What a provider can and can't say in Delaware
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 1731(b)(12) (willfulness required); guideline: education + reprimand (secondary) |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes via dental rule 1100-12.0 (secondary source) | 1731(b)(12) (willfulness required); guideline: education + reprimand (secondary) |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 1731(b)(12) (willfulness required); guideline: education + reprimand (secondary) |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 1731(b)(12) (willfulness required); guideline: education + reprimand (secondary) |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 1731(b)(12) (willfulness required); guideline: education + reprimand (secondary) |
- Consumer privacy and health data law: Delaware has a consumer privacy law in force (DPDPA (35k; 10k from 2027)). It exempts only HIPAA-protected health information (a data-level exemption), so a covered practice's other data, such as website or marketing data, can still fall under it. [DE-004]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general if more than 500 residents affected. [DE-003]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules. [DE-001]
- Patient confidentiality duties: The licensing board can discipline willful breaches of patient confidentiality (24 Del. C. 1731(b)(12)). [DE-001]
- Lawsuits by individuals: No private right of action was located in the statutes reviewed; other claims, such as privacy torts, may still exist. [U-98]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was located in this research. [U-61]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [DE-001, U-97]
- Research notes and gaps: The Delaware dental rule was read on an unofficial website and should be confirmed against the official code. [U-95]
Sources:
- [DE-001] 24 Del. C. 1731(b)(12); 24 Del. Admin. Code 1700-17.0 (b)(12) (paragraph number inferred from list) (https://delcode.delaware.gov/title24/c017/sc04/index.html)
- [DE-003] 6 Del. C. 12B-101(7)a.6-8; 12B-102(a), (c), (d); 12B-103(b); 12B-104 (https://delcode.delaware.gov/title6/c012b/index.html)
- [DE-004] 6 Del. C. 12D-102, -103, -106, -111; 85 Del. Laws c. 463 (https://delcode.delaware.gov/title6/c012d/index.html)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Delaware (DE) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | 24 Del. C. 1731(b)(12) (physicians: wilful violation of confidential relationship); dental rule 1100-12.0 (secondary) | Yes - applies to licensed providers regardless of HIPAA status | DPDPA (6 Del. C. 12D): DATA-level PHI exemption; thresholds 35k / 10k+20% (10k / 5k+20% from 2027); sensitive data needs consent | 12B-102: medical, health insurance, biometric covered; 60 days; AG if >500; HIPAA-compliant deemed compliant | 1731(b)(12) (willfulness required); guideline: education + reprimand (secondary) | HIPAA if covered; DPDPA consent if in scope; licensee confidentiality ground | None statutory located (common law not researched) | None statutory located (breach: AG action; common law preserved) | Board of Medical Licensure and Discipline, Board of Dentistry and Dental Hygiene, Board of Nursing (DPR), DOJ Consumer Protection | DPDPA via 6 Del. C. 2513/2522 (not verified); breach: AG action for damages; license discipline | E4 | Medium-High | 2026-10-22 |
| Delaware (DE) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | 24 Del. C. 1731(b)(12) (physicians: wilful violation of confidential relationship); dental rule 1100-12.0 (secondary) | Yes via dental rule 1100-12.0 (secondary source) | DPDPA (6 Del. C. 12D): DATA-level PHI exemption; thresholds 35k / 10k+20% (10k / 5k+20% from 2027); sensitive data needs consent | 12B-102: medical, health insurance, biometric covered; 60 days; AG if >500; HIPAA-compliant deemed compliant | 1731(b)(12) (willfulness required); guideline: education + reprimand (secondary) | HIPAA if covered; DPDPA consent if in scope; licensee confidentiality ground | None statutory located (common law not researched) | None statutory located (breach: AG action; common law preserved) | Board of Medical Licensure and Discipline, Board of Dentistry and Dental Hygiene, Board of Nursing (DPR), DOJ Consumer Protection | DPDPA via 6 Del. C. 2513/2522 (not verified); breach: AG action for damages; license discipline | E4 | Medium-High | 2026-10-22 |
| Delaware (DE) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | 24 Del. C. 1731(b)(12) (physicians: wilful violation of confidential relationship); dental rule 1100-12.0 (secondary) | Yes - applies to licensed providers regardless of HIPAA status | DPDPA (6 Del. C. 12D): DATA-level PHI exemption; thresholds 35k / 10k+20% (10k / 5k+20% from 2027); sensitive data needs consent | 12B-102: medical, health insurance, biometric covered; 60 days; AG if >500; HIPAA-compliant deemed compliant | 1731(b)(12) (willfulness required); guideline: education + reprimand (secondary) | HIPAA if covered; DPDPA consent if in scope; licensee confidentiality ground | None statutory located (common law not researched) | None statutory located (breach: AG action; common law preserved) | Board of Medical Licensure and Discipline, Board of Dentistry and Dental Hygiene, Board of Nursing (DPR), DOJ Consumer Protection | DPDPA via 6 Del. C. 2513/2522 (not verified); breach: AG action for damages; license discipline | E4 | Medium-High | 2026-10-22 |
| Delaware (DE) | Medical med spa | Depends; cash-only med spas often not covered | 24 Del. C. 1731(b)(12) (physicians: wilful violation of confidential relationship); dental rule 1100-12.0 (secondary) | Yes - applies to licensed providers regardless of HIPAA status | DPDPA (6 Del. C. 12D): DATA-level PHI exemption; thresholds 35k / 10k+20% (10k / 5k+20% from 2027); sensitive data needs consent | 12B-102: medical, health insurance, biometric covered; 60 days; AG if >500; HIPAA-compliant deemed compliant | 1731(b)(12) (willfulness required); guideline: education + reprimand (secondary) | HIPAA if covered; DPDPA consent if in scope; licensee confidentiality ground | None statutory located (common law not researched) | None statutory located (breach: AG action; common law preserved) | Board of Medical Licensure and Discipline, Board of Dentistry and Dental Hygiene, Board of Nursing (DPR), DOJ Consumer Protection | DPDPA via 6 Del. C. 2513/2522 (not verified); breach: AG action for damages; license discipline | E4 | Medium-High | 2026-10-22 |
| Delaware (DE) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | 24 Del. C. 1731(b)(12) (physicians: wilful violation of confidential relationship); dental rule 1100-12.0 (secondary) | No | DPDPA (6 Del. C. 12D): DATA-level PHI exemption; thresholds 35k / 10k+20% (10k / 5k+20% from 2027); sensitive data needs consent | 12B-102: medical, health insurance, biometric covered; 60 days; AG if >500; HIPAA-compliant deemed compliant | 1731(b)(12) (willfulness required); guideline: education + reprimand (secondary) | HIPAA if covered; DPDPA consent if in scope; licensee confidentiality ground | None statutory located (common law not researched) | None statutory located (breach: AG action; common law preserved) | Board of Medical Licensure and Discipline, Board of Dentistry and Dental Hygiene, Board of Nursing (DPR), DOJ Consumer Protection | DPDPA via 6 Del. C. 2513/2522 (not verified); breach: AG action for damages; license discipline | E4 | Medium-High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Cadia Healthcare Facilities
HHS OCR · DE (federal action) · 2025-04-22 (announced 2025-09-30)
- Provider type
- Rehabilitation, skilled nursing and long-term care providers (5 facilities)
- Relevant facts
- Website 'success story' program posted 150 patients' names, photos and condition, treatment and recovery details without valid written authorizations
- Legal issues
- 45 CFR 164.502(a), 164.508 authorization; 164.530(c) safeguards; breach notification 164.404
- Holding, findings, allegations or settlement terms
- Settlement (resolution agreement); OCR investigation determined impermissible disclosures, safeguards failure and failure to notify
- Consequences recorded
- $182,000; 2-year CAP: policies, workforce (incl. marketing) training, breach notices to all patients posted without authorization
- Procedural status
- Closed: resolution agreement (CAP monitoring 2 years)
- Precedential?
- No (settlement; not precedential)
- Why it is in this research
- Before/after photos, testimonials and social media marketing need a valid HIPAA authorization; unauthorized posting can trigger breach notice (federal; E1 for the photo/testimonial scenario)
Related pages
Topics
Healthcare industry
Sources
DE-004. 6 Del. C. 12D-102, -103, -106, -111; 85 Del. Laws c. 463
DPDPA applies at 35,000 consumers (or 10,000 with 20%+ revenue from sales), dropping to 10,000 (or 5,000 with 20%) from 2027-01-01; DATA-level PHI exemption only; sensitive data (mental or physical health condition or diagnosis, including pregnancy; biometric data) requires consent; AG enforcement, discretionary cure after 2025, no private right of action.
Statute · Explicit · High · Penalty amount under 6 Del. C. 2513/2522 not verified (U-56). Low thresholds bring larger med spas into scope (inference).
DE-003. 6 Del. C. 12B-101(7)a.6-8; 12B-102(a), (c), (d); 12B-103(b); 12B-104
Breach law 'personal information' includes medical history, treatment or diagnosis, DNA profile, health insurance IDs and biometric data; harm exception only after an investigation; notice within 60 days; AG notice if more than 500 residents; HIPAA-regulated persons following their procedures are deemed compliant; AG may sue for compliance and direct economic damages.
Statute · Explicit · High
DE-001. 24 Del. C. 1731(b)(12); 24 Del. Admin. Code 1700-17.0
Physician unprofessional conduct includes 'wilful violation of the confidential relationship with or confidential communications of a patient'. Board disciplinary guidelines (per secondary copy) pair confidentiality/HIPAA violations under this provision with education and a letter of reprimand.
Statute; Regulation · Explicit (statute); guideline per LII · Medium-High · Willfulness required. Guideline text not read on the official site (U-56).
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-61. U-61 · Partly resolved; remainder consolidated into U-98 (2026-10-22)
Left for the post-batch-8 pass: med spa statutes (GA 43-34-240+ text; NC/SC guidance only; DE/PA none located; MD COMAR official text); likeness and confidentiality torts in GA, VA, MD, DE, PA (only Pavesich, McCormick, Acosta, Humphers-type authority located); state AG enforcement against practices (none located).
High priority · Batch 4
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All
U-95. U-95 · Open
Claims and cases that remain unverifiable from official sources (bot checks, outages or no public record): Ohio bill status (legislature.ohio.gov connection failed); Tausinga (no docket found); OSBMLS v. Larson final order; TN, AR, MS and GA code text (Justia hosts; tnsosfiles 403); KS-005 rule text (KSBHA 403); MS-004 rule; NM-001 (NMOneSource 403); WV rule 11-1A-12.1.f (LII host); Hawaii HRS text after 2017 (capitol.hawaii.gov Cloudflare, not circumvented); DC B26-0525 status; Aspen Dental final approval order; Cancelmo docket entries (PACERMonitor mirror); basis of the Amazon Ads SDK termination; case-law reproductions on secondary hosts.
High priority · All