What a provider can and can't say in Alaska
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 40.967(12) (negligence suffices); no board decision located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Partly: 40.967 is a medical-board rule; dental grounds not read | 40.967(12) (negligence suffices); no board decision located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 40.967(12) (negligence suffices); no board decision located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 40.967(12) (negligence suffices); no board decision located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 40.967(12) (negligence suffices); no board decision located |
- Consumer privacy and health data law: Alaska has no comprehensive consumer privacy law in force as of October 22, 2026. Status of proposals: HB 367 died 2026-05-20. Bills are not law. [AK-001]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: attorney general only for no-harm determinations. [AK-002]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules. [AK-003]
- Patient confidentiality duties: Board rules reach intentional or even negligent disclosures (12 AAC 40.967(12): intentional or negligent). [AK-003]
- Lawsuits by individuals: A limited right to sue may exist (Chizmar).† [AK-007]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (Procedure rules (binding) plus draft guidance). [AK-005, AK-006]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [AK-003, U-97]
- Research notes and gaps: Dental board confidentiality grounds were not read in this research (a gap). [U-98]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [AK-001] HB 367 (34th Leg.) (https://www.akleg.gov/basis/Bill/Detail/34?Root=hb367)
- [AK-002] AS 45.48.010(a)-(c), .040, .080(b), .090(2), (7) (https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090)
- [AK-003] 12 AAC 40.967(9)-(12); AS 08.64.326(a)(3), (7), (9) (https://www.akleg.gov/basis/aac.asp?media=print&secStart=12.40.967&secEnd=12.40.967)
- [AK-005] 12 AAC 40.967(8), (31), (32); 12 AAC 40.920(a), (f)(14) (https://www.akleg.gov/basis/aac.asp?media=print&secStart=12.40.967&secEnd=12.40.967)
- [AK-006] Medical Spa Services Work Group, Esthetics Procedures Continuum (Feb. 2025) (https://www.commerce.alaska.gov/web/Portals/5/pub/Archive26/BoardMeetings/MedSpaWorkGroup_EstheticsContinuum_2025_02.pdf)
- [AK-007] Chizmar v. Mackie, 896 P.2d 196 (Alaska 1995) (https://law.justia.com/cases/alaska/supreme-court/1995/s-5232-1.html)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Alaska (AK) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | 12 AAC 40.967(12) intentional or NEGLIGENT disclosure of confidential patient information (medical board licensees); Chizmar common-law discussion | Yes - applies to licensed providers regardless of HIPAA status | None enacted (HB 367 died 2026-05-20) | AS 45.48: medical info NOT covered; AG notice only for no-harm determinations; $500/resident cap $50,000 | 40.967(12) (negligence suffices); no board decision located | HIPAA if covered; 40.967(12); likeness common law (not researched) | None statutory located (common law not researched) | Partly: Chizmar recognizes emotional-distress recovery for breach of confidentiality (privileged on its facts) | State Medical Board, Board of Dental Examiners, Board of Nursing, Board of Barbers and Hairdressers (estheticians), AG | AS 08.01.075 civil fine up to $5,000; breach $500/resident, $50,000 cap | E4 | Medium-High | 2026-10-22 |
| Alaska (AK) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | 12 AAC 40.967(12) intentional or NEGLIGENT disclosure of confidential patient information (medical board licensees); Chizmar common-law discussion | Partly: 40.967 is a medical-board rule; dental grounds not read | None enacted (HB 367 died 2026-05-20) | AS 45.48: medical info NOT covered; AG notice only for no-harm determinations; $500/resident cap $50,000 | 40.967(12) (negligence suffices); no board decision located | HIPAA if covered; 40.967(12); likeness common law (not researched) | None statutory located (common law not researched) | Partly: Chizmar recognizes emotional-distress recovery for breach of confidentiality (privileged on its facts) | State Medical Board, Board of Dental Examiners, Board of Nursing, Board of Barbers and Hairdressers (estheticians), AG | AS 08.01.075 civil fine up to $5,000; breach $500/resident, $50,000 cap | E4 | Medium-High | 2026-10-22 |
| Alaska (AK) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | 12 AAC 40.967(12) intentional or NEGLIGENT disclosure of confidential patient information (medical board licensees); Chizmar common-law discussion | Yes - applies to licensed providers regardless of HIPAA status | None enacted (HB 367 died 2026-05-20) | AS 45.48: medical info NOT covered; AG notice only for no-harm determinations; $500/resident cap $50,000 | 40.967(12) (negligence suffices); no board decision located | HIPAA if covered; 40.967(12); likeness common law (not researched) | None statutory located (common law not researched) | Partly: Chizmar recognizes emotional-distress recovery for breach of confidentiality (privileged on its facts) | State Medical Board, Board of Dental Examiners, Board of Nursing, Board of Barbers and Hairdressers (estheticians), AG | AS 08.01.075 civil fine up to $5,000; breach $500/resident, $50,000 cap | E4 | Medium-High | 2026-10-22 |
| Alaska (AK) | Medical med spa | Depends; cash-only med spas often not covered | 12 AAC 40.967(12) intentional or NEGLIGENT disclosure of confidential patient information (medical board licensees); Chizmar common-law discussion | Yes - applies to licensed providers regardless of HIPAA status | None enacted (HB 367 died 2026-05-20) | AS 45.48: medical info NOT covered; AG notice only for no-harm determinations; $500/resident cap $50,000 | 40.967(12) (negligence suffices); no board decision located | HIPAA if covered; 40.967(12); likeness common law (not researched) | None statutory located (common law not researched) | Partly: Chizmar recognizes emotional-distress recovery for breach of confidentiality (privileged on its facts) | State Medical Board, Board of Dental Examiners, Board of Nursing, Board of Barbers and Hairdressers (estheticians), AG | AS 08.01.075 civil fine up to $5,000; breach $500/resident, $50,000 cap | E4 | Medium-High | 2026-10-22 |
| Alaska (AK) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | 12 AAC 40.967(12) intentional or NEGLIGENT disclosure of confidential patient information (medical board licensees); Chizmar common-law discussion | No | None enacted (HB 367 died 2026-05-20) | AS 45.48: medical info NOT covered; AG notice only for no-harm determinations; $500/resident cap $50,000 | 40.967(12) (negligence suffices); no board decision located | HIPAA if covered; 40.967(12); likeness common law (not researched) | None statutory located (common law not researched) | Partly: Chizmar recognizes emotional-distress recovery for breach of confidentiality (privileged on its facts) | State Medical Board, Board of Dental Examiners, Board of Nursing, Board of Barbers and Hairdressers (estheticians), AG | AS 08.01.075 civil fine up to $5,000; breach $500/resident, $50,000 cap | E4 | Medium-High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Chizmar v. Mackie
Alaska Supreme Court · AK · 1995-05-19
- Provider type
- Physician
- Relevant facts
- Physician told the patient's husband of a (false-positive) HIV screening result without her consent
- Legal issues
- Breach of duty of confidentiality; negligent infliction of emotional distress; Alaska constitutional privacy
- Holding, findings, allegations or settlement terms
- Judicial holding: emotional-distress damages recoverable without physical injury where a preexisting duty exists; constitutional privacy does not reach private parties; disclosure to spouse privileged as a matter of law
- Consequences recorded
- Directed verdict on confidentiality claim affirmed; NIED claim remanded
- Procedural status
- Final
- Precedential?
- Yes (Alaska Supreme Court)
- Why it is in this research
- Confirms a common-law confidentiality theory exists but privileged disclosures defeat it
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
AK-001. HB 367 (34th Leg.)
No comprehensive consumer privacy law. HB 367 (Consumer Data Privacy Act, 34th Legislature) was introduced 2026-02-23, reported as CSHB 367(JUD) and referred to House Finance on 2026-05-12, and died when the session adjourned on 2026-05-20. Proposed bills are not law.
Legislative history · Explicit (status page via search index; sponsor statement per Privacy Daily) · Medium-High · akleg.gov bill page returned 403 to curl; status read from the official page as indexed. Committee substitute would have used 35,000 / 10,000+20% thresholds (secondary).
AK-002. AS 45.48.010(a)-(c), .040, .080(b), .090(2), (7)
Breach law (Personal Information Protection Act): 'personal information' = name plus SSN, driver's license/state ID, account or card number (with code if required), or financial-account passwords/PINs; medical information NOT covered. Notice in the most expeditious time possible; notice is excused only if, after investigation AND written notice to the AG, there is no reasonable likelihood of harm (documented, kept 5 years); consumer reporting agencies if more than 1,000; 'covered person' includes any person doing business. Non-government violators: unfair trade practice, but civil penalty capped at $500 per resident not notified, $50,000 total, and private damages limited to actual economic damages. No HIPAA deemed-compliance provision located.
Statute · Explicit · High · Read via fetch tool (print view). Maximum, not typical.
https://www.akleg.gov/basis/statutes.asp?media=print&secStart=45.48.010&secEnd=45.48.090
AK-003. 12 AAC 40.967(9)-(12); AS 08.64.326(a)(3), (7), (9)
State Medical Board regulation: 'unprofessional conduct' includes 'intentionally or negligently releasing or disclosing confidential patient information', except disclosures required by state or federal law or necessary to prevent an imminent risk of harm to the patient or others; also failing to keep accurate records and releasing records only as allowed. Unprofessional conduct and violation of a board regulation are statutory grounds for sanctions; false or misleading advertising is a separate ground.
Regulation + statute · Explicit · High · Negligent disclosure is enough (no 'willful' element), which is a lower threshold than KS, WV or D.C. (inference from text). No board decision applying (12) to a review reply located (E4).
https://www.akleg.gov/basis/aac.asp?media=print&secStart=12.40.967&secEnd=12.40.967
AK-007. Chizmar v. Mackie, 896 P.2d 196 (Alaska 1995)
Chizmar v. Mackie: the court found persuasive authority that a physician's breach of the duty of confidentiality supports emotional-distress damages, but held disclosure of an AIDS diagnosis to the patient's spouse privileged as a matter of law; it also held that Alaska's constitutional right to privacy (art. I, sec. 22) restrains government, not private parties (Luedtke).
Case law · Explicit · Medium-High · Read via Justia (secondary). The confidentiality discussion supports a common-law remedy but the holding on the facts was a privilege (characterize carefully).
https://law.justia.com/cases/alaska/supreme-court/1995/s-5232-1.html
AK-005. 12 AAC 40.967(8), (31), (32); 12 AAC 40.920(a), (f)(14)
Cosmetic procedures and delegation: unprofessional conduct includes permitting botulinum toxin, dermal filler, autotransplanted biological materials, chemical peels below the dermal layer, or hot lasers by anyone who is not an appropriate AS 08-licensed provider trained for the treatment. Physicians and PAs may delegate routine duties only under listed conditions (assessment, stable patient, documented training, written instructions); injectable medications may be delegated only as a single IM, intradermal or subcutaneous injection with the delegating licensee immediately available on site.
Regulation · Explicit · High · Binding. 12 AAC 40.920 text read from the Board's official delegation-regulations PDF (commerce.alaska.gov). Board of Nursing Botox position statement (Dec. 2017) is guidance and was not read (scanned).
https://www.akleg.gov/basis/aac.asp?media=print&secStart=12.40.967&secEnd=12.40.967
AK-006. Medical Spa Services Work Group, Esthetics Procedures Continuum (Feb. 2025)
Medical Spa Services Work Group 'Esthetics Procedures Continuum' (Feb. 2025): states it is a working draft that does not reflect board decision-making or define current requirements; recommends a statute for continuing education and a new 900+ hour advanced-esthetician license, and asks the Medical Board and Board of Nursing to clarify delegated duties (cosmetic injectables, ablative-laser hair removal, deep peels, Class 3 devices remain under medical supervision).
Guidance (work-group recommendation) · Explicit (guidance) · High · Not binding; no resulting statute or rule located (U-89).
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All