Bracketed codes are reference numbers for the sources listed in the research claim register; "research gap" codes point to logged open research issues.
- Covered entity
- Under HIPAA, a health plan, a health care clearinghouse, or a health care provider that conducts standard electronic transactions. [F-001]
- Protected health information (PHI)
- Individually identifiable health information held by a covered entity or business associate, in any form. [F-003]
- Health care
- Under HIPAA, care, services or supplies related to health, including services that affect the structure or function of the body. [F-002]
- Consent
- General agreement by a patient. Under some state laws written consent is required; under HIPAA, consent does not substitute for an authorization where one is required. [F-006, RI-003]
- Breach
- Under HIPAA, an impermissible use or disclosure of unsecured PHI, presumed reportable unless a risk assessment shows a low probability of compromise. State breach laws use their own definitions. [F-010]
- Violation
- Failing to follow a legal requirement. A violation is not necessarily a reportable breach. [F-010]
- Entity-level exemption
- A privacy law exemption that excludes a HIPAA-regulated business entirely. [NV-002, TX-008]
- Data-level exemption
- A privacy law exemption that excludes only HIPAA-protected data, so the business's other data can still be covered. [WA-002, MD-006]
- Settlement / consent order
- An agreed resolution of allegations, often without admission. It is not a court finding that the law was violated. [F-031, IN-006]
- Finding
- A determination of fact or law by a court or agency after review of evidence.
- Statutory maximum
- The highest penalty a law allows. It is not a typical outcome. [F-014]
- Section 230
- A federal law that generally protects websites from liability as publishers of user content. [F-034]
- Consumer Review Fairness Act
- A federal law that voids form-contract terms restricting or penalizing consumer reviews. [F-032]
- Med spa
- A business offering cosmetic medical procedures outside a traditional office. Some states define it in statute; many regulate the procedures instead.† [CT-009, TN-006, IN-007]
- Supplemental jurisdiction
- Here, the District of Columbia, included alongside the 50 states but not a state. [DC-001]
- Evidence labels (E1-E5)
- This guide's labels for enforcement evidence: E1 official enforcement against comparable conduct; E2 related official enforcement or charges that are allegations only; E3 allegations or media only; E4 law exists, no enforcement located; E5 not researched.
Related pages
Topics
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
F-001. 45 CFR 160.103
A health care provider is a HIPAA covered entity only if it transmits health information electronically in connection with a HIPAA standard transaction (e.g., claims, eligibility).
Regulation · Explicit · High · Cash-only practices that never conduct standard transactions (directly or via a billing agent) are generally not covered; facts must be checked practice-by-practice.
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
F-002. 45 CFR 160.103
'Health care' includes services affecting the structure or function of the body, so elective cosmetic procedures performed by providers are health care.
Regulation · Explicit (definition); application to cosmetic care inferred · High · Inference that cosmetic injectables/surgery fall within 'structure or function' is strong but OCR has not issued cosmetic-specific guidance located in this research.
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
F-005. 45 CFR 164.508(a)(3)
A covered entity must obtain an authorization for any use or disclosure of PHI for marketing, except face-to-face communications or promotional gifts of nominal value; authorizations must disclose remuneration from third parties.
Regulation · Explicit · High · Whether posting a before/after photo on the practice's own social media is 'marketing' under 164.501 vs. another non-permitted disclosure, either way an authorization is required absent a listed permission; inferred.
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
F-006. 45 CFR 164.508(b)(5),(c)(1)-(2)
A valid HIPAA authorization must contain core elements (description of information, who discloses, recipient, purpose, expiration, signature/date) and required statements; it may be revoked in writing except to the extent of reliance.
Regulation · Explicit · High · Generic 'consent' clauses in intake forms often lack required elements; HIPAA 'consent' (164.506(b)) is not an authorization.
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
RI-003. R.I. Gen. Laws 5-37.3-3, 5-37.3-4(a)(1)-(3)
Confidentiality of Health Care Communications and Information Act: a health care provider (any person licensed by the state, or lawfully providing health care) may not release confidential health care information without the patient's written consent on a compliant form, subject to listed exceptions.
Statute · Explicit · High · Applies regardless of HIPAA status to licensed providers.
https://webserver.rilegislature.gov/Statutes/TITLE5/5-37.3/INDEX.htm
F-010. 45 CFR 164.402
An impermissible use or disclosure of unsecured PHI is presumed a breach unless a documented four-factor risk assessment shows a low probability of compromise; three narrow exclusions apply.
Regulation · Explicit · High · A public review reply disclosing PHI is a privacy violation and generally also a breach requiring notification unless the assessment supports low probability; OCR's New Vision CAP required breach notices (from resolution agreement).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.402
NV-002. NRS 603A.490(1)(a)
Unlike Washington, Nevada's exemption is entity-level: any person or entity subject to HIPAA is exempt.
Statute · Explicit · High · A HIPAA-covered practice's non-PHI web data appears exempt in NV but not WA (inferred contrast).
TX-008. Tex. Bus. & Com. Code 541.002, .003, .107
Texas Data Privacy and Security Act exempts HIPAA covered entities (entity-level) and PHI (data-level), and applies only to non-small businesses except the sale-of-sensitive-data consent rule, which applies to small businesses too.
Statute · Explicit · High · Health data is 'sensitive data' requiring consent for non-exempt businesses.
WA-002. RCW 19.373.100(1)
MHMDA exemptions are data-level: HIPAA PHI and health care information governed by RCW 70.02 are exempt, not entities.
Statute · Explicit · High · A HIPAA-covered practice's website/marketing data that is not PHI may still be consumer health data (inferred).
MD-006. Md. Code, Com. Law 14-4702; 14-4703(b)(1), (b)(6)(ii)
MODPA applies at 35,000 consumers (or 10,000 with 20%+ revenue from data sales); exemptions are DATA-level only (PHI; MCMRA records held by a CE/BA applying HIPAA standards); no entity-level covered-entity exemption.
Statute · Explicit · High · Non-PHI marketing data of a covered cosmetic practice can be in scope if thresholds are met (inference).
https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4703
F-031. HHS OCR, Cadia Healthcare Facilities Resolution Agreement (2025-04-22; announced 2025-09-30)
OCR resolved a website testimonial case: Cadia Healthcare Facilities (five Delaware rehabilitation and nursing providers) posted 150 patients' names, photographs and treatment and recovery details as 'success stories' without valid written HIPAA authorizations. OCR determined impermissible disclosures, inadequate safeguards and failure to give breach notice; Cadia paid $182,000 and agreed to a 2-year corrective action plan that includes training marketing staff and notifying every patient posted without authorization. OCR stated that a valid written authorization is generally necessary before posting PHI in a website testimonial or social media campaign.
Federal enforcement (resolution agreement) · Explicit · High · Settlement, no admission stated in the release. Not a cosmetic practice, but the conduct (testimonial posts with photos) maps directly to before/after and testimonial marketing (application inferred). Unauthorized posting was treated as a breach requiring notice. Added 2026-10-22 (V-049, V-050).
https://www.hhs.gov/press-room/ocr-settles-hipaa-with-cadia-healthcare-facilities.html
IN-006. State of Indiana ex rel. Rokita v. Westend Dental LLC, No. 1:24-cv-02255 (S.D. Ind.)
Indiana AG suit against a dental group ALLEGED, among other things, that public replies to online patient reviews on Google and Facebook posts disclosed patients' PHI (including minors and x-rays) without authorization, pleaded under HIPAA (42 U.S.C. 1320d-5(d)), the breach law and the Deceptive Consumer Sales Act. A consent judgment entered 2025-01-02 (no admission) bars disclosing PHI 'in response to online reviews' or in ads without patient authorization, requires social-media and review policies, and requires a $350,000 payment.
Enforcement (state AG; federal-court consent judgment) · Explicit (complaint and proposed judgment read; entered version not read) · High · Settlement, not a finding. Dental practice (cosmetic status not stated). State AG HIPAA enforcement against review replies; the payment also resolves breach claims.
https://storage.courtlistener.com/recap/gov.uscourts.insd.218861/gov.uscourts.insd.218861.1.0.pdf
F-014. 45 CFR 102.3; 91 FR 3665
2026 inflation-adjusted HIPAA CMP amounts: Tier 1 $145-$73,011; Tier 2 $1,461-$73,011; Tier 3 $14,602-$73,011; Tier 4 $73,011-$2,190,294; CY cap $2,190,294.
Regulation · Explicit · High · These are statutory/regulatory maxima. OCR resolution amounts in review-response cases ranged $10,000-$50,000 (see cases.csv); maxima are not typical outcomes. Inflation-adjusted values of the enforcement-discretion caps were not verified from a primary source.
F-034. 47 U.S.C. 230(c)(1)-(2)
Section 230: no provider or user of an interactive computer service may be treated as the publisher or speaker of information provided by another information content provider, and platforms are protected for good-faith moderation decisions. Review sites generally decide removal under their own policies; they are generally not liable for patients' reviews.
Statute · Explicit (text); 'generally decide under their own policies' is an inference · High · Med spa pass, final phase part 2 (2026-10-22). Read on GovInfo (V-073). Exceptions in 230(e) (federal criminal law, IP, etc.) not analyzed. Statements about platform policies are inference, not law.
https://www.govinfo.gov/link/uscode/47/230?type=usc&year=mostrecent&link-type=html
F-032. 15 U.S.C. 45b
Consumer Review Fairness Act: a provision of a form contract is void if it prohibits or restricts an individual's ability to post a review, imposes a penalty or fee for doing so, or takes the reviewer's intellectual property in the review (other than a non-exclusive license). It does not affect legal duties of confidentiality, defamation claims, or a business's right to remove from its own website content that contains another person's personal information, is unlawful or abusive, unrelated, or clearly false. The FTC and state attorneys general enforce it.
Statute · Explicit · High · Med spa pass, final phase part 2 (2026-10-22). Read on GovInfo U.S. Code (2024 ed.) (V-071). Bars patient 'gag clauses' in form contracts; does not authorize removal of reviews on third-party platforms.
https://www.govinfo.gov/link/uscode/15/45b?type=usc&year=mostrecent&link-type=html
CT-009. Conn. Gen. Stat. 19a-903c (P.A. 14-119; P.A. 15-242)
Med spa statute: a medical spa must employ or contract with a physician, PA or APRN (medical director duties); a licensed provider must perform an initial in-person assessment before cosmetic medical procedures; procedures may be performed only by those providers or by a supervised RN as allowed; the names of the medical director and providers must be posted on site, on the website and in advertising. No DPH med spa regulations were located.
Statute · Explicit (OLR summary); statute text read on Justia (secondary) · Medium · Med spa pass, final phase part 2 (2026-10-22). Statute text from Justia (secondary host); summary confirmed in the official OLR report 2025-R-0159. Official CGS page not read (cga.ct.gov timeouts earlier) (V-055, U-99).
TN-006. Tenn. Code 63-1-153(a)-(c); 63-6-105(a)-(b)
Medical spa law: a 'medical spa' is any entity offering or performing cosmetic medical services (any service using a biologic or synthetic material, chemical, mechanical device or displaced energy that alters or is capable of altering living tissue to improve appearance), excluding a physician-owned practice; it must display the medical director's name and board-certification status at the site and in advertising. The Board of Medical Examiners maintains an online registry that also includes physician-owned practices holding themselves out as med spas or primarily performing elective cosmetic services.
Statute · Explicit · Medium-High · Secondary host for statute text; implementing rule read from the official Secretary of State PDF (TN-007).
https://law.justia.com/codes/tennessee/title-63/chapter-1/part-1/section-63-1-153/
IN-007. Ind. Code 25-22.5-12.5-1 to -6
Medical spa registration statute (added 2026): a 'medical spa' is a facility or practice offering medical services, using prescription drugs by IV, IM or subcutaneous delivery, and holding itself out as cosmetic or lifestyle focused (weight loss, wellness, botulinum toxin and fillers, hormones, cosmetic laser or energy devices including hair removal); physician offices and otherwise state-licensed facilities are excluded. Registration is required from January 1, 2027 (fine up to $5,000 for unregistered operation); each spa must designate a responsible practitioner with prescriptive authority and relevant training who is physically present enough to ensure compliance and that every worker is licensed for and trained in their services; serious adverse events must be reported; the public database must redact personally identifying health information.
Statute · Explicit · High · Binding, but the registration duty is future-dated. Board implementing procedure (due 2026-10-01) not read (U-64).
DC-001. B25-0930; B26-0525
D.C. is a SUPPLEMENTAL jurisdiction (not a state). No comprehensive consumer privacy or consumer-health-data law. B25-0930 (Consumer Health Information Privacy Protection Act of 2024, introduced 2024-07-12 at the AG's request; Health Committee hearing 2024-10-17) died at the end of Council Period 25. B26-0525 (Personal Health Data Security Amendment Act of 2025) was introduced 2025-12-01 with a roundtable on 2026-03-23 and was pending in committee as of May 2026. Proposed bills are not law.
Legislative history · Per secondary trackers (LegiScan, BillTrack50, recordinglaw.com) · Medium · LIMS pages did not render to the fetch tool; B26-0525 status after May 2026 unverified (U-91).