What a provider can and can't say in California
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | CMIA 56.10(a) bars disclosure; no exception for responding to reviews; OCR New Vision Dental (CA) federal case |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | CMIA 56.10(a) bars disclosure; no exception for responding to reviews; OCR New Vision Dental (CA) federal case |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | CMIA 56.10(a) bars disclosure; no exception for responding to reviews; OCR New Vision Dental (CA) federal case |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | CMIA 56.10(a) bars disclosure; no exception for responding to reviews; OCR New Vision Dental (CA) federal case |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Generally not CMIA provider (Div. 3 licensees) unless a 56.06 deemed provider; CCPA if thresholds met | CMIA 56.10(a) bars disclosure; no exception for responding to reviews; OCR New Vision Dental (CA) federal case |
- Consumer privacy and health data law: California has a consumer privacy law in force (CCPA/CPRA (thresholds); CMIA 56.06 for apps). It exempts only HIPAA-protected health information (a data-level exemption), so a covered practice's other data, such as website or marketing data, can still fall under it. [CA-009]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general if more than 500 residents affected. [CA-010]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (CMIA). [CA-001, CA-002]
- Patient confidentiality duties: The state confidentiality law applies to licensed providers (Statute plus B&P 2263 (willful unauthorized violation of confidence)). [CA-007]
- Lawsuits by individuals: Patients may be able to sue in some situations (56.35 (economic loss or personal injury) and 56.36(b) ($1,000 nominal for negligent release; actual damages need not be shown)). [CA-005]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (Civ. 3344). [CA-005, CA-008]
- Med spa rules: Med spas: only agency guidance was found (Medical Board of California med spa publications; no med-spa-specific law); the binding rules are the general professional practice acts. [CA-016]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2). Not finding enforcement does not mean none exists. [CA-011, CA-012]
Sources:
- [CA-001] Cal. Civ. Code 56.10(a) (https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=56.10)
- [CA-002] Cal. Civ. Code 56.05 'Provider of health care' (https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=56.05)
- [CA-005] Cal. Civ. Code 56.35; 56.36(b), (e) (https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=56.35)
- [CA-007] Cal. Bus. & Prof. Code 2263 (https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=2263)
- [CA-008] Cal. Civ. Code 3344 (a)(1), (a)(2) (https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=3344)
- [CA-009] Cal. Civ. Code 1798.140, 1798.146; CPPA adjustment 1798.146(a) (https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.140)
- [CA-010] Cal. Civ. Code 1798.82 (a),(f) (https://downloads.leginfo.legislature.ca.gov/ (pubinfo bulk data: SB 446 chaptered text))
- [CA-011] People v. Adventist Health Hanford (AG press release) (https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-against-adventist-over-unauthorized)
- [CA-012] Jane Does One-Six v. Gary Motykie, M.D., et al., No. 23STCV13325 (L.A. Super. Ct.) (https://www.gmmddatalitigation.com/)
- [CA-016] Medical Board of California, 'Medical Spas' and 'Medical Spas: Business' publications (https://www.mbc.ca.gov/Download/Documents/medical-spas-business.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| California (CA) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | CMIA Civ. 56.10 (authorization required); B&P 2263 | Yes - applies to licensed providers regardless of HIPAA status | CCPA/CPRA for non-exempt data/businesses meeting thresholds; CMIA 56.06 for apps/digital services | Civ. 1798.82: health/medical info covered; 30 calendar days (SB 446, ch. 319, official text); AG sample copy within 15 days if >500; H&S 1280.15: licensed clinics/facilities report to CDPH and patient within 15 business days | CMIA 56.10(a) bars disclosure; no exception for responding to reviews; OCR New Vision Dental (CA) federal case | CMIA authorization (56.11) and 56.10(d) marketing limits; Civ. 3344 consent for advertising use | Civ. 3344 (greater of $750 or actual damages + profits + punitive + fees) | Yes: Civ. 56.35 (requires economic loss or personal injury) and 56.36(b) ($1,000 nominal damages for negligent release, no actual damages needed; 56.36(e) defense for CE/BA releases); Civ. 3344; CCPA 1798.150 for security breaches only | Medical Board, Dental Board, BRN, CPPA, AG, DAs/city attorneys, CDPH (facilities) | CMIA 56.36(c): negligent up to $2,500; knowing/willful up to $25,000 (licensees $2,500/$10,000/$25,000 by offense); financial gain up to $250,000 (licensees $5,000/$25,000/$250,000) plus disgorgement; CCPA admin fines $2,663/$7,988 | E1 (federal OCR New Vision Dental, CA); E2 (AG Adventist settlement); E3 (Motykie class action allegations) | Medium (official code site blocked; Justia 2025 code used) | 2026-10-22 |
| California (CA) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | CMIA Civ. 56.10 (authorization required); B&P 2263 | Yes - applies to licensed providers regardless of HIPAA status | CCPA/CPRA for non-exempt data/businesses meeting thresholds; CMIA 56.06 for apps/digital services | Civ. 1798.82: health/medical info covered; 30 calendar days (SB 446, ch. 319, official text); AG sample copy within 15 days if >500; H&S 1280.15: licensed clinics/facilities report to CDPH and patient within 15 business days | CMIA 56.10(a) bars disclosure; no exception for responding to reviews; OCR New Vision Dental (CA) federal case | CMIA authorization (56.11) and 56.10(d) marketing limits; Civ. 3344 consent for advertising use | Civ. 3344 (greater of $750 or actual damages + profits + punitive + fees) | Yes: Civ. 56.35 (requires economic loss or personal injury) and 56.36(b) ($1,000 nominal damages for negligent release, no actual damages needed; 56.36(e) defense for CE/BA releases); Civ. 3344; CCPA 1798.150 for security breaches only | Medical Board, Dental Board, BRN, CPPA, AG, DAs/city attorneys, CDPH (facilities) | CMIA 56.36(c): negligent up to $2,500; knowing/willful up to $25,000 (licensees $2,500/$10,000/$25,000 by offense); financial gain up to $250,000 (licensees $5,000/$25,000/$250,000) plus disgorgement; CCPA admin fines $2,663/$7,988 | E1 (federal OCR New Vision Dental, CA); E2 (AG Adventist settlement); E3 (Motykie class action allegations) | Medium (official code site blocked; Justia 2025 code used) | 2026-10-22 |
| California (CA) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | CMIA Civ. 56.10 (authorization required); B&P 2263 | Yes - applies to licensed providers regardless of HIPAA status | CCPA/CPRA for non-exempt data/businesses meeting thresholds; CMIA 56.06 for apps/digital services | Civ. 1798.82: health/medical info covered; 30 calendar days (SB 446, ch. 319, official text); AG sample copy within 15 days if >500; H&S 1280.15: licensed clinics/facilities report to CDPH and patient within 15 business days | CMIA 56.10(a) bars disclosure; no exception for responding to reviews; OCR New Vision Dental (CA) federal case | CMIA authorization (56.11) and 56.10(d) marketing limits; Civ. 3344 consent for advertising use | Civ. 3344 (greater of $750 or actual damages + profits + punitive + fees) | Yes: Civ. 56.35 (requires economic loss or personal injury) and 56.36(b) ($1,000 nominal damages for negligent release, no actual damages needed; 56.36(e) defense for CE/BA releases); Civ. 3344; CCPA 1798.150 for security breaches only | Medical Board, Dental Board, BRN, CPPA, AG, DAs/city attorneys, CDPH (facilities) | CMIA 56.36(c): negligent up to $2,500; knowing/willful up to $25,000 (licensees $2,500/$10,000/$25,000 by offense); financial gain up to $250,000 (licensees $5,000/$25,000/$250,000) plus disgorgement; CCPA admin fines $2,663/$7,988 | E1 (federal OCR New Vision Dental, CA); E2 (AG Adventist settlement); E3 (Motykie class action allegations) | Medium (official code site blocked; Justia 2025 code used) | 2026-10-22 |
| California (CA) | Medical med spa | Depends; cash-only med spas often not covered | CMIA Civ. 56.10 (authorization required); B&P 2263 | Yes - applies to licensed providers regardless of HIPAA status | CCPA/CPRA for non-exempt data/businesses meeting thresholds; CMIA 56.06 for apps/digital services | Civ. 1798.82: health/medical info covered; 30 calendar days (SB 446, ch. 319, official text); AG sample copy within 15 days if >500; H&S 1280.15: licensed clinics/facilities report to CDPH and patient within 15 business days | CMIA 56.10(a) bars disclosure; no exception for responding to reviews; OCR New Vision Dental (CA) federal case | CMIA authorization (56.11) and 56.10(d) marketing limits; Civ. 3344 consent for advertising use | Civ. 3344 (greater of $750 or actual damages + profits + punitive + fees) | Yes: Civ. 56.35 (requires economic loss or personal injury) and 56.36(b) ($1,000 nominal damages for negligent release, no actual damages needed; 56.36(e) defense for CE/BA releases); Civ. 3344; CCPA 1798.150 for security breaches only | Medical Board, Dental Board, BRN, CPPA, AG, DAs/city attorneys, CDPH (facilities) | CMIA 56.36(c): negligent up to $2,500; knowing/willful up to $25,000 (licensees $2,500/$10,000/$25,000 by offense); financial gain up to $250,000 (licensees $5,000/$25,000/$250,000) plus disgorgement; CCPA admin fines $2,663/$7,988 | E1 (federal OCR New Vision Dental, CA); E2 (AG Adventist settlement); E3 (Motykie class action allegations) | Medium (official code site blocked; Justia 2025 code used) | 2026-10-22 |
| California (CA) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | CMIA Civ. 56.10 (authorization required); B&P 2263 | Generally not CMIA provider (Div. 3 licensees) unless a 56.06 deemed provider; CCPA if thresholds met | CCPA/CPRA for non-exempt data/businesses meeting thresholds; CMIA 56.06 for apps/digital services | Civ. 1798.82: health/medical info covered; 30 calendar days (SB 446, ch. 319, official text); AG sample copy within 15 days if >500; H&S 1280.15: licensed clinics/facilities report to CDPH and patient within 15 business days | CMIA 56.10(a) bars disclosure; no exception for responding to reviews; OCR New Vision Dental (CA) federal case | CMIA authorization (56.11) and 56.10(d) marketing limits; Civ. 3344 consent for advertising use | Civ. 3344 (greater of $750 or actual damages + profits + punitive + fees) | Yes: Civ. 56.35 (requires economic loss or personal injury) and 56.36(b) ($1,000 nominal damages for negligent release, no actual damages needed; 56.36(e) defense for CE/BA releases); Civ. 3344; CCPA 1798.150 for security breaches only | Medical Board, Dental Board, BRN, CPPA, AG, DAs/city attorneys, CDPH (facilities) | CMIA 56.36(c): negligent up to $2,500; knowing/willful up to $25,000 (licensees $2,500/$10,000/$25,000 by offense); financial gain up to $250,000 (licensees $5,000/$25,000/$250,000) plus disgorgement; CCPA admin fines $2,663/$7,988 | E1 (federal OCR New Vision Dental, CA); E2 (AG Adventist settlement); E3 (Motykie class action allegations) | Medium (official code site blocked; Justia 2025 code used) | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
New Vision Dental (B. Brandon Au DDS Inc.)
HHS OCR · CA (federal action) · 2022-12-14
- Provider type
- Dental
- Relevant facts
- Yelp replies disclosed names, treatment, insurance
- Legal issues
- 45 CFR 164.502(a), 164.520(b), 164.530(i)
- Holding, findings, allegations or settlement terms
- Settlement (no admission); admission of liability: No
- Consequences recorded
- $23,000; Remove posts; breach notices; 2-year monitoring
- Procedural status
- Closed: resolution agreement; CAP monitoring period (status not re-checked)
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Review response
People v. Adventist Health Hanford
CA Attorney General · CA · 2024-06-19
- Provider type
- Hospital
- Relevant facts
- Disclosure of patient information to law enforcement
- Legal issues
- CMIA; UCL
- Holding, findings, allegations or settlement terms
- Settlement; admission of liability: Not reviewed
- Consequences recorded
- $10,000 civil penalties + injunctive terms; Policy/training terms
- Procedural status
- Judgment entered (per AG release)
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- State CMIA enforcement example
Jane Does One-Six v. Gary Motykie, M.D., et al.
L.A. County Superior Court No. 23STCV13325 · CA · 2023 (filed)
- Provider type
- Plastic surgery
- Relevant facts
- Alleged inadequate security; before/after photos exfiltrated and published
- Legal issues
- Allegations (claims not verified from complaint)
- Holding, findings, allegations or settlement terms
- Allegations only; court has not ruled on merits; admission of liability: Defendants deny
- Consequences recorded
- None / unknown
- Procedural status
- Pending; court-approved notice says no merits ruling; defendants deny (V-021).
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Breach of photo data
Related pages
Topics
Sources
CA-009. Cal. Civ. Code 1798.140, 1798.146; CPPA adjustment
CCPA/CPRA exempts CMIA medical information and HIPAA PHI, and exempts providers/covered entities to the extent they maintain patient information in the same manner; applies only to businesses meeting thresholds (revenue $26,625,000 as adjusted for 2025).
Statute / Regulation · Explicit · Medium · Official text from the California Legislative Counsel bulk database (pubinfo, data as of 2026-10-18), read 2026-10-22 (U-11 closed for this section). The $26,625,000 threshold is the CPPA 2025 adjustment and was not re-read. Non-HIPAA aesthetic businesses meeting thresholds are subject to CCPA, including sensitive personal information rules. [Audit D 2026-10-22: reader link changed from the official bulk-data zip (where the text was read) to the official section page]
https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.140
CA-010. Cal. Civ. Code 1798.82
Breach notice (1798.82) as amended by SB 446 (Stats. 2025, ch. 319, chaptered 2025-10-03): consumer notice within 30 calendar days of discovery or notification (delay allowed for law enforcement or to determine scope and restore integrity); AG sample copy within 15 calendar days of consumer notice if >500 residents; HIPAA covered entities complying with HITECH are deemed compliant only with the notice-content requirements of subdivision (d).
Statute · Explicit (bill text via search) · High · Verified from official Legislature bulk bill text (chaptered version). Closes U-12.
https://downloads.leginfo.legislature.ca.gov/ (pubinfo bulk data: SB 446 chaptered text)
CA-001. Cal. Civ. Code 56.10(a)
CMIA prohibits a provider of health care from disclosing medical information without authorization except as compelled or permitted by 56.10(b)-(c).
Statute · Explicit · High · Official text from the California Legislative Counsel bulk database (pubinfo, data as of 2026-10-18), read 2026-10-22 (U-11 closed for this section). [Audit D 2026-10-22: reader link changed from the official bulk-data zip (where the text was read) to the official section page]
https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=56.10
CA-002. Cal. Civ. Code 56.05
CMIA 'provider of health care' includes persons licensed under Business & Professions Code Division 2 (physicians, dentists, nurses, PAs) and licensed clinics; applies regardless of HIPAA status.
Statute · Explicit · High · Official text from the California Legislative Counsel bulk database (pubinfo, data as of 2026-10-18), read 2026-10-22 (U-11 closed for this section). [Audit D 2026-10-22: reader link changed from the official bulk-data zip (where the text was read) to the official section page]
https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=56.05
CA-007. Cal. Bus. & Prof. Code 2263
Willful, unauthorized violation of professional confidence is unprofessional conduct for Medical Board licensees.
Statute · Explicit · High · Official text from the California Legislative Counsel bulk database (pubinfo, data as of 2026-10-18), read 2026-10-22 (U-11 closed for this section). [Audit D 2026-10-22: reader link changed from the official bulk-data zip (where the text was read) to the official section page]
https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=2263
CA-005. Cal. Civ. Code 56.35; 56.36(b), (e)
CMIA private actions: (1) under 56.35, a patient whose medical information was used or disclosed in violation of 56.10 (and listed sections) AND who sustained economic loss or personal injury may recover compensatory damages, punitive damages up to $3,000, attorney's fees up to $1,000 and costs; (2) under 56.36(b), anyone whose information was NEGLIGENTLY released may recover $1,000 nominal damages without proving actual damages, plus any actual damages. Under 56.36(e), nominal damages are unavailable if a HIPAA covered entity or business associate shows the release went only to another covered entity or business associate, required notices were given, and it was not medical identity theft.
Statute · Explicit · High · CORRECTED 2026-10-22 (V-034): earlier text omitted the economic-loss condition in 56.35 and the 56.36(e) defense. Courts have required that information actually be viewed for 56.36 claims (secondary; not re-verified). Official text from the California Legislative Counsel bulk database (pubinfo, data as of 2026-10-18), read 2026-10-22 (U-11 closed for this section). [Audit D 2026-10-22: reader link changed from the official bulk-data zip (where the text was read) to the official section page]
https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=56.35
CA-008. Cal. Civ. Code 3344
Knowing use of another's name, voice, signature, photograph or likeness for advertising or selling without prior consent: liability for the greater of $750 or actual damages, plus attributable profits, punitive damages, and attorney's fees and costs to the prevailing party. Since 2026-01-01 (SB 683) a court may issue an injunction or TRO, and a respondent ordered to remove the likeness must do so within two business days of service.
Statute · Explicit · High · Verified 2026-10-22 (V-036). Applies to any business, including nonmedical aesthetics. Official text from the California Legislative Counsel bulk database (pubinfo, data as of 2026-10-18), read 2026-10-22 (U-11 closed for this section). [Audit D 2026-10-22: reader link changed from the official bulk-data zip (where the text was read) to the official section page]
https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=3344
CA-016. Medical Board of California, 'Medical Spas' and 'Medical Spas: Business' publications
Med spa: no med-spa-specific statute or regulation located. The Medical Board of California's medical spa publications (guidance) state that procedures that alter or damage living tissue (e.g., lasers, injectables) are the practice of medicine under the Medical Practice Act, and that lay ownership of a medical practice is not allowed (corporate practice of medicine).
Agency guidance (interpreting binding statute) · Explicit (guidance); binding effect rests on B&P 2052 and the corporate practice bar (not re-read) · Medium · Med spa pass, final phase part 2 (2026-10-22). Guidance only. B&P 2052 and 2400 not re-read in this pass (V-054).
https://www.mbc.ca.gov/Download/Documents/medical-spas-business.pdf
CA-011. People v. Adventist Health Hanford (AG press release)
California AG settled with Adventist Health Hanford over disclosure of patient information to law enforcement, including $10,000 civil penalties and injunctive terms.
Settlement · Explicit · High · Settlement, not finding; not a cosmetic practice.
CA-012. Jane Does One-Six v. Gary Motykie, M.D., et al., No. 23STCV13325 (L.A. Super. Ct.)
Putative class action alleges a Beverly Hills plastic surgeon's practice failed to safeguard data, leading to cybercriminal publication of before/after photos; court has not ruled on merits; defendants deny.
Litigation (allegations) · Explicit (court-approved notice) · Medium · Allegations only; outcome unknown as of 2026-10-22.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
V-021. V-021
This reference id is cited in the publication and is not a row in the claim register supplied with it.