Breach Notification Act: 'sensitive personally identifying information' includes medical history, mental or physical condition, medical treatment or diagnosis, and health insurance identifiers; covered entities must notify within 45 days of determining a breach reasonably likely to cause substantial harm; AG notice within 45 days if more than 1,000 individuals; reasonable security measures required.
Statute · Explicit · Medium-High · Copy hosted by a state agency (not the Code publisher). Medical information IS covered.
https://acua.alabama.gov/PDF/law/AlabamaDataBreachNotificationAct.pdf
AL-003. Ala. Code 8-38-9; 8-38-11
Alabama breach enforcement and HIPAA: violations are unlawful trade practices under the DTPA (AG exclusive; no private action under 8-19-10; DTPA penalties capped at $500,000 per breach; plus up to $5,000 per day of failure to take reasonable action on notice). An entity regulated by federal breach rules is exempt if it maintains those procedures, notifies under them and timely sends the AG a copy when more than 1,000 are notified.
Statute · Explicit · Medium-High · HIPAA practices must still copy the AG for breaches over 1,000 (key difference from TN/KY). Common-law rights preserved.
https://acua.alabama.gov/PDF/law/AlabamaDataBreachNotificationAct.pdf
AL-004. Horne v. Patton, 291 Ala. 701, 287 So. 2d 824 (1973)
Alabama Supreme Court: a physician owes a duty not to make extra-judicial disclosures of information acquired in the physician-patient relationship; unauthorized disclosure to an employer stated claims for breach of confidence (tort and implied contract) and invasion of privacy.
Judicial decision · Holding per opinion summaries (opinion not fully read) · Medium-High · Supports private claims over review replies that disclose patient information (application inferred).
https://law.justia.com/cases/alabama/supreme-court/1973/287-so-2d-824-1.html
AL-005. Ala. Admin. Code r. 540-X-11-.02(5)-(9), -.04
BME laser/energy-device rule: physicians may delegate non-ablative treatments by written protocol to Level 1 (PA, CRNP, RN) or Level 2 (LPN, medical assistant, aesthetician, cosmetologist, laser technician) delegates; supervision must include signed informed consent, annual protocol review, complication care and annual skills evaluation; on-site supervision (physician in the same building) or, for Level 1 delegates only, 'locally remote' supervision by board-certified, trained physicians.
Regulation · Explicit · High · Medical Licensure Commission grounds 34-24-360 (unprofessional conduct) not read in full (U-73).
https://admincode.legislature.state.al.us/api/chapter/540-X-11
AL-006. State v. Aurora IV and Wellness (Cullman Cty. Cir. Ct.)
Alabama AG obtained a TRO with asset freeze (Cullman County Circuit Court, Nov. 2025) against an IV and wellness clinic ALLEGED to have injected research-grade GLP-1 drugs advertised as pharmaceutical-grade, under the DTPA; the case SETTLED on 2026-01-12 ($17,267.50 restitution to consumers, $7,000 to the State, clinic closed, owners barred from direct-patient health care work, nursing license surrendered) without adjudicated findings.
Enforcement (state AG; TRO = allegations) · Explicit (press release) · High · Settlement terms from the AG press release (V-019). Deceptive-trade-practices and med spa safety, not a privacy case.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
V-019. V-019
This reference id is cited in the publication and is not a row in the claim register supplied with it.
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All