What a provider can and can't say in Illinois
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 50/3(d) bars disclosing details of services without written waiver; no review exception |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 50/3(d) bars disclosing details of services without written waiver; no review exception |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 50/3(d) bars disclosing details of services without written waiver; no review exception |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 50/3(d) bars disclosing details of services without written waiver; no review exception |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | 50/3(d) reaches 'physicians and health care providers' only (scope for estheticians unresolved); BIPA fully applies | 50/3(d) bars disclosing details of services without written waiver; no review exception |
- Consumer privacy and health data law: Illinois has no comprehensive consumer privacy law in force as of October 22, 2026. Separately, its Biometric Information Privacy Act (BIPA) is in force; it covers face-geometry scans but excludes information captured from a patient in a health care setting, an exclusion the Illinois Supreme Court read broadly in Mosby v. Ingalls Memorial Hospital (2023). [IL-002, IL-004]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general if more than 500 residents affected. [IL-005]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (410 ILCS 50/3(d)). [IL-001]
- Patient confidentiality duties: The state confidentiality law applies to licensed providers. [IL-001]
- Lawsuits by individuals: Patients may be able to sue in some situations (BIPA; ROPA). [IL-003, IL-006]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (765 ILCS 1075). [IL-006]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (225 ILCS 60/54.2 delegation plus IDFPR/IDPH medspa memo (guidance)). [IL-008]
- Enforcement located: Strongest state enforcement evidence located: allegations or media reports only (E3). Not finding enforcement does not mean none exists. [IL-007]
Sources:
- [IL-001] 410 ILCS 50/3(d) (https://www.ilga.gov/Documents/legislation/ilcs/documents/041000500K3.htm)
- [IL-002] 740 ILCS 14/10 definitions (https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K10.htm)
- [IL-003] 740 ILCS 14/20 (a)-(c) (https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K20.htm)
- [IL-004] Mosby v. Ingalls Memorial Hospital, 2023 IL 129081 (https://ilcourtsaudio.blob.core.windows.net/antilles-resources/resources/aa521aa9-5cf0-417c-a388-85bfec69625d/Mosby%20v.%20Ingalls%20Memorial%20Hospital,%202023%20IL%20129081.pdf)
- [IL-005] 815 ILCS 530/5, 530/10 5; 10(a),(e) (https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K10.htm)
- [IL-006] 765 ILCS 1075/30, 1075/40 (https://www.ilga.gov/Documents/legislation/ilcs/documents/076510750K30.htm)
- [IL-007] Sangamon Cty. Cir. Ct. No. 2025LA000036 (https://www.aspendentalpixelsettlement.com/faq)
- [IL-008] 225 ILCS 60/54.2; IDFPR/IDPH medspa memo (rev. 2025-10-30) (https://ilga.gov/legislation/ilcs/documents/022500600K54.2.htm)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Illinois (IL) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Medical Patient Rights Act 410 ILCS 50/3(d) (no disclosure of nature/details of services; written waiver; no conditioning) | Yes - applies to licensed providers regardless of HIPAA status | No comprehensive privacy law; BIPA 740 ILCS 14 (health-care-setting exclusion; Mosby) | PIPA 815 ILCS 530: medical info (incl. website/app), health insurance, biometric covered; most expedient time; AG if >500 (HIPAA CEs per s.50) | 50/3(d) bars disclosing details of services without written waiver; no review exception | Right of Publicity Act written consent; BIPA written release for face-geometry scans (non-health-care settings); HIPAA if covered | 765 ILCS 1075 (greater of actual damages/profits or $1,000; punitive if willful; digital replicas) | Yes: BIPA 14/20; Right of Publicity Act; MPRA remedy not verified | IDFPR (Medical, Dental, Nursing boards), AG | BIPA statutory liquidated damages $1,000 (negligent) / $5,000 (intentional or reckless) per person, or actual damages if greater (single recovery per method); ROPA statutory minimum $1,000 | E3 (Aspen Dental pixel class settlement, no finding); E1-adjacent judicial ruling (Mosby) narrows BIPA in health care | High | 2026-10-22 |
| Illinois (IL) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Medical Patient Rights Act 410 ILCS 50/3(d) (no disclosure of nature/details of services; written waiver; no conditioning) | Yes - applies to licensed providers regardless of HIPAA status | No comprehensive privacy law; BIPA 740 ILCS 14 (health-care-setting exclusion; Mosby) | PIPA 815 ILCS 530: medical info (incl. website/app), health insurance, biometric covered; most expedient time; AG if >500 (HIPAA CEs per s.50) | 50/3(d) bars disclosing details of services without written waiver; no review exception | Right of Publicity Act written consent; BIPA written release for face-geometry scans (non-health-care settings); HIPAA if covered | 765 ILCS 1075 (greater of actual damages/profits or $1,000; punitive if willful; digital replicas) | Yes: BIPA 14/20; Right of Publicity Act; MPRA remedy not verified | IDFPR (Medical, Dental, Nursing boards), AG | BIPA statutory liquidated damages $1,000 (negligent) / $5,000 (intentional or reckless) per person, or actual damages if greater (single recovery per method); ROPA statutory minimum $1,000 | E3 (Aspen Dental pixel class settlement, no finding); E1-adjacent judicial ruling (Mosby) narrows BIPA in health care | High | 2026-10-22 |
| Illinois (IL) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Medical Patient Rights Act 410 ILCS 50/3(d) (no disclosure of nature/details of services; written waiver; no conditioning) | Yes - applies to licensed providers regardless of HIPAA status | No comprehensive privacy law; BIPA 740 ILCS 14 (health-care-setting exclusion; Mosby) | PIPA 815 ILCS 530: medical info (incl. website/app), health insurance, biometric covered; most expedient time; AG if >500 (HIPAA CEs per s.50) | 50/3(d) bars disclosing details of services without written waiver; no review exception | Right of Publicity Act written consent; BIPA written release for face-geometry scans (non-health-care settings); HIPAA if covered | 765 ILCS 1075 (greater of actual damages/profits or $1,000; punitive if willful; digital replicas) | Yes: BIPA 14/20; Right of Publicity Act; MPRA remedy not verified | IDFPR (Medical, Dental, Nursing boards), AG | BIPA statutory liquidated damages $1,000 (negligent) / $5,000 (intentional or reckless) per person, or actual damages if greater (single recovery per method); ROPA statutory minimum $1,000 | E3 (Aspen Dental pixel class settlement, no finding); E1-adjacent judicial ruling (Mosby) narrows BIPA in health care | High | 2026-10-22 |
| Illinois (IL) | Medical med spa | Depends; cash-only med spas often not covered | Medical Patient Rights Act 410 ILCS 50/3(d) (no disclosure of nature/details of services; written waiver; no conditioning) | Yes - applies to licensed providers regardless of HIPAA status | No comprehensive privacy law; BIPA 740 ILCS 14 (health-care-setting exclusion; Mosby) | PIPA 815 ILCS 530: medical info (incl. website/app), health insurance, biometric covered; most expedient time; AG if >500 (HIPAA CEs per s.50) | 50/3(d) bars disclosing details of services without written waiver; no review exception | Right of Publicity Act written consent; BIPA written release for face-geometry scans (non-health-care settings); HIPAA if covered | 765 ILCS 1075 (greater of actual damages/profits or $1,000; punitive if willful; digital replicas) | Yes: BIPA 14/20; Right of Publicity Act; MPRA remedy not verified | IDFPR (Medical, Dental, Nursing boards), AG | BIPA statutory liquidated damages $1,000 (negligent) / $5,000 (intentional or reckless) per person, or actual damages if greater (single recovery per method); ROPA statutory minimum $1,000 | E3 (Aspen Dental pixel class settlement, no finding); E1-adjacent judicial ruling (Mosby) narrows BIPA in health care | High | 2026-10-22 |
| Illinois (IL) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Medical Patient Rights Act 410 ILCS 50/3(d) (no disclosure of nature/details of services; written waiver; no conditioning) | 50/3(d) reaches 'physicians and health care providers' only (scope for estheticians unresolved); BIPA fully applies | No comprehensive privacy law; BIPA 740 ILCS 14 (health-care-setting exclusion; Mosby) | PIPA 815 ILCS 530: medical info (incl. website/app), health insurance, biometric covered; most expedient time; AG if >500 (HIPAA CEs per s.50) | 50/3(d) bars disclosing details of services without written waiver; no review exception | Right of Publicity Act written consent; BIPA written release for face-geometry scans (non-health-care settings); HIPAA if covered | 765 ILCS 1075 (greater of actual damages/profits or $1,000; punitive if willful; digital replicas) | Yes: BIPA 14/20; Right of Publicity Act; MPRA remedy not verified | IDFPR (Medical, Dental, Nursing boards), AG | BIPA statutory liquidated damages $1,000 (negligent) / $5,000 (intentional or reckless) per person, or actual damages if greater (single recovery per method); ROPA statutory minimum $1,000 | E3 (Aspen Dental pixel class settlement, no finding); E1-adjacent judicial ruling (Mosby) narrows BIPA in health care | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Mosby v. Ingalls Memorial Hospital
Supreme Court of Illinois · IL · 2023-11-30
- Provider type
- Hospital (health care workers)
- Relevant facts
- Nurses' finger scans for medication-dispensing system
- Legal issues
- BIPA s.10 health-care exclusion
- Holding, findings, allegations or settlement terms
- Exclusion covers biometric data collected for HIPAA treatment, payment or operations, including workers' data; appellate court reversed
- Consequences recorded
- n/a
- Procedural status
- Remanded (2023)
- Precedential?
- Yes (IL Supreme Court)
- Why it is in this research
- Face/fingerprint tools in licensed practices vs. nonmedical aesthetic businesses
Donnelly et al. v. Aspen Dental Management, Inc.
Circuit Court of Sangamon County, Illinois · IL · 2025-2026 (settlement)
- Provider type
- Dental (DSO)
- Relevant facts
- Alleged disclosure of website visitor data to Meta/Google via pixels
- Legal issues
- Privacy and consumer claims (as alleged)
- Holding, findings, allegations or settlement terms
- Class settlement; defendant denies wrongdoing; no court finding
- Consequences recorded
- Settlement fund >$18M (per administrator site)
- Procedural status
- Final approval reported granted 2025-10-20; payments reported issued from 2026-02-27 (secondary trackers; order not read; V-015). Settlement, no finding.
- Precedential?
- No
- Why it is in this research
- Website pixels at dental/cosmetic practices
Related pages
Topics
Sources
IL-002. 740 ILCS 14/10
BIPA biometric identifiers include face geometry scans but exclude information captured from a patient in a health care setting or collected for HIPAA treatment, payment or operations; 'written release' includes electronic signature.
Statute · Explicit · High · Nonmedical aesthetic businesses (e.g., face-scanning skin-analysis tools) are not within the health-care exclusion (inference).
https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K10.htm
IL-004. Mosby v. Ingalls Memorial Hospital, 2023 IL 129081
Illinois Supreme Court held the BIPA health-care exclusion covers biometric information collected, used or stored for HIPAA treatment, payment or operations, including health care workers' finger scans for medication-dispensing stations (Mosby v. Ingalls Memorial Hospital); certified questions answered, appellate court reversed.
Judicial decision · Explicit · High · Precedential statewide; official court PDF.
IL-005. 815 ILCS 530/5, 530/10
PIPA breach law covers medical information (including information provided to a website or app), health insurance information and biometric data; notice in the most expedient time possible without unreasonable delay; AG notice if more than 500 Illinois residents (not applicable to HIPAA covered entities/BAs compliant with s.50).
Statute · Explicit · High · s.50 HIPAA provisions not fetched.
https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K10.htm
IL-001. 410 ILCS 50/3(d)
Medical Patient Rights Act: each physician and health care provider must refrain from disclosing the nature or details of services provided to patients, except listed disclosures (treatment, payment, operations per HIPAA, etc.); the right may be waived in writing, but services may not be conditioned on a waiver.
Statute · Explicit · High · Applies regardless of HIPAA status to 'physicians and health care providers'; private remedy not verified.
https://www.ilga.gov/Documents/legislation/ilcs/documents/041000500K3.htm
IL-003. 740 ILCS 14/20
BIPA private right of action: greater of $1,000 liquidated or actual damages (negligent), $5,000 (intentional/reckless), plus fees; repeated collection or disclosure of the same identifier by the same method is a single violation.
Statute · Explicit · High · Maximums per person; outcomes vary.
https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K20.htm
IL-006. 765 ILCS 1075/30, 1075/40
Right of Publicity Act: no commercial use of an individual's identity without previous written consent; remedies are the greater of actual damages/profits or $1,000, plus punitive damages for willful violations; 2025 amendment adds digital replica provisions.
Statute · Explicit · High
https://www.ilga.gov/Documents/legislation/ilcs/documents/076510750K30.htm
IL-008. 225 ILCS 60/54.2; IDFPR/IDPH medspa memo (rev. 2025-10-30)
Med spa: no med-spa-specific statute; 225 ILCS 60/54.2 governs physician delegation; an IDFPR/IDPH joint memo on medical spas (updated 2025-10-30) states that injectables and tissue-altering laser procedures are medical procedures requiring licensed providers and appropriate delegation.
Statute + agency guidance · Explicit · Medium · Med spa pass, final phase part 2 (2026-10-22). Memo is guidance, not a rule (V-057). Memo URL: https://idfpr.illinois.gov/content/dam/soi/en/web/idfpr/forms/dpr/idfpr-medspa-memo.pdf
https://ilga.gov/legislation/ilcs/documents/022500600K54.2.htm
IL-007. Sangamon Cty. Cir. Ct. No. 2025LA000036
A dental chain's website-pixel class action (Donnelly v. Aspen Dental Management, Sangamon County No. 2025LA000036) produced a settlement fund of more than $18 million; defendant denied wrongdoing and no court found liability.
Private class settlement · Explicit (settlement administrator site) · Medium · Settlement website, not court record; final-approval status not verified (U-36).
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
V-015. V-015
This reference id is cited in the publication and is not a row in the claim register supplied with it.