What a provider can and can't say in Arizona
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | No state rule specific to reviews; 12-2292 and board unprofessional-conduct provisions (32-1401(27)(b); 32-1201.01(1)) bar unauthorized disclosure |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | No state rule specific to reviews; 12-2292 and board unprofessional-conduct provisions (32-1401(27)(b); 32-1201.01(1)) bar unauthorized disclosure |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | No state rule specific to reviews; 12-2292 and board unprofessional-conduct provisions (32-1401(27)(b); 32-1201.01(1)) bar unauthorized disclosure |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | No state rule specific to reviews; 12-2292 and board unprofessional-conduct provisions (32-1401(27)(b); 32-1201.01(1)) bar unauthorized disclosure |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Unclear: applies only to title-32 licensees who maintain medical records; estheticians/laser techs unresolved | No state rule specific to reviews; 12-2292 and board unprofessional-conduct provisions (32-1401(27)(b); 32-1201.01(1)) bar unauthorized disclosure |
- Consumer privacy and health data law: Arizona has no comprehensive consumer privacy law in force as of October 22, 2026. [AZ-011]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general if more than 1,000 residents affected; HIPAA entities exempt. [AZ-008, AZ-009]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (12-2292). [AZ-001, AZ-002]
- Patient confidentiality duties: The state confidentiality law applies to licensed providers (no mental state needed for duty). [AZ-001, AZ-005]
- Lawsuits by individuals: Court decisions recognize patient privacy or confidentiality lawsuits in some situations (negligent disclosure allowed (Shepherd v. Costco 2021); 12-2296 good-faith immunity is a defense). [AZ-014, AZ-004]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (laser statute). [AZ-010]
- Enforcement located: Strongest state enforcement evidence located: allegations or media reports only (E3). Not finding enforcement does not mean none exists.† [AZ-012]
- Research notes and gaps: Arizona presumes providers acted in good faith under its medical records law; a patient must overcome that presumption with clear and convincing evidence. [AZ-004]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [AZ-001] A.R.S. 12-2292(A) (https://www.azleg.gov/ars/12/02292.htm)
- [AZ-002] A.R.S. 12-2291(5) (5)(a)-(b) (https://www.azleg.gov/ars/12/02291.htm)
- [AZ-004] A.R.S. 12-2296 (https://www.azleg.gov/ars/12/02296.htm)
- [AZ-005] A.R.S. 32-1401(27)(a)-(c) (27)(a),(b),(c) (https://www.azleg.gov/ars/32/01401.htm)
- [AZ-008] A.R.S. 18-551, 18-552 18-551 'specified data element' (e),(f); 18-552(B),(B)(2) (https://www.azleg.gov/ars/18/00552.htm)
- [AZ-009] A.R.S. 18-552(L) (https://www.azleg.gov/ars/18/00552.htm)
- [AZ-010] A.R.S. 32-3233 (A)-(J) (https://www.azleg.gov/ars/32/03233.htm)
- [AZ-011] n/a (https://www.azleg.gov/arstitle/)
- [AZ-012] DrBicuspid (Aug. 26, 2019) (https://www.drbicuspid.com/)
- [AZ-014] Shepherd v. Costco Wholesale Corp., 250 Ariz. 511, 482 P.3d 390 (2021) paras. 27, 31-33 (https://www.azcourts.gov/Portals/0/OpinionFiles/Supreme/2021/ASC-CV190144%20-%203-8-2021%20-%20FILED%20-%20OPINION.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Arizona (AZ) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | A.R.S. 12-2292/12-2294 (medical records confidential; authorization required) | Yes - applies to licensed providers regardless of HIPAA status | None located (no comprehensive or health-data privacy law) | A.R.S. 18-552: health data covered; 45 days; AG/CRA/AZDOHS if >1,000; HIPAA CEs/BAs exempt | No state rule specific to reviews; 12-2292 and board unprofessional-conduct provisions (32-1401(27)(b); 32-1201.01(1)) bar unauthorized disclosure | Written authorization under 12-2292/12-2294 for licensees; HIPAA 164.508 if covered; no AZ commercial-likeness statute for living persons located | None for living persons located (common-law appropriation; verify) | No express private right in 12-2292 located; common-law negligence for negligent disclosure recognized (Shepherd v. Costco, 250 Ariz. 511 (2021)), subject to 12-2296 good-faith immunity (plaintiff must rebut by clear and convincing evidence); Consumer Fraud Act 44-1522 private action implied by case law (not verified) | AZ Medical Board, Osteopathic Board, Dental Board, Nursing Board, ADHS (lasers), AG | Breach: lesser of $10,000/individual or economic loss, max $500,000/breach; licensing discipline | E2 (federal OCR cases nationally); E3 (2019 media-reported dental board review) | Medium | 2026-10-22 |
| Arizona (AZ) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | A.R.S. 12-2292/12-2294 (medical records confidential; authorization required) | Yes - applies to licensed providers regardless of HIPAA status | None located (no comprehensive or health-data privacy law) | A.R.S. 18-552: health data covered; 45 days; AG/CRA/AZDOHS if >1,000; HIPAA CEs/BAs exempt | No state rule specific to reviews; 12-2292 and board unprofessional-conduct provisions (32-1401(27)(b); 32-1201.01(1)) bar unauthorized disclosure | Written authorization under 12-2292/12-2294 for licensees; HIPAA 164.508 if covered; no AZ commercial-likeness statute for living persons located | None for living persons located (common-law appropriation; verify) | No express private right in 12-2292 located; common-law negligence for negligent disclosure recognized (Shepherd v. Costco, 250 Ariz. 511 (2021)), subject to 12-2296 good-faith immunity (plaintiff must rebut by clear and convincing evidence); Consumer Fraud Act 44-1522 private action implied by case law (not verified) | AZ Medical Board, Osteopathic Board, Dental Board, Nursing Board, ADHS (lasers), AG | Breach: lesser of $10,000/individual or economic loss, max $500,000/breach; licensing discipline | E2 (federal OCR cases nationally); E3 (2019 media-reported dental board review) | Medium | 2026-10-22 |
| Arizona (AZ) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | A.R.S. 12-2292/12-2294 (medical records confidential; authorization required) | Yes - applies to licensed providers regardless of HIPAA status | None located (no comprehensive or health-data privacy law) | A.R.S. 18-552: health data covered; 45 days; AG/CRA/AZDOHS if >1,000; HIPAA CEs/BAs exempt | No state rule specific to reviews; 12-2292 and board unprofessional-conduct provisions (32-1401(27)(b); 32-1201.01(1)) bar unauthorized disclosure | Written authorization under 12-2292/12-2294 for licensees; HIPAA 164.508 if covered; no AZ commercial-likeness statute for living persons located | None for living persons located (common-law appropriation; verify) | No express private right in 12-2292 located; common-law negligence for negligent disclosure recognized (Shepherd v. Costco, 250 Ariz. 511 (2021)), subject to 12-2296 good-faith immunity (plaintiff must rebut by clear and convincing evidence); Consumer Fraud Act 44-1522 private action implied by case law (not verified) | AZ Medical Board, Osteopathic Board, Dental Board, Nursing Board, ADHS (lasers), AG | Breach: lesser of $10,000/individual or economic loss, max $500,000/breach; licensing discipline | E2 (federal OCR cases nationally); E3 (2019 media-reported dental board review) | Medium | 2026-10-22 |
| Arizona (AZ) | Medical med spa | Depends; cash-only med spas often not covered | A.R.S. 12-2292/12-2294 (medical records confidential; authorization required) | Yes - applies to licensed providers regardless of HIPAA status | None located (no comprehensive or health-data privacy law) | A.R.S. 18-552: health data covered; 45 days; AG/CRA/AZDOHS if >1,000; HIPAA CEs/BAs exempt | No state rule specific to reviews; 12-2292 and board unprofessional-conduct provisions (32-1401(27)(b); 32-1201.01(1)) bar unauthorized disclosure | Written authorization under 12-2292/12-2294 for licensees; HIPAA 164.508 if covered; no AZ commercial-likeness statute for living persons located | None for living persons located (common-law appropriation; verify) | No express private right in 12-2292 located; common-law negligence for negligent disclosure recognized (Shepherd v. Costco, 250 Ariz. 511 (2021)), subject to 12-2296 good-faith immunity (plaintiff must rebut by clear and convincing evidence); Consumer Fraud Act 44-1522 private action implied by case law (not verified) | AZ Medical Board, Osteopathic Board, Dental Board, Nursing Board, ADHS (lasers), AG | Breach: lesser of $10,000/individual or economic loss, max $500,000/breach; licensing discipline | E2 (federal OCR cases nationally); E3 (2019 media-reported dental board review) | Medium | 2026-10-22 |
| Arizona (AZ) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | A.R.S. 12-2292/12-2294 (medical records confidential; authorization required) | Unclear: applies only to title-32 licensees who maintain medical records; estheticians/laser techs unresolved | None located (no comprehensive or health-data privacy law) | A.R.S. 18-552: health data covered; 45 days; AG/CRA/AZDOHS if >1,000; HIPAA CEs/BAs exempt | No state rule specific to reviews; 12-2292 and board unprofessional-conduct provisions (32-1401(27)(b); 32-1201.01(1)) bar unauthorized disclosure | Written authorization under 12-2292/12-2294 for licensees; HIPAA 164.508 if covered; no AZ commercial-likeness statute for living persons located | None for living persons located (common-law appropriation; verify) | No express private right in 12-2292 located; common-law negligence for negligent disclosure recognized (Shepherd v. Costco, 250 Ariz. 511 (2021)), subject to 12-2296 good-faith immunity (plaintiff must rebut by clear and convincing evidence); Consumer Fraud Act 44-1522 private action implied by case law (not verified) | AZ Medical Board, Osteopathic Board, Dental Board, Nursing Board, ADHS (lasers), AG | Breach: lesser of $10,000/individual or economic loss, max $500,000/breach; licensing discipline | E2 (federal OCR cases nationally); E3 (2019 media-reported dental board review) | Medium | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Arizona dental board review of Gus Khalifa, DDS (media report)
AZ State Board of Dental Examiners · AZ · 2019-08-26 (report)
- Provider type
- Endodontics
- Relevant facts
- Yelp reply disclosed patient's last name and dental history; dentist claimed patient 'forfeited' confidentiality
- Legal issues
- A.R.S. 32-1201.01 (inferred)
- Holding, findings, allegations or settlement terms
- Investigation reported; outcome unverified
- Consequences recorded
- None / unknown
- Procedural status
- Unknown
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Review response; waiver myth
Shepherd v. Costco Wholesale Corp.
Arizona Supreme Court · AZ · 2021-03-08
- Provider type
- Pharmacy (licensed health care provider)
- Relevant facts
- Pharmacy staff disclosed a patient's E.D. prescription to his ex-wife, who told his children and friends
- Legal issues
- Negligent disclosure of medical information; HIPAA as standard of care; A.R.S. 12-2296 good-faith immunity
- Holding, findings, allegations or settlement terms
- Judicial holding: negligence claim may proceed; HIPAA may inform the standard of care; immunity is an affirmative defense; plaintiff must rebut the good-faith presumption by clear and convincing evidence
- Consequences recorded
- Dismissal reversed in part; remanded (no damages determined in the opinion)
- Procedural status
- Final appellate decision; later trial-court history not located
- Precedential?
- Yes (Arizona Supreme Court)
- Why it is in this research
- Private damages exposure for a practice whose staff or review replies disclose patient information (inference)
Related pages
Topics
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
AZ-011. n/a
No comprehensive consumer privacy or consumer health data statute was located in Arizona law as of 2026-10-22.
Search result (negative) · Inferred from search · Medium · Searched azleg.gov titles 18 and 44 and web for 'Arizona consumer data privacy act enacted'; 2026 session bills not exhaustively reviewed.
AZ-008. A.R.S. 18-551, 18-552
Breach notification covers medical or mental health treatment/diagnosis information and health insurance identifiers; notice within 45 days of determination; AG, CRAs, and ADHS-Homeland Security notice if >1,000 notified.
Statute · Explicit · High · Statute does not apply to HIPAA covered entities or business associates (18-552(N)) - entity-level exemption.
AZ-009. A.R.S. 18-552(L)
Only the AG enforces the breach statute; knowing and wilful violation: civil penalty up to the lesser of $10,000 per affected individual or total economic loss, max $500,000 per breach or series of related breaches.
Statute · Explicit · High · No private right of action under 18-552.
AZ-001. A.R.S. 12-2292(A)
Medical and payment records are privileged and confidential; a health care provider may disclose them only as authorized by state or federal law or written authorization.
Statute · Explicit · High · Applies to title-32 licensees who maintain medical records and to licensed health care institutions (12-2291(5)), regardless of HIPAA status.
AZ-002. A.R.S. 12-2291(5)
'Health care provider' for the medical records statute includes persons licensed under title 32 who maintain medical records and health care institutions licensed under 36-401.
Statute · Explicit · High · Laser technicians certified by ADHS and estheticians (cosmetology board, title 32 ch. 5) - whether they 'maintain medical records' is unresolved.
AZ-005. A.R.S. 32-1401(27)(a)-(c)
For allopathic physicians, intentionally disclosing a professional secret or privileged communication except as required by law, violating applicable federal/state law, and false or misleading advertising are unprofessional conduct.
Statute · Explicit · High · Arizona Medical Board enforces.
AZ-014. Shepherd v. Costco Wholesale Corp., 250 Ariz. 511, 482 P.3d 390 (2021)
Arizona Supreme Court: HIPAA creates no private right of action, but it does not bar a state-law negligence claim for negligent disclosure of medical information; HIPAA, professional regulations and the provider's own privacy policy may inform (but not by themselves establish) the standard of care. The 12-2296 good-faith immunity is an affirmative defense; the plaintiff need not plead around it but must ultimately rebut the presumption of good faith by clear and convincing evidence.
Case law · Explicit · High · Pharmacy facts (E.D. prescription disclosed to ex-wife). Supports a negligence claim against a provider whose review reply or post discloses patient information (application inferred). Whether A.R.S. 12-2292 itself creates a private action remains undecided (U-07). Added 2026-10-22 (V-047).
AZ-004. A.R.S. 12-2296
Providers acting in good faith under the medical records article are immune from liability; good faith is presumed but rebuttable by clear and convincing evidence.
Statute · Explicit · High · Whether 12-2292 by itself supports a private damages action is unresolved, but Shepherd v. Costco (Ariz. 2021) allows a common-law negligence claim for negligent disclosure, subject to this immunity (see AZ-014, U-07).
AZ-010. A.R.S. 32-3233
Laser/IPL cosmetic procedures by laser technicians require ADHS certification and supervision by a health professional (indirect for hair removal; direct for other cosmetic procedures).
Statute · Explicit · High · Scope/supervision law, not privacy law; relevant to whether a med spa's staff are health professionals subject to 12-2292.
AZ-012. DrBicuspid (Aug. 26, 2019)
Media reported (2019) that the Arizona dental board was reviewing an endodontist's Yelp reply disclosing a patient's dental history; outcome not verified.
Media report · Explicit (report) · Low · Allegation/investigation only; board outcome unverified.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All