Pending bills to recheck
- DC B26-0525. As of Oct 22, 2026: B26-0525 was pending as of May 2026 (secondary source). It is not law.
What a provider can and can't say in District of Columbia
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 3-1205.14(a)(16); Jemsek 2025 social-media charge (allegation); Vassiliades photos holding |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 3-1205.14(a)(16); Jemsek 2025 social-media charge (allegation); Vassiliades photos holding |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 3-1205.14(a)(16); Jemsek 2025 social-media charge (allegation); Vassiliades photos holding |
| Medical med spa | Depends; cash-only med spas often not covered | Yes for licensees (3-1205.14; Vassiliades); Policy 15-02 guidance on structure | 3-1205.14(a)(16); Jemsek 2025 social-media charge (allegation); Vassiliades photos holding |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Partly: Vassiliades tort reasoning is physician-specific; publicity-of-private-facts tort applies to anyone | 3-1205.14(a)(16); Jemsek 2025 social-media charge (allegation); Vassiliades photos holding |
- Consumer privacy and health data law: District of Columbia has no comprehensive consumer privacy law in force as of October 22, 2026. Status of proposals: B26-0525 pending as of May 2026 (secondary). Bills are not law. [DC-001]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general at 50 or more residents affected even for HIPAA entities. [DC-002, DC-003]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules and tort (Vassiliades) and MHIA.† [DC-005, DC-006, DC-007]
- Patient confidentiality duties: The licensing board can discipline willful breaches of patient confidentiality (3-1205.14(a)(16)). [DC-006]
- Lawsuits by individuals: Patients may be able to sue in some situations (Vassiliades; 7-1207.01).† [DC-007, DC-005]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located.† [DC-007, U-98]
- Med spa rules: Med spas: only agency guidance was found (Policy 15-02); the binding rules are the general professional practice acts. [DC-008]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2) (Jemsek, 2025 charge: an allegation, not a finding). Not finding enforcement does not mean none exists. [DC-009]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [DC-001] B25-0930; B26-0525 (https://lims.dccouncil.gov/Legislation/B25-0930)
- [DC-002] D.C. Code 28-3851(1B), (3)(A)(i)(III)-(VI), (ii); D.C. Law 23-98 (https://code.dccouncil.gov/us/dc/council/code/sections/28-3851)
- [DC-003] D.C. Code 28-3852(a), (a-1), (b-1), (c), (g) (https://code.dccouncil.gov/us/dc/council/code/sections/28-3852)
- [DC-005] D.C. Code 7-1201.01(9)-(11), 7-1201.02(a), 7-1207.01, 7-1207.02(a) (https://code.dccouncil.gov/us/dc/council/code/sections/7-1201.01)
- [DC-006] D.C. Code 3-1205.14(a)(16), (c)(4)-(5) (https://code.dccouncil.gov/us/dc/council/code/sections/3-1205.14)
- [DC-007] Vassiliades v. Garfinckel's, Brooks Bros., 492 A.2d 580 (D.C. 1985) (https://law.justia.com/cases/district-of-columbia/court-of-appeals/1985/83-1255-3.html)
- [DC-008] D.C. Board of Medicine Policy No. 15-02 (https://doh.dc.gov/sites/default/files/dc/sites/doh/publication/attachments/Policy-Aesthetic-Medicine-FINAL%20%284%29.pdf)
- [DC-009] In re Joseph Jemsek, M.D., Notice of Summary Action (2025-05-13); Final Order (2025-08-14) (https://dchealth.dc.gov/sites/default/files/dc/sites/doh/page_content/attachments/Jemsek_Joseph-Summary_Supension_05_13_2025-Redacted.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| District of Columbia (DC) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | D.C. Code 3-1205.14(a)(16) willful breach of confidentiality (all HORA boards); 7-1201.02 Mental Health Information Act; Vassiliades tort | Yes - applies to licensed providers regardless of HIPAA status | None enacted (B25-0930 died 2024; B26-0525 pending as of May 2026) | 28-3851: medical, genetic, health-insurance and biometric info COVERED; AG notice if 50+ even for HIPAA entities | 3-1205.14(a)(16); Jemsek 2025 social-media charge (allegation); Vassiliades photos holding | HIPAA if covered; Vassiliades (publicity of private facts; breach of confidential relationship) | None statutory located (common-law appropriation; failed on Vassiliades facts) | Yes: Vassiliades tort; 7-1207.01 ($1,000 minimum for willful MH disclosures); CPPA 28-3905(k) (inferred for breach) | DC Health / Board of Medicine, Board of Dentistry, Board of Nursing, OAG (CPPA), DLCP (cosmetology) | 3-1205.14(c)(5) up to $5,000/violation; CPPA $500-$5,000 (first) / $1,000-$10,000 (repeat) | E2 (Jemsek 2025 charging notice: social-media disclosure; Vassiliades judicial holding) | High | 2026-10-22 |
| District of Columbia (DC) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | D.C. Code 3-1205.14(a)(16) willful breach of confidentiality (all HORA boards); 7-1201.02 Mental Health Information Act; Vassiliades tort | Yes - applies to licensed providers regardless of HIPAA status | None enacted (B25-0930 died 2024; B26-0525 pending as of May 2026) | 28-3851: medical, genetic, health-insurance and biometric info COVERED; AG notice if 50+ even for HIPAA entities | 3-1205.14(a)(16); Jemsek 2025 social-media charge (allegation); Vassiliades photos holding | HIPAA if covered; Vassiliades (publicity of private facts; breach of confidential relationship) | None statutory located (common-law appropriation; failed on Vassiliades facts) | Yes: Vassiliades tort; 7-1207.01 ($1,000 minimum for willful MH disclosures); CPPA 28-3905(k) (inferred for breach) | DC Health / Board of Medicine, Board of Dentistry, Board of Nursing, OAG (CPPA), DLCP (cosmetology) | 3-1205.14(c)(5) up to $5,000/violation; CPPA $500-$5,000 (first) / $1,000-$10,000 (repeat) | E2 (Jemsek 2025 charging notice: social-media disclosure; Vassiliades judicial holding) | High | 2026-10-22 |
| District of Columbia (DC) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | D.C. Code 3-1205.14(a)(16) willful breach of confidentiality (all HORA boards); 7-1201.02 Mental Health Information Act; Vassiliades tort | Yes - applies to licensed providers regardless of HIPAA status | None enacted (B25-0930 died 2024; B26-0525 pending as of May 2026) | 28-3851: medical, genetic, health-insurance and biometric info COVERED; AG notice if 50+ even for HIPAA entities | 3-1205.14(a)(16); Jemsek 2025 social-media charge (allegation); Vassiliades photos holding | HIPAA if covered; Vassiliades (publicity of private facts; breach of confidential relationship) | None statutory located (common-law appropriation; failed on Vassiliades facts) | Yes: Vassiliades tort; 7-1207.01 ($1,000 minimum for willful MH disclosures); CPPA 28-3905(k) (inferred for breach) | DC Health / Board of Medicine, Board of Dentistry, Board of Nursing, OAG (CPPA), DLCP (cosmetology) | 3-1205.14(c)(5) up to $5,000/violation; CPPA $500-$5,000 (first) / $1,000-$10,000 (repeat) | E2 (Jemsek 2025 charging notice: social-media disclosure; Vassiliades judicial holding) | High | 2026-10-22 |
| District of Columbia (DC) | Medical med spa | Depends; cash-only med spas often not covered | D.C. Code 3-1205.14(a)(16) willful breach of confidentiality (all HORA boards); 7-1201.02 Mental Health Information Act; Vassiliades tort | Yes for licensees (3-1205.14; Vassiliades); Policy 15-02 guidance on structure | None enacted (B25-0930 died 2024; B26-0525 pending as of May 2026) | 28-3851: medical, genetic, health-insurance and biometric info COVERED; AG notice if 50+ even for HIPAA entities | 3-1205.14(a)(16); Jemsek 2025 social-media charge (allegation); Vassiliades photos holding | HIPAA if covered; Vassiliades (publicity of private facts; breach of confidential relationship) | None statutory located (common-law appropriation; failed on Vassiliades facts) | Yes: Vassiliades tort; 7-1207.01 ($1,000 minimum for willful MH disclosures); CPPA 28-3905(k) (inferred for breach) | DC Health / Board of Medicine, Board of Dentistry, Board of Nursing, OAG (CPPA), DLCP (cosmetology) | 3-1205.14(c)(5) up to $5,000/violation; CPPA $500-$5,000 (first) / $1,000-$10,000 (repeat) | E2 (Jemsek 2025 charging notice: social-media disclosure; Vassiliades judicial holding) | High | 2026-10-22 |
| District of Columbia (DC) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | D.C. Code 3-1205.14(a)(16) willful breach of confidentiality (all HORA boards); 7-1201.02 Mental Health Information Act; Vassiliades tort | Partly: Vassiliades tort reasoning is physician-specific; publicity-of-private-facts tort applies to anyone | None enacted (B25-0930 died 2024; B26-0525 pending as of May 2026) | 28-3851: medical, genetic, health-insurance and biometric info COVERED; AG notice if 50+ even for HIPAA entities | 3-1205.14(a)(16); Jemsek 2025 social-media charge (allegation); Vassiliades photos holding | HIPAA if covered; Vassiliades (publicity of private facts; breach of confidential relationship) | None statutory located (common-law appropriation; failed on Vassiliades facts) | Yes: Vassiliades tort; 7-1207.01 ($1,000 minimum for willful MH disclosures); CPPA 28-3905(k) (inferred for breach) | DC Health / Board of Medicine, Board of Dentistry, Board of Nursing, OAG (CPPA), DLCP (cosmetology) | 3-1205.14(c)(5) up to $5,000/violation; CPPA $500-$5,000 (first) / $1,000-$10,000 (repeat) | E2 (Jemsek 2025 charging notice: social-media disclosure; Vassiliades judicial holding) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Vassiliades v. Garfinckel's, Brooks Bros.
District of Columbia Court of Appeals · DC (supplemental jurisdiction) · 1985-05-13
- Provider type
- Plastic surgeon; department store
- Relevant facts
- Surgeon showed a patient's before-and-after face-lift photographs on television and at a store presentation without her consent
- Legal issues
- Publicity of private facts; breach of physician-patient confidential relationship; appropriation; false light
- Holding, findings, allegations or settlement terms
- Judicial holding: sufficient evidence of invasion of privacy by the surgeon; breach of the confidential relationship is an actionable tort; store not liable (relied on surgeon's assurance of consent); appropriation and false light rejected
- Consequences recorded
- Jury verdicts of $100,000 and $250,000 set aside; JNOV reversed as to the surgeon; new trial on damages
- Procedural status
- Final appellate decision (remand outcome not located)
- Precedential?
- Yes (D.C. Court of Appeals)
- Why it is in this research
- Directly on point for cosmetic before/after photo use without consent
DC Health: Joseph Jemsek, M.D.
D.C. Department of Health / Board of Medicine · DC (licensing) · Notice 2025-05-13; Final Order 2025-08-14
- Provider type
- Physician (infectious disease)
- Relevant facts
- Notice recites staff reports that the physician disclosed a patient's last name and state on a Facebook livestream and that a marketing assistant posted a patient's photo on practice social media, alongside impairment and practice-safety charges
- Legal issues
- D.C. Code 3-1205.14(a)(16) and other grounds; 3-1205.15(a)(1)(D) summary suspension
- Holding, findings, allegations or settlement terms
- CHARGES (allegations) in the summary notice; Final Order revoked the license on separate ALJ findings (Lyme disease treatment); no finding on confidentiality located
- Consequences recorded
- Summary suspension (terminated 2025-08-14); license revoked 2025-08-14 on other grounds
- Procedural status
- Final (revocation)
- Precedential?
- No
- Why it is in this research
- Official charge treating social-media disclosure as a confidentiality violation (E2)
Related pages
Topics
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
DC-001. B25-0930; B26-0525
D.C. is a SUPPLEMENTAL jurisdiction (not a state). No comprehensive consumer privacy or consumer-health-data law. B25-0930 (Consumer Health Information Privacy Protection Act of 2024, introduced 2024-07-12 at the AG's request; Health Committee hearing 2024-10-17) died at the end of Council Period 25. B26-0525 (Personal Health Data Security Amendment Act of 2025) was introduced 2025-12-01 with a roundtable on 2026-03-23 and was pending in committee as of May 2026. Proposed bills are not law.
Legislative history · Per secondary trackers (LegiScan, BillTrack50, recordinglaw.com) · Medium · LIMS pages did not render to the fetch tool; B26-0525 status after May 2026 unverified (U-91).
DC-002. D.C. Code 28-3851(1B), (3)(A)(i)(III)-(VI), (ii); D.C. Law 23-98
Breach law: 'personal information' includes name or other identifier plus medical information (any information about a consumer's dental, medical or mental health treatment or diagnosis by a health-care professional), genetic information/DNA profile, health insurance information, or biometric data, as well as government ID, financial and account-login elements (Security Breach Protection Amendment Act of 2020).
Statute · Explicit · High · The 'no harm' exclusion requires consultation with OAG and federal law enforcement (28-3851(1)(B)(iii)).
https://code.dccouncil.gov/us/dc/council/code/sections/28-3851
DC-003. D.C. Code 28-3852(a), (a-1), (b-1), (c), (g)
Breach notice: residents in the most expedient time possible; written notice to the Office of the Attorney General if 50 or more residents are affected, no later than resident notice (with 11 listed items); consumer reporting agencies if more than 1,000. An entity following HIPAA/HITECH breach-notice rules is deemed compliant for resident notice, but must in all cases give the AG notice.
Statute · Explicit · High · HIPAA deemed compliance does NOT excuse the AG notice (unusual).
https://code.dccouncil.gov/us/dc/council/code/sections/28-3852
DC-005. D.C. Code 7-1201.01(9)-(11), 7-1201.02(a), 7-1207.01, 7-1207.02(a)
Mental Health Information Act: no mental health professional (which includes any licensed physician), facility, data collector, or their employees or agents may disclose mental health information except as the Act authorizes; negligent violation: actual damages, costs and attorney's fees; willful or intentional violation: damages of not less than $1,000 plus costs and fees; willful violation is a misdemeanor (fine up to $1,000, up to 60 days).
Statute · Explicit · High · Covers only MENTAL HEALTH information (diagnosis or treatment of a mental or emotional condition), not general medical records; reaches a cosmetic practice only for such information, e.g. psychological screening (inference).
https://code.dccouncil.gov/us/dc/council/code/sections/7-1201.01
DC-006. D.C. Code 3-1205.14(a)(16), (c)(4)-(5)
Health Occupations Revision Act: every health board may discipline a licensee who 'willfully breaches a statutory, regulatory, or ethical requirement of confidentiality with respect to a person who is a patient or client of the health professional, unless ordered by a court'; sanctions include reprimand, suspension, revocation and a civil fine not to exceed $5,000 per violation.
Statute · Explicit · High · Applies across HORA boards (medicine, dentistry, nursing and others). 'Willful' element. Ethical requirements (AMA/ADA codes) are incorporated by the text.
https://code.dccouncil.gov/us/dc/council/code/sections/3-1205.14
DC-007. Vassiliades v. Garfinckel's, Brooks Bros., 492 A.2d 580 (D.C. 1985)
Vassiliades v. Garfinckel's: a plastic surgeon who showed a patient's before-and-after photographs on television and at a department-store presentation without consent was liable for invasion of privacy (publicity of private facts); the court also held breach of the physician-patient confidential relationship is an actionable tort. Appropriation and false-light theories failed on the facts; the store was not liable because it relied on the surgeon's assurance of consent; new trial on damages.
Case law · Explicit · High · Read via Justia (secondary). Closest comparable to cosmetic-photo disclosure in the whole project; judicial liability, not agency enforcement.
https://law.justia.com/cases/district-of-columbia/court-of-appeals/1985/83-1255-3.html
DC-008. D.C. Board of Medicine Policy No. 15-02
Board of Medicine Policy No. 15-02 on aesthetic medicine (2014-11-13): Level II and III procedures (lasers, IPL, injectables such as neuromodulators and fillers, deeper peels, body contouring) are the practice of medicine and may be performed only as part of a medical practice; facilities need medical, clinical and site directors, with directors physically present at least 50% of operating hours; 'medical spa' terms may not describe a non-medical facility. The policy states it is 'directive in nature and not mandatory' until regulations are adopted.
Guidance (board policy) · Explicit (guidance) · High · Not binding. No later med spa rule located in 17 DCMR (search; U-91).
DC-009. In re Joseph Jemsek, M.D., Notice of Summary Action (2025-05-13); Final Order (2025-08-14)
DC Health Notice of Summary Action to Suspend License (Joseph Jemsek, M.D., 2025-05-13) charged, among other grounds, a willful breach of confidentiality under 3-1205.14(a)(16), reciting staff reports that the physician disclosed a patient's last name and state on a Facebook livestream and that a marketing assistant posted a patient's photo on the practice's Facebook and LinkedIn pages. On 2025-08-14 the summary suspension was terminated and the license revoked by a Final Order resting on separate ALJ findings (Lyme disease treatment); no final finding on the confidentiality charge was located.
Enforcement (licensing; charging notice = allegations) · Explicit (scanned notice read as images) · High · E2: social-media disclosure CHARGED, not found. Shows D.C. treats online posting of patient details as a 3-1205.14(a)(16) matter.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All