Reputation MedicsReputation Medics™TRUST RESTORED

Last updated Oct 22, 2026

Hawaii

This guide is general educational information, not legal advice, and it does not create a lawyer-client relationship. Laws change and their application depends on specific facts. It does not promise any outcome, including removal of any review, any settlement, fine or successful claim. Consult a qualified lawyer licensed in your state before acting.

What a provider can and can't say in Hawaii

The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.

Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]

Review-response rule by practice type

Practice categoryHIPAA statusApplies without HIPAA?Review-response rule source
Cosmetic/plastic surgeryDepends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are notYes - applies to licensed providers regardless of HIPAA status453-8(a)(9) ethics; 323B gives no cover for non-HIPAA-permitted disclosures; no board order located
Cosmetic dentistryUsually yes if it files any electronic dental claims; cash-only dental is notYes - applies to licensed providers regardless of HIPAA status453-8(a)(9) ethics; 323B gives no cover for non-HIPAA-permitted disclosures; no board order located
General medical/dermatology (elective cosmetic)Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patientsYes - applies to licensed providers regardless of HIPAA status453-8(a)(9) ethics; 323B gives no cover for non-HIPAA-permitted disclosures; no board order located
Medical med spaDepends; cash-only med spas often not coveredYes - applies to licensed providers regardless of HIPAA status453-8(a)(9) ethics; 323B gives no cover for non-HIPAA-permitted disclosures; no board order located
Nonmedical aesthetic businessGenerally no (not a health care provider billing electronically)No (art. I sec. 6 reach to private parties outside litigation unresolved)453-8(a)(9) ethics; 323B gives no cover for non-HIPAA-permitted disclosures; no board order located
  • Consumer privacy and health data law: Hawaii has no comprehensive consumer privacy law in force as of October 22, 2026. Status of proposals: SB 1037 carried over; SB 1163 died. Bills are not law. [HI-001]
  • Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: Office of Consumer Protection if more than 1,000 residents affected; HIPAA-compliant deemed compliant.† [HI-002, HI-004]
  • Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules (ethics) and constitution.† [HI-005, HI-006]
  • Patient confidentiality duties: The board can discipline unethical conduct, which can include confidentiality breaches (453-8(a)(9)).† [HI-005]
  • Lawsuits by individuals: Patients may be able to sue in some situations (482P likeness; 487N-3(b)).† [HI-007, HI-003]
  • Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (482P). [HI-007]
  • Med spa rules: Med spas: only agency guidance was found (informal opinion); the binding rules are the general professional practice acts. [HI-008]
  • Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists.† [HI-005, U-97]
  • Research notes and gaps: Hawaii statute text after 2017 could not be checked on the official site because it blocked automated access. [U-95]

† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.

Sources:

*Educational information, not legal advice. Last reviewed October 22, 2026.*

State comparison

All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.

Cosmetic and aesthetic privacy comparison for 50 states and the District of Columbia, current as of Oct 22, 2026
Hawaii (HI)Cosmetic/plastic surgeryDepends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are notHRS 453-8(a)(9) ethics standards (AMA/HMA); Haw. Const. art. I sec. 6 informational privacy; HRS 323B safe harbor for HIPAA-permitted usesYes - applies to licensed providers regardless of HIPAA statusNone enacted (SB 1037 carried over, no action; SB 1163 died 2026)487N: medical info NOT covered; OCP notice if >1,000; HIPAA-compliant providers deemed compliant453-8(a)(9) ethics; 323B gives no cover for non-HIPAA-permitted disclosures; no board order locatedHIPAA if covered; 482P publicity rights (express or implied consent)HRS 482P (greater of $10,000 or actual damages, plus profits)Yes: 482P likeness action; 487N-3(b) actual damages (breach)Hawaii Medical Board (DCCA/RICO), Board of Dentistry, Board of Nursing, Board of Barbering and Cosmetology, AG/OCP487N up to $2,500/violation; 482P $10,000 minimum statutory damages; board fines not readE4Medium2026-10-22
Hawaii (HI)Cosmetic dentistryUsually yes if it files any electronic dental claims; cash-only dental is notHRS 453-8(a)(9) ethics standards (AMA/HMA); Haw. Const. art. I sec. 6 informational privacy; HRS 323B safe harbor for HIPAA-permitted usesYes - applies to licensed providers regardless of HIPAA statusNone enacted (SB 1037 carried over, no action; SB 1163 died 2026)487N: medical info NOT covered; OCP notice if >1,000; HIPAA-compliant providers deemed compliant453-8(a)(9) ethics; 323B gives no cover for non-HIPAA-permitted disclosures; no board order locatedHIPAA if covered; 482P publicity rights (express or implied consent)HRS 482P (greater of $10,000 or actual damages, plus profits)Yes: 482P likeness action; 487N-3(b) actual damages (breach)Hawaii Medical Board (DCCA/RICO), Board of Dentistry, Board of Nursing, Board of Barbering and Cosmetology, AG/OCP487N up to $2,500/violation; 482P $10,000 minimum statutory damages; board fines not readE4Medium2026-10-22
Hawaii (HI)General medical/dermatology (elective cosmetic)Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patientsHRS 453-8(a)(9) ethics standards (AMA/HMA); Haw. Const. art. I sec. 6 informational privacy; HRS 323B safe harbor for HIPAA-permitted usesYes - applies to licensed providers regardless of HIPAA statusNone enacted (SB 1037 carried over, no action; SB 1163 died 2026)487N: medical info NOT covered; OCP notice if >1,000; HIPAA-compliant providers deemed compliant453-8(a)(9) ethics; 323B gives no cover for non-HIPAA-permitted disclosures; no board order locatedHIPAA if covered; 482P publicity rights (express or implied consent)HRS 482P (greater of $10,000 or actual damages, plus profits)Yes: 482P likeness action; 487N-3(b) actual damages (breach)Hawaii Medical Board (DCCA/RICO), Board of Dentistry, Board of Nursing, Board of Barbering and Cosmetology, AG/OCP487N up to $2,500/violation; 482P $10,000 minimum statutory damages; board fines not readE4Medium2026-10-22
Hawaii (HI)Medical med spaDepends; cash-only med spas often not coveredHRS 453-8(a)(9) ethics standards (AMA/HMA); Haw. Const. art. I sec. 6 informational privacy; HRS 323B safe harbor for HIPAA-permitted usesYes - applies to licensed providers regardless of HIPAA statusNone enacted (SB 1037 carried over, no action; SB 1163 died 2026)487N: medical info NOT covered; OCP notice if >1,000; HIPAA-compliant providers deemed compliant453-8(a)(9) ethics; 323B gives no cover for non-HIPAA-permitted disclosures; no board order locatedHIPAA if covered; 482P publicity rights (express or implied consent)HRS 482P (greater of $10,000 or actual damages, plus profits)Yes: 482P likeness action; 487N-3(b) actual damages (breach)Hawaii Medical Board (DCCA/RICO), Board of Dentistry, Board of Nursing, Board of Barbering and Cosmetology, AG/OCP487N up to $2,500/violation; 482P $10,000 minimum statutory damages; board fines not readE4Medium2026-10-22
Hawaii (HI)Nonmedical aesthetic businessGenerally no (not a health care provider billing electronically)HRS 453-8(a)(9) ethics standards (AMA/HMA); Haw. Const. art. I sec. 6 informational privacy; HRS 323B safe harbor for HIPAA-permitted usesNo (art. I sec. 6 reach to private parties outside litigation unresolved)None enacted (SB 1037 carried over, no action; SB 1163 died 2026)487N: medical info NOT covered; OCP notice if >1,000; HIPAA-compliant providers deemed compliant453-8(a)(9) ethics; 323B gives no cover for non-HIPAA-permitted disclosures; no board order locatedHIPAA if covered; 482P publicity rights (express or implied consent)HRS 482P (greater of $10,000 or actual damages, plus profits)Yes: 482P likeness action; 487N-3(b) actual damages (breach)Hawaii Medical Board (DCCA/RICO), Board of Dentistry, Board of Nursing, Board of Barbering and Cosmetology, AG/OCP487N up to $2,500/violation; 482P $10,000 minimum statutory damages; board fines not readE4Medium2026-10-22

Cases this research tied to this jurisdiction

Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.

Pacific Radiation Oncology, LLC v. Queen's Medical Center

Supreme Court of Hawaii (certified questions from D. Haw.) · HI · 2016-06-13

Provider type
Hospital; physician group
Relevant facts
Parties to a business dispute sought to use nonparty patients' medical records (including de-identified records) in litigation
Legal issues
Haw. Const. art. I, sec. 6 informational privacy
Holding, findings, allegations or settlement terms
Judicial holding: records of nonparty patients may not be used or compelled in litigation absent a compelling state interest, even de-identified
Consequences recorded
Both certified questions answered in the negative
Procedural status
Final
Precedential?
Yes (Hawaii Supreme Court)
Why it is in this research
Strong state constitutional policy on health information; reach to public disclosures by private providers unresolved

Primary source

Related pages

Topics

Reference

Healthcare industry

† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.

Sources

  1. HI-001. SB 1037 (2025-2026); SB 1163 (2026); HB 1566 (2024)

    No comprehensive consumer privacy or consumer-health-data law. SB 1037 (Consumer Data Protection, 2025) was re-referred 2025-02-04 and carried over to 2026 with no further recorded action; SB 1163 (geolocation and other data sales) passed the Senate in 2026 and died in House committee; HB 1566 (consumer health data, 2024) died. Proposed bills are not law.

    Legislative history · Per official status page (via search index) and secondary trackers · Medium · capitol.hawaii.gov returned a Cloudflare block to curl and the fetch tool (not circumvented). SB 1163 and HB 1566 status per LegiScan/BillTrack50 (secondary).

    https://www.capitol.hawaii.gov/session/measure_indiv.aspx?billnumber=1037&billtype=SB&year=2026

  2. HI-002. HRS 487N-1, 487N-2(a), (f), (g)(2)

    Breach law: 'personal information' = name plus SSN, driver's license/Hawaii ID, or financial account number with access code or password; medical information NOT covered. Notice without unreasonable delay; Office of Consumer Protection and consumer reporting agencies if more than 1,000 persons; a health plan or health care provider subject to and in compliance with HIPAA privacy and security standards is deemed compliant.

    Statute · Explicit · Medium-High · Verified against the official 2017 HRS compilation and consistent with Justia 2025 (V-045); post-2017 amendments unconfirmed (capitol.hawaii.gov Cloudflare block, not circumvented). SB 3016 (2026) would have added health-insurance and medical ID numbers (proposed; not law).

    https://law.justia.com/codes/hawaii/title-26/chapter-487n/section-487n-2/

  3. HI-004. HRS 323B-3(a)-(c), 323B-4

    Health Care Privacy Harmonization Act: a covered entity's or business associate's use or disclosure permitted by the HIPAA Privacy Rule is deemed to comply with all state laws on use, disclosure or confidentiality; a HIPAA-compliant authorization satisfies state authorization laws; HIPAA-compliant breach notice satisfies state PHI breach-notice laws. The Act does not override stricter federal rules (42 CFR Part 2) or state evidentiary privileges.

    Statute · Explicit · Medium-High · Official 2017 compilation; later amendments not checked (U-90). A safe harbor, not a prohibition: a review reply that HIPAA does not permit gets no protection from 323B (inference).

    https://data.capitol.hawaii.gov/sessions/session2017/HRS-Chapter-PDF's/HRS_0323B.pdf

  4. HI-005. HRS 453-8(a)(3), (7), (9)

    Medical Board grounds include false, fraudulent or deceptive advertising; professional misconduct; and conduct contrary to recognized standards of ethics adopted by the Hawaii Medical Association, AMA, Hawaii Association of Osteopathic Physicians and Surgeons, or AOA. No explicit confidentiality ground.

    Statute · Explicit · Medium-High · AMA confidentiality opinions enter through (a)(9) (inference). Fine amounts (HRS 453-8.6 / 436B-19) not read (U-90).

    https://law.justia.com/codes/hawaii/title-25/chapter-453/section-453-8/

  5. HI-006. Haw. Const. art. I, sec. 6; Pacific Radiation Oncology, LLC v. Queen's Med. Ctr., SCCQ-15-0000300 (Haw. 2016); Brende v. Hara, 113 Haw. 424 (2007)

    Hawaii Constitution art. I, sec. 6 (right to privacy) protects patients' health information: parties may not use or be compelled to produce confidential medical records of nonparty patients in litigation, even de-identified, absent a compelling state interest; the framers aimed to guard against abuse of intimate information 'in the hands of government or private parties'.

    Constitution + case law · Explicit · High · Holding concerns use in litigation; whether art. I, sec. 6 gives a damages action against a private provider for a public disclosure is NOT established (U-90).

    https://www.courts.state.hi.us/wp-content/uploads/2016/06/SCCQ-15-0000300ada.pdf

  6. HI-007. HRS 482P-5, 482P-6(a), (b), (e)

    Publicity Rights Act: using a living individual's name, voice, signature or likeness in advertising without express or implied consent infringes the right; liability is the greater of $10,000 or actual damages, plus attributable profits; injunctions and attorneys' fees available.

    Statute · Explicit · Medium-High · Applies to patient photos/testimonials in ads (application inferred). Currency after 2017 not checked; 482P-7 exemptions not analyzed.

    https://data.capitol.hawaii.gov/sessions/session2017/HRS-Chapter-PDF's/HRS_0482P.pdf

  7. HI-003. HRS 487N-3(a), (b)

    Breach-law remedies: penalties up to $2,500 per violation in an action by the AG or the Office of Consumer Protection; injured parties may recover actual damages and the court may award attorneys' fees.

    Statute · Explicit · Medium-High · Verified against the official 2017 HRS compilation and consistent with Justia 2025 (V-045). Maximum, not typical.

    https://law.justia.com/codes/hawaii/title-26/chapter-487n/section-487n-3/

  8. HI-008. Hawaii Medical Board, Minutes of Jan. 12, 2017; HAR 16-201-90

    Hawaii Medical Board informal opinion (minutes, 2017-01-12): unlicensed individuals may not use lasers or IPL to cut, shape, burn, vaporize or otherwise structurally alter tissue, whether or not delegated or supervised; licensed nurses may do so only if their practice act allows and the task is delegated and directed by a physician; medical assistants are unregulated and HRS 453-5.3 concerns physician assistants only. The Board affirmed its August 2014 informal opinion.

    Guidance (board informal opinion) · Explicit (guidance) · High · Informal interpretations are not binding (HAR 16-201-90). No Hawaii med spa statute or facility license located (secondary).

    https://cca.hawaii.gov/wp-content/uploads/2026/03/Medical_170112.pdf

  9. F-007. 45 CFR 164.502(a)

    Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.

    Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502

  10. F-024. HHS OCR resolution agreements

    OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).

    Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).

    https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html

  11. F-003. 45 CFR 160.103

    PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.

    Regulation · Explicit · High

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103

  12. U-97. U-97 · Open (accepted limitation)

    Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.

    High priority · All

  13. U-95. U-95 · Open

    Claims and cases that remain unverifiable from official sources (bot checks, outages or no public record): Ohio bill status (legislature.ohio.gov connection failed); Tausinga (no docket found); OSBMLS v. Larson final order; TN, AR, MS and GA code text (Justia hosts; tnsosfiles 403); KS-005 rule text (KSBHA 403); MS-004 rule; NM-001 (NMOneSource 403); WV rule 11-1A-12.1.f (LII host); Hawaii HRS text after 2017 (capitol.hawaii.gov Cloudflare, not circumvented); DC B26-0525 status; Aspen Dental final approval order; Cancelmo docket entries (PACERMonitor mirror); basis of the Amazon Ads SDK termination; case-law reproductions on secondary hosts.

    High priority · All