What a provider can and can't say in Florida
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 456.057(7)(a) bars discussing a patient's condition without written authorization |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 456.057(7)(a) bars discussing a patient's condition without written authorization |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 456.057(7)(a) bars discussing a patient's condition without written authorization |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 456.057(7)(a) bars discussing a patient's condition without written authorization |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | 456.057 applies to DOH-licensed practitioners; estheticians (ch. 477, DBPR) not covered (inference) | 456.057(7)(a) bars discussing a patient's condition without written authorization |
- Consumer privacy and health data law: Florida has no general consumer privacy law that reaches most practices; a narrow law was not reviewed in this research.† [FL-009]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: Dept. of Legal Affairs if 500 or more residents affected; HIPAA notice deemed compliant. [FL-004, FL-005]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (456.057(7)). [FL-001, FL-003]
- Patient confidentiality duties: The state confidentiality law applies to licensed providers (no mental state). [FL-003]
- Lawsuits by individuals: Patients may be able to sue in some situations ((540.08); torts; none under breach law). [FL-006, FL-007]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (540.08). [FL-006]
- Med spa rules: Med spas: no med-spa-specific statute was located.† [FL-008]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [FL-003, U-97]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [FL-001] Fla. Stat. 456.057(7)(a) (https://www.flsenate.gov/Laws/Statutes/2026/456.057)
- [FL-003] Fla. Stat. 456.057(7)(c); 456.072(1)(k),(dd) (https://www.flsenate.gov/Laws/Statutes/2026/456.072)
- [FL-004] Fla. Stat. 501.171(1),(3),(4)(a),(4)(g) (https://www.flsenate.gov/Laws/Statutes/2026/501.171)
- [FL-005] Fla. Stat. 501.171(9),(10) (https://www.flsenate.gov/Laws/Statutes/2026/501.171)
- [FL-006] Fla. Stat. 540.08 (1)-(2) (https://www.flsenate.gov/Laws/Statutes/2026/540.08)
- [FL-007] Gracey v. Eaker, 837 So.2d 348 (Fla. 2002); Cape Publications v. Hitchner, 549 So.2d 1374 (Fla. 1989) pinpoints not verified (https://www.courtlistener.com/opinion/1146259/gracey-v-eaker/)
- [FL-008] Fla. Stat. chs. 456, 458, 459, 464, 478 (https://www.flsenate.gov/Laws/Statutes/2026)
- [FL-009] Fla. Stat. 501.701-501.722 501.702 (definition of 'controller') (http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501.html)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Florida (FL) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Fla. Stat. 456.057(7) (no disclosure without written authorization; no marketing use without written release) | Yes - applies to licensed providers regardless of HIPAA status | None (no FL consumer health data law; Florida Digital Bill of Rights thresholds very high - not reviewed) | Fla. Stat. 501.171: medical info covered; 30 days; Dept. of Legal Affairs if 500+; federal-regulator compliance deemed | 456.057(7)(a) bars discussing a patient's condition without written authorization | 456.057(7)(b) specific written release for marketing; Fla. Stat. 540.08 consent for commercial use | Fla. Stat. 540.08 (damages incl. royalty; punitive) | 540.08; common-law torts and Gracey fiduciary theory; no private action under 501.171; private right under 456.057 unclear | Board of Medicine, Board of Osteopathic Medicine, Board of Dentistry, Board of Nursing (DOH), DBPR (estheticians), Dept. of Legal Affairs | FIPA up to $500,000 per breach; practitioner discipline incl. fines under 456.072(2) (amounts not verified) | E4 (no FL state action vs. cosmetic practice located); federal OCR cases nationally | High | 2026-10-22 |
| Florida (FL) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Fla. Stat. 456.057(7) (no disclosure without written authorization; no marketing use without written release) | Yes - applies to licensed providers regardless of HIPAA status | None (no FL consumer health data law; Florida Digital Bill of Rights thresholds very high - not reviewed) | Fla. Stat. 501.171: medical info covered; 30 days; Dept. of Legal Affairs if 500+; federal-regulator compliance deemed | 456.057(7)(a) bars discussing a patient's condition without written authorization | 456.057(7)(b) specific written release for marketing; Fla. Stat. 540.08 consent for commercial use | Fla. Stat. 540.08 (damages incl. royalty; punitive) | 540.08; common-law torts and Gracey fiduciary theory; no private action under 501.171; private right under 456.057 unclear | Board of Medicine, Board of Osteopathic Medicine, Board of Dentistry, Board of Nursing (DOH), DBPR (estheticians), Dept. of Legal Affairs | FIPA up to $500,000 per breach; practitioner discipline incl. fines under 456.072(2) (amounts not verified) | E4 (no FL state action vs. cosmetic practice located); federal OCR cases nationally | High | 2026-10-22 |
| Florida (FL) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Fla. Stat. 456.057(7) (no disclosure without written authorization; no marketing use without written release) | Yes - applies to licensed providers regardless of HIPAA status | None (no FL consumer health data law; Florida Digital Bill of Rights thresholds very high - not reviewed) | Fla. Stat. 501.171: medical info covered; 30 days; Dept. of Legal Affairs if 500+; federal-regulator compliance deemed | 456.057(7)(a) bars discussing a patient's condition without written authorization | 456.057(7)(b) specific written release for marketing; Fla. Stat. 540.08 consent for commercial use | Fla. Stat. 540.08 (damages incl. royalty; punitive) | 540.08; common-law torts and Gracey fiduciary theory; no private action under 501.171; private right under 456.057 unclear | Board of Medicine, Board of Osteopathic Medicine, Board of Dentistry, Board of Nursing (DOH), DBPR (estheticians), Dept. of Legal Affairs | FIPA up to $500,000 per breach; practitioner discipline incl. fines under 456.072(2) (amounts not verified) | E4 (no FL state action vs. cosmetic practice located); federal OCR cases nationally | High | 2026-10-22 |
| Florida (FL) | Medical med spa | Depends; cash-only med spas often not covered | Fla. Stat. 456.057(7) (no disclosure without written authorization; no marketing use without written release) | Yes - applies to licensed providers regardless of HIPAA status | None (no FL consumer health data law; Florida Digital Bill of Rights thresholds very high - not reviewed) | Fla. Stat. 501.171: medical info covered; 30 days; Dept. of Legal Affairs if 500+; federal-regulator compliance deemed | 456.057(7)(a) bars discussing a patient's condition without written authorization | 456.057(7)(b) specific written release for marketing; Fla. Stat. 540.08 consent for commercial use | Fla. Stat. 540.08 (damages incl. royalty; punitive) | 540.08; common-law torts and Gracey fiduciary theory; no private action under 501.171; private right under 456.057 unclear | Board of Medicine, Board of Osteopathic Medicine, Board of Dentistry, Board of Nursing (DOH), DBPR (estheticians), Dept. of Legal Affairs | FIPA up to $500,000 per breach; practitioner discipline incl. fines under 456.072(2) (amounts not verified) | E4 (no FL state action vs. cosmetic practice located); federal OCR cases nationally | High | 2026-10-22 |
| Florida (FL) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Fla. Stat. 456.057(7) (no disclosure without written authorization; no marketing use without written release) | 456.057 applies to DOH-licensed practitioners; estheticians (ch. 477, DBPR) not covered (inference) | None (no FL consumer health data law; Florida Digital Bill of Rights thresholds very high - not reviewed) | Fla. Stat. 501.171: medical info covered; 30 days; Dept. of Legal Affairs if 500+; federal-regulator compliance deemed | 456.057(7)(a) bars discussing a patient's condition without written authorization | 456.057(7)(b) specific written release for marketing; Fla. Stat. 540.08 consent for commercial use | Fla. Stat. 540.08 (damages incl. royalty; punitive) | 540.08; common-law torts and Gracey fiduciary theory; no private action under 501.171; private right under 456.057 unclear | Board of Medicine, Board of Osteopathic Medicine, Board of Dentistry, Board of Nursing (DOH), DBPR (estheticians), Dept. of Legal Affairs | FIPA up to $500,000 per breach; practitioner discipline incl. fines under 456.072(2) (amounts not verified) | E4 (no FL state action vs. cosmetic practice located); federal OCR cases nationally | High | 2026-10-22 |
Related pages
Topics
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
FL-009. Fla. Stat. 501.701-501.722
Florida's Digital Bill of Rights (Fla. Stat. 501.701-501.722, SB 262 (2023)) applies only to very large controllers (more than $1 billion in global gross annual revenue plus further criteria), so it is not expected to reach typical practices; it was not reviewed in this research.
Statute · Explicit (thresholds, from general knowledge of the act); text not read · Low · Med spa pass, final phase part 2 (2026-10-22). Thresholds and effective date not re-read on the official host this session; verify before publication (U-99).
http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501.html
FL-004. Fla. Stat. 501.171(1),(3),(4)(a),(4)(g)
FIPA breach law covers medical history/condition/treatment and health insurance information; individual notice within 30 days; Dept. of Legal Affairs notice for 500+; notice under a federal regulator's rules (e.g., HIPAA) is deemed compliant.
Statute · Explicit · High · HIPAA entities must still provide a copy to the Dept. if 500+ (inferred from (3)/(4)(g) interaction - verify).
FL-005. Fla. Stat. 501.171(9),(10)
FIPA violations are FDUTPA violations; civil penalties up to $500,000 per breach for notice failures; no private cause of action.
Statute · Explicit · High
FL-001. Fla. Stat. 456.057(7)(a)
Records owners may not furnish records or discuss a patient's medical condition with anyone other than the patient, representative, or involved providers without written authorization, subject to listed exceptions.
Statute · Explicit · High · Applies to all DOH-licensed health care practitioners regardless of HIPAA status.
FL-003. Fla. Stat. 456.057(7)(c); 456.072(1)(k),(dd)
Information disclosed by a patient to a practitioner in the course of care is confidential; violations are grounds for discipline under 456.072.
Statute · Explicit · High
FL-006. Fla. Stat. 540.08
Unauthorized commercial use of a name or likeness is prohibited without express written or oral consent; remedies include injunction, damages including reasonable royalty, and punitive damages.
Statute · Explicit · High
FL-007. Gracey v. Eaker, 837 So.2d 348 (Fla. 2002); Cape Publications v. Hitchner, 549 So.2d 1374 (Fla. 1989)
Florida recognizes breach of fiduciary duty for a psychotherapist's unauthorized disclosure (Gracey v. Eaker) and the public-disclosure tort (Cape Publications v. Hitchner).
Judicial decision · Explicit (cases located) · Medium · Extension of Gracey beyond psychotherapy to cosmetic providers is unresolved.
https://www.courtlistener.com/opinion/1146259/gracey-v-eaker/
FL-008. Fla. Stat. chs. 456, 458, 459, 464, 478
No dedicated medical-spa licensure statute was located; injectables and lasers are governed by practice acts and Board of Medicine rules.
Search result (negative) · Inferred from search · Low-Medium · Board rule details (e.g., 64B8-56 electrolysis/laser) not verified from flrules.org.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All