What a provider can and can't say in Idaho
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 54-1814(13) (physicians); no review exception |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Unverified (dental board rules not read) | 54-1814(13) (physicians); no review exception |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 54-1814(13) (physicians); no review exception |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 54-1814(13) (physicians); no review exception |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 54-1814(13) (physicians); no review exception |
- Consumer privacy and health data law: Idaho has no comprehensive consumer privacy law in force as of October 22, 2026. [ID-003]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Notice is required only if misuse has occurred or is reasonably likely. [ID-002]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules (physicians). [ID-001]
- Patient confidentiality duties: Board discipline for confidentiality breaches rests on a general professional-conduct ground (54-1814(13)). [ID-001]
- Lawsuits by individuals: No private right of action was located in the statutes reviewed; other claims, such as privacy torts, may still exist. [U-98]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (IDAPA 24.33.01 delegation (eff. 2025-07-01) plus DOPL guidance). [ID-004]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [ID-001, U-97]
- Research notes and gaps: Idaho dental board confidentiality grounds were not verified (a gap). [U-98]
Sources:
- [ID-001] Idaho Code 54-1814(13), (4) (https://legislature.idaho.gov/statutesrules/idstat/Title54/T54CH18/SECT54-1814/)
- [ID-002] Idaho Code 28-51-104(5); 28-51-105(1); 28-51-106(2); 28-51-107 (https://legislature.idaho.gov/statutesrules/idstat/Title28/T28CH51/SECT28-51-105/)
- [ID-003] n/a (https://legislature.idaho.gov/statutesrules/idstat/)
- [ID-004] IDAPA 24.33.01 (https://files.dfm.idaho.gov/dfm-admin-website/rules/current/24/243301.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Idaho (ID) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Idaho Code 54-1814(13) (physicians: failing to safeguard confidentiality); dental rules not verified | Yes - applies to licensed providers regardless of HIPAA status | None | 28-51-104/105: medical info NOT covered; misuse-likely trigger; most expedient time; no AG notice for private entities | 54-1814(13) (physicians); no review exception | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located; torts not researched | Idaho Board of Medicine, Board of Dentistry, Board of Nursing, AG | Breach: up to $25,000 per breach (intentional failure); license discipline | E4 | Medium-High | 2026-10-22 |
| Idaho (ID) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Idaho Code 54-1814(13) (physicians: failing to safeguard confidentiality); dental rules not verified | Unverified (dental board rules not read) | None | 28-51-104/105: medical info NOT covered; misuse-likely trigger; most expedient time; no AG notice for private entities | 54-1814(13) (physicians); no review exception | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located; torts not researched | Idaho Board of Medicine, Board of Dentistry, Board of Nursing, AG | Breach: up to $25,000 per breach (intentional failure); license discipline | E4 | Medium-High | 2026-10-22 |
| Idaho (ID) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Idaho Code 54-1814(13) (physicians: failing to safeguard confidentiality); dental rules not verified | Yes - applies to licensed providers regardless of HIPAA status | None | 28-51-104/105: medical info NOT covered; misuse-likely trigger; most expedient time; no AG notice for private entities | 54-1814(13) (physicians); no review exception | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located; torts not researched | Idaho Board of Medicine, Board of Dentistry, Board of Nursing, AG | Breach: up to $25,000 per breach (intentional failure); license discipline | E4 | Medium-High | 2026-10-22 |
| Idaho (ID) | Medical med spa | Depends; cash-only med spas often not covered | Idaho Code 54-1814(13) (physicians: failing to safeguard confidentiality); dental rules not verified | Yes - applies to licensed providers regardless of HIPAA status | None | 28-51-104/105: medical info NOT covered; misuse-likely trigger; most expedient time; no AG notice for private entities | 54-1814(13) (physicians); no review exception | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located; torts not researched | Idaho Board of Medicine, Board of Dentistry, Board of Nursing, AG | Breach: up to $25,000 per breach (intentional failure); license discipline | E4 | Medium-High | 2026-10-22 |
| Idaho (ID) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Idaho Code 54-1814(13) (physicians: failing to safeguard confidentiality); dental rules not verified | No | None | 28-51-104/105: medical info NOT covered; misuse-likely trigger; most expedient time; no AG notice for private entities | 54-1814(13) (physicians); no review exception | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located; torts not researched | Idaho Board of Medicine, Board of Dentistry, Board of Nursing, AG | Breach: up to $25,000 per breach (intentional failure); license discipline | E4 | Medium-High | 2026-10-22 |
Related pages
Topics
Healthcare industry
Sources
ID-003. n/a
Idaho has no comprehensive consumer privacy or consumer-health-data law as of 2026-10-22.
Search result (negative) · Inferred from search · Medium · Based on legislative trackers and code search; not exhaustive.
ID-002. Idaho Code 28-51-104(5); 28-51-105(1); 28-51-106(2); 28-51-107
Breach law 'personal information' is limited to SSN, driver's license/ID, and financial account with access code; medical information is NOT covered. Notice is required only if misuse has occurred or is reasonably likely; intentional failure to notify: fine up to $25,000 per breach; regulated entities following their regulator's procedures are deemed compliant.
Statute · Explicit · High · AG 24-hour notice applies to public agencies only.
https://legislature.idaho.gov/statutesrules/idstat/Title28/T28CH51/SECT28-51-105/
ID-001. Idaho Code 54-1814(13), (4)
Physician discipline ground: 'Failing to safeguard the confidentiality of medical records or other medical information pertaining to identifiable patients, except as required or authorized by law'; also unethical or unprofessional advertising.
Statute · Explicit · High · Applies regardless of HIPAA status. No general Idaho patient-confidentiality statute with a private remedy was located.
https://legislature.idaho.gov/statutesrules/idstat/Title54/T54CH18/SECT54-1814/
ID-004. IDAPA 24.33.01
Med spa: no med-spa-specific statute located; IDAPA 24.33.01 (Board of Medicine rules, effective 2025-07-01) governs physician supervision and delegation, and DOPL guidance addresses who may administer injectables.
Regulation + agency guidance · Explicit (rule); application to aesthetic procedures partly from guidance · Medium · Med spa pass, final phase part 2 (2026-10-22). Procedure rules (binding) plus guidance; delegation pinpoints not extracted (V-056).
https://files.dfm.idaho.gov/dfm-admin-website/rules/current/24/243301.pdf
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All