What a provider can and can't say in Connecticut
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | Byrne tort; OCR Allergy Associates of Hartford (media statements, federal) |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | Byrne tort; OCR Allergy Associates of Hartford (media statements, federal) |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | Byrne tort; OCR Allergy Associates of Hartford (media statements, federal) |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | Byrne tort; OCR Allergy Associates of Hartford (media statements, federal) |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Byrne duty runs to health care providers; CTDPA 42-526 consumer health data applies to all persons | Byrne tort; OCR Allergy Associates of Hartford (media statements, federal) |
- Consumer privacy and health data law: Connecticut has a consumer privacy law in force (CTDPA plus 42-526 consumer health data (no threshold)). It exempts HIPAA-covered practices as a whole (an entity-level exemption). [CT-001, CT-002]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general.† [CT-006]
- Patient confidentiality duties: Patient confidentiality duties come mainly from court-recognized privacy claims (Byrne). [CT-007]
- Research notes and gaps: A specific board confidentiality ground was not read or not located; this is a research gap, not a finding that none exists. [U-98]
- Lawsuits by individuals: Court decisions recognize patient privacy or confidentiality lawsuits in some situations (Byrne). [CT-007, CT-004]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located.† [CT-006, U-98]
- Med spa rules: Med spas: there is med-spa-specific law (CGS 19a-903c (medical director; in-person assessment; who may perform; names posted)). [CT-009]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2). Not finding enforcement does not mean none exists. [CT-008]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [CT-001] Conn. Gen. Stat. 42-517 (a)(7), (b) (https://www.cga.ct.gov/current/pub/chap_743jj.htm)
- [CT-002] Conn. Gen. Stat. 42-526 (a), (b)(6) (https://www.cga.ct.gov/current/pub/chap_743jj.htm)
- [CT-004] Conn. Gen. Stat. 42-525 (https://www.cga.ct.gov/current/pub/chap_743jj.htm)
- [CT-006] Conn. Gen. Stat. 36a-701b (a)(2)(A)(vii)-(viii), (b), (h) (https://law.justia.com/codes/connecticut/title-36a/chapter-669/section-36a-701b/)
- [CT-007] 314 Conn. 433 (2014) (cite per CourtListener record 2014-11-11); 327 Conn. 540, 175 A.3d 1 (2018) pinpoints not verified (https://www.courtlistener.com/opinion/6482796/byrne-v-avery-ctr-for-obstetrics-gynecology-pc/)
- [CT-008] CT AG press release 2025 (https://portal.ct.gov/ag/press-releases/2025-press-releases/attorney-general-tong-announces-settlement-with-ticketnetwork)
- [CT-009] Conn. Gen. Stat. 19a-903c (P.A. 14-119; P.A. 15-242) (https://cga.ct.gov/2025/rpt/pdf/2025-R-0159.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Connecticut (CT) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Byrne v. Avery (2018) common-law confidentiality tort; privilege 52-146o (not verified) | Yes - applies to licensed providers regardless of HIPAA status | CTDPA 42-515 et seq.: ENTITY-level HIPAA exemption; 42-526 consumer health data (no threshold); P.A. 25-113 eff. 2026-07-01 | 36a-701b: medical + health insurance info; 60 days; AG no later than residents; HIPAA-compliant deemed compliant but AG notice required | Byrne tort; OCR Allergy Associates of Hartford (media statements, federal) | CTDPA consent for sensitive data (non-exempt entities); HIPAA if covered; common-law appropriation | None located (common law; verify) | Byrne tort; no CTDPA private action (42-110g excluded) | Medical Examining Board/DPH, Dental Commission, AG | CUTPA penalties (42-110o amount not verified); license discipline | E2 (CT AG TicketNetwork CTDPA settlement; Comstar; OCR Allergy Associates federal) | High | 2026-10-22 |
| Connecticut (CT) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Byrne v. Avery (2018) common-law confidentiality tort; privilege 52-146o (not verified) | Yes - applies to licensed providers regardless of HIPAA status | CTDPA 42-515 et seq.: ENTITY-level HIPAA exemption; 42-526 consumer health data (no threshold); P.A. 25-113 eff. 2026-07-01 | 36a-701b: medical + health insurance info; 60 days; AG no later than residents; HIPAA-compliant deemed compliant but AG notice required | Byrne tort; OCR Allergy Associates of Hartford (media statements, federal) | CTDPA consent for sensitive data (non-exempt entities); HIPAA if covered; common-law appropriation | None located (common law; verify) | Byrne tort; no CTDPA private action (42-110g excluded) | Medical Examining Board/DPH, Dental Commission, AG | CUTPA penalties (42-110o amount not verified); license discipline | E2 (CT AG TicketNetwork CTDPA settlement; Comstar; OCR Allergy Associates federal) | High | 2026-10-22 |
| Connecticut (CT) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Byrne v. Avery (2018) common-law confidentiality tort; privilege 52-146o (not verified) | Yes - applies to licensed providers regardless of HIPAA status | CTDPA 42-515 et seq.: ENTITY-level HIPAA exemption; 42-526 consumer health data (no threshold); P.A. 25-113 eff. 2026-07-01 | 36a-701b: medical + health insurance info; 60 days; AG no later than residents; HIPAA-compliant deemed compliant but AG notice required | Byrne tort; OCR Allergy Associates of Hartford (media statements, federal) | CTDPA consent for sensitive data (non-exempt entities); HIPAA if covered; common-law appropriation | None located (common law; verify) | Byrne tort; no CTDPA private action (42-110g excluded) | Medical Examining Board/DPH, Dental Commission, AG | CUTPA penalties (42-110o amount not verified); license discipline | E2 (CT AG TicketNetwork CTDPA settlement; Comstar; OCR Allergy Associates federal) | High | 2026-10-22 |
| Connecticut (CT) | Medical med spa | Depends; cash-only med spas often not covered | Byrne v. Avery (2018) common-law confidentiality tort; privilege 52-146o (not verified) | Yes - applies to licensed providers regardless of HIPAA status | CTDPA 42-515 et seq.: ENTITY-level HIPAA exemption; 42-526 consumer health data (no threshold); P.A. 25-113 eff. 2026-07-01 | 36a-701b: medical + health insurance info; 60 days; AG no later than residents; HIPAA-compliant deemed compliant but AG notice required | Byrne tort; OCR Allergy Associates of Hartford (media statements, federal) | CTDPA consent for sensitive data (non-exempt entities); HIPAA if covered; common-law appropriation | None located (common law; verify) | Byrne tort; no CTDPA private action (42-110g excluded) | Medical Examining Board/DPH, Dental Commission, AG | CUTPA penalties (42-110o amount not verified); license discipline | E2 (CT AG TicketNetwork CTDPA settlement; Comstar; OCR Allergy Associates federal) | High | 2026-10-22 |
| Connecticut (CT) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Byrne v. Avery (2018) common-law confidentiality tort; privilege 52-146o (not verified) | Byrne duty runs to health care providers; CTDPA 42-526 consumer health data applies to all persons | CTDPA 42-515 et seq.: ENTITY-level HIPAA exemption; 42-526 consumer health data (no threshold); P.A. 25-113 eff. 2026-07-01 | 36a-701b: medical + health insurance info; 60 days; AG no later than residents; HIPAA-compliant deemed compliant but AG notice required | Byrne tort; OCR Allergy Associates of Hartford (media statements, federal) | CTDPA consent for sensitive data (non-exempt entities); HIPAA if covered; common-law appropriation | None located (common law; verify) | Byrne tort; no CTDPA private action (42-110g excluded) | Medical Examining Board/DPH, Dental Commission, AG | CUTPA penalties (42-110o amount not verified); license discipline | E2 (CT AG TicketNetwork CTDPA settlement; Comstar; OCR Allergy Associates federal) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Allergy Associates of Hartford
HHS OCR · CT (federal action) · 2018-11-26
- Provider type
- Allergy
- Relevant facts
- Physician discussed patient with TV reporter after service-animal dispute; no sanction
- Legal issues
- Impermissible disclosure; failure to sanction workforce (see OCR page; section list not re-verified)
- Holding, findings, allegations or settlement terms
- Settlement (no admission); admission of liability: No
- Consequences recorded
- $125,000; 2-year CAP
- Procedural status
- Closed: resolution agreement; CAP monitoring period (status not re-checked)
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Media/public statements about a patient
Byrne v. Avery Center for Obstetrics & Gynecology, P.C.
Supreme Court of Connecticut · CT · 2014-11-11; 2018-01-16
- Provider type
- OB/GYN practice
- Relevant facts
- Practice released patient records in response to a subpoena without notice
- Legal issues
- HIPAA preemption; common-law duty of confidentiality
- Holding, findings, allegations or settlement terms
- 2014: HIPAA does not preempt state negligence claims; 2018: common-law cause of action for unauthorized disclosure recognized
- Consequences recorded
- n/a
- Procedural status
- Remanded (status after 2018 not verified)
- Precedential?
- Yes (CT Supreme Court)
- Why it is in this research
- Private tort liability in CT even where HIPAA has no private action
TicketNetwork, Inc. (CTDPA)
Connecticut Attorney General · CT (state AG) · 2025
- Provider type
- Not health care (online ticketing)
- Relevant facts
- Privacy notice deficiencies not cured after notice
- Legal issues
- CTDPA 42-520 notice requirements
- Holding, findings, allegations or settlement terms
- Settlement
- Consequences recorded
- $85,000; compliance and reporting terms
- Procedural status
- Closed (settlement)
- Precedential?
- No
- Why it is in this research
- CTDPA enforcement is active; consumer health data is an AG priority
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
CT-001. Conn. Gen. Stat. 42-517
CTDPA exempts HIPAA covered entities and business associates at the ENTITY level (42-517(a)(7)) and PHI at the data level (42-517(b)).
Statute · Explicit · High · A covered cosmetic practice is outside CTDPA entirely; a non-covered med spa is not.
CT-002. Conn. Gen. Stat. 42-526
Consumer health data rules (42-526) apply to all persons doing business in CT with no volume threshold: confidentiality duty for staff/contractors with access, processor contracts, consent to sell, and geofence ban near mental/reproductive/sexual health facilities; covered entities/BAs excluded.
Statute · Explicit · High · Highly relevant to non-HIPAA med spas and nonmedical aesthetic businesses.
CT-006. Conn. Gen. Stat. 36a-701b
Breach law covers medical information and health insurance identifiers; notice without unreasonable delay but no later than 60 days after discovery; AG notice no later than resident notice; HIPAA/HITECH-compliant persons are deemed compliant but must still notify the AG and offer identity theft services where SSN/TIN involved.
Statute · Explicit · Medium-High · Justia secondary; cga.ct.gov chapter 669 timed out.
https://law.justia.com/codes/connecticut/title-36a/chapter-669/section-36a-701b/
CT-007. 314 Conn. 433 (2014) (cite per CourtListener record 2014-11-11); 327 Conn. 540, 175 A.3d 1 (2018)
Byrne v. Avery Center (2014): HIPAA does not preempt state-law negligence claims for disclosure of medical records; Byrne (2018): Connecticut recognizes a common-law cause of action against a health care provider for unauthorized disclosure of confidential information.
Judicial decision · Explicit (cases located; holdings from CourtListener snippets) · Medium-High · 2014 reporter cite not shown on CourtListener record (U-29).
https://www.courtlistener.com/opinion/6482796/byrne-v-avery-ctr-for-obstetrics-gynecology-pc/
CT-004. Conn. Gen. Stat. 42-525
AG has exclusive CTDPA enforcement; the mandatory cure period ended 2024-12-31; violations are CUTPA unfair trade practices, but the CUTPA private action (42-110g) does not apply.
Statute · Explicit · High · CUTPA penalty amount (42-110o) not verified (U-35).
CT-009. Conn. Gen. Stat. 19a-903c (P.A. 14-119; P.A. 15-242)
Med spa statute: a medical spa must employ or contract with a physician, PA or APRN (medical director duties); a licensed provider must perform an initial in-person assessment before cosmetic medical procedures; procedures may be performed only by those providers or by a supervised RN as allowed; the names of the medical director and providers must be posted on site, on the website and in advertising. No DPH med spa regulations were located.
Statute · Explicit (OLR summary); statute text read on Justia (secondary) · Medium · Med spa pass, final phase part 2 (2026-10-22). Statute text from Justia (secondary host); summary confirmed in the official OLR report 2025-R-0159. Official CGS page not read (cga.ct.gov timeouts earlier) (V-055, U-99).
CT-008. CT AG press release 2025
First CTDPA settlement: TicketNetwork paid $85,000 after failing to cure privacy-notice deficiencies (2025); AG 2025 enforcement report (2026-02-05) lists consumer health data as a priority.
Enforcement (state AG settlement) · Explicit (search extract of official page) · Medium · Not health care; shows CTDPA enforcement is active.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All