What a provider can and can't say in Indiana
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 844 IAC 5-2-2 via 25-1-9-4(a)(3) (Bernard); AG/HIPAA consent judgment barring PHI in review replies (Westend) |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 844 IAC 5-2-2 via 25-1-9-4(a)(3) (Bernard); AG/HIPAA consent judgment barring PHI in review replies (Westend) |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 844 IAC 5-2-2 via 25-1-9-4(a)(3) (Bernard); AG/HIPAA consent judgment barring PHI in review replies (Westend) |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 844 IAC 5-2-2 via 25-1-9-4(a)(3) (Bernard); AG/HIPAA consent judgment barring PHI in review replies (Westend) |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 844 IAC 5-2-2 via 25-1-9-4(a)(3) (Bernard); AG/HIPAA consent judgment barring PHI in review replies (Westend) |
- Consumer privacy and health data law: Indiana has a consumer privacy law in force (ICDPA eff. 2026-01-01). It exempts HIPAA-covered practices as a whole (an entity-level exemption). [IN-001, IN-002]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: attorney general. [IN-003, IN-006]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board rules (text not read) and statute. [IN-004]
- Research notes and gaps: A specific board confidentiality ground was not read or not located (844 IAC 5-2-2); this is a research gap, not a finding that none exists. [U-98]
- Lawsuits by individuals: Court decisions recognize patient privacy or confidentiality lawsuits in some situations (Hinchy). [IN-008]
- Research notes and gaps: Indiana has a reported likeness statute (IC 32-36), but its text was not read in this research (a gap). [U-98]
- Med spa rules: Med spas: there is med-spa-specific law (2026 registration). [IN-007]
- Enforcement located: Strongest state enforcement evidence located: official enforcement against comparable conduct (E1) (Attorney General v. Westend: consent judgment, no admission). Not finding enforcement does not mean none exists. [IN-006, IN-005]
Sources:
- [IN-001] Ind. Code 24-15-1-1(a), (b)(3)-(4); 24-15-1-2; 24-15-2-28; 24-15-4-1(5) (https://iga.in.gov/ic/2026/Title_24/Article_15.pdf)
- [IN-002] Ind. Code 24-15-10-1 to -3 (https://iga.in.gov/ic/2026/Title_24/Article_15.pdf)
- [IN-003] Ind. Code 24-4.9-2-10; 24-4.9-3-1(c); 24-4.9-3-3(a); 24-4.9-4-2 (https://iga.in.gov/ic/2026/Title_24/Article_4.9.pdf)
- [IN-004] Ind. Code 16-39-5-3(c)-(d) (https://iga.in.gov/ic/2026/Title_16/Article_39/Chapter_5.pdf)
- [IN-005] In re Caitlin Bernard, M.D., Cause No. 2022 MLB 0024 Ultimate findings; Count III; Order 1-2 (https://indianacapitalchronicle.com/wp-content/uploads/2023/07/01078719A202306275.pdf)
- [IN-006] State of Indiana ex rel. Rokita v. Westend Dental LLC, No. 1:24-cv-02255 (S.D. Ind.) Complaint paras. 101-108; proposed consent judgment paras. 58, 75 (https://storage.courtlistener.com/recap/gov.uscourts.insd.218861/gov.uscourts.insd.218861.1.0.pdf)
- [IN-007] Ind. Code 25-22.5-12.5-1 to -6 (https://iga.in.gov/ic/2026/Title_25/Article_22.5.pdf)
- [IN-008] Walgreen Co. v. Hinchy, 21 N.E.3d 99 (Ind. Ct. App. 2014) (https://caseclips.courts.in.gov/2014/11/20/walgreen-v-hinchy/)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Indiana (IN) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | IC 16-39 (records; 16-39-5-3 confidentiality in business use); 844 IAC 5-2-2 physician confidentiality (not read) | Yes - applies to licensed providers regardless of HIPAA status | ICDPA (IC 24-15), eff. 2026-01-01: ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50%; sensitive data needs consent | 24-4.9: medical info NOT covered; <=45 days; AG notice always; HIPAA compliance-plan exemption (partly read) | 844 IAC 5-2-2 via 25-1-9-4(a)(3) (Bernard); AG/HIPAA consent judgment barring PHI in review replies (Westend) | HIPAA if covered; Westend judgment bars PHI in ads/social posts without authorization; IC 32-36 publicity statute not read | IC 32-36 (right of publicity) exists - not read | Common law (Walgreen v. Hinchy, respondeat superior); none under ICDPA | Medical Licensing Board, State Board of Dentistry (PLA), AG (licensing prosecutions; HIPAA under 1320d-5(d); DCSA) | ICDPA up to $7,500/violation; breach up to $150,000 per deceptive act; Westend $350,000 consent payment; Bernard $3,000 | E1 (Indiana AG v. Westend Dental 2025: review-reply PHI disclosures, consent judgment $350,000); E2 (Bernard 2023) | High | 2026-10-22 |
| Indiana (IN) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | IC 16-39 (records; 16-39-5-3 confidentiality in business use); 844 IAC 5-2-2 physician confidentiality (not read) | Yes - applies to licensed providers regardless of HIPAA status | ICDPA (IC 24-15), eff. 2026-01-01: ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50%; sensitive data needs consent | 24-4.9: medical info NOT covered; <=45 days; AG notice always; HIPAA compliance-plan exemption (partly read) | 844 IAC 5-2-2 via 25-1-9-4(a)(3) (Bernard); AG/HIPAA consent judgment barring PHI in review replies (Westend) | HIPAA if covered; Westend judgment bars PHI in ads/social posts without authorization; IC 32-36 publicity statute not read | IC 32-36 (right of publicity) exists - not read | Common law (Walgreen v. Hinchy, respondeat superior); none under ICDPA | Medical Licensing Board, State Board of Dentistry (PLA), AG (licensing prosecutions; HIPAA under 1320d-5(d); DCSA) | ICDPA up to $7,500/violation; breach up to $150,000 per deceptive act; Westend $350,000 consent payment; Bernard $3,000 | E1 (Indiana AG v. Westend Dental 2025: review-reply PHI disclosures, consent judgment $350,000); E2 (Bernard 2023) | High | 2026-10-22 |
| Indiana (IN) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | IC 16-39 (records; 16-39-5-3 confidentiality in business use); 844 IAC 5-2-2 physician confidentiality (not read) | Yes - applies to licensed providers regardless of HIPAA status | ICDPA (IC 24-15), eff. 2026-01-01: ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50%; sensitive data needs consent | 24-4.9: medical info NOT covered; <=45 days; AG notice always; HIPAA compliance-plan exemption (partly read) | 844 IAC 5-2-2 via 25-1-9-4(a)(3) (Bernard); AG/HIPAA consent judgment barring PHI in review replies (Westend) | HIPAA if covered; Westend judgment bars PHI in ads/social posts without authorization; IC 32-36 publicity statute not read | IC 32-36 (right of publicity) exists - not read | Common law (Walgreen v. Hinchy, respondeat superior); none under ICDPA | Medical Licensing Board, State Board of Dentistry (PLA), AG (licensing prosecutions; HIPAA under 1320d-5(d); DCSA) | ICDPA up to $7,500/violation; breach up to $150,000 per deceptive act; Westend $350,000 consent payment; Bernard $3,000 | E1 (Indiana AG v. Westend Dental 2025: review-reply PHI disclosures, consent judgment $350,000); E2 (Bernard 2023) | High | 2026-10-22 |
| Indiana (IN) | Medical med spa | Depends; cash-only med spas often not covered | IC 16-39 (records; 16-39-5-3 confidentiality in business use); 844 IAC 5-2-2 physician confidentiality (not read) | Yes - applies to licensed providers regardless of HIPAA status | ICDPA (IC 24-15), eff. 2026-01-01: ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50%; sensitive data needs consent | 24-4.9: medical info NOT covered; <=45 days; AG notice always; HIPAA compliance-plan exemption (partly read) | 844 IAC 5-2-2 via 25-1-9-4(a)(3) (Bernard); AG/HIPAA consent judgment barring PHI in review replies (Westend) | HIPAA if covered; Westend judgment bars PHI in ads/social posts without authorization; IC 32-36 publicity statute not read | IC 32-36 (right of publicity) exists - not read | Common law (Walgreen v. Hinchy, respondeat superior); none under ICDPA | Medical Licensing Board, State Board of Dentistry (PLA), AG (licensing prosecutions; HIPAA under 1320d-5(d); DCSA) | ICDPA up to $7,500/violation; breach up to $150,000 per deceptive act; Westend $350,000 consent payment; Bernard $3,000 | E1 (Indiana AG v. Westend Dental 2025: review-reply PHI disclosures, consent judgment $350,000); E2 (Bernard 2023) | High | 2026-10-22 |
| Indiana (IN) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | IC 16-39 (records; 16-39-5-3 confidentiality in business use); 844 IAC 5-2-2 physician confidentiality (not read) | No | ICDPA (IC 24-15), eff. 2026-01-01: ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50%; sensitive data needs consent | 24-4.9: medical info NOT covered; <=45 days; AG notice always; HIPAA compliance-plan exemption (partly read) | 844 IAC 5-2-2 via 25-1-9-4(a)(3) (Bernard); AG/HIPAA consent judgment barring PHI in review replies (Westend) | HIPAA if covered; Westend judgment bars PHI in ads/social posts without authorization; IC 32-36 publicity statute not read | IC 32-36 (right of publicity) exists - not read | Common law (Walgreen v. Hinchy, respondeat superior); none under ICDPA | Medical Licensing Board, State Board of Dentistry (PLA), AG (licensing prosecutions; HIPAA under 1320d-5(d); DCSA) | ICDPA up to $7,500/violation; breach up to $150,000 per deceptive act; Westend $350,000 consent payment; Bernard $3,000 | E1 (Indiana AG v. Westend Dental 2025: review-reply PHI disclosures, consent judgment $350,000); E2 (Bernard 2023) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
State of Indiana ex rel. Rokita v. Westend Dental LLC
U.S. District Court, S.D. Indiana (Indiana AG plaintiff) · IN (state AG; HIPAA via 42 U.S.C. 1320d-5(d)) · Complaint 2024-12-23; consent judgment 2025-01-02
- Provider type
- Dental group (seven offices)
- Relevant facts
- ALLEGED: Oct 2020 ransomware breach and late/misleading notice; HIPAA program failures; public replies to online patient reviews and Facebook posts disclosing PHI (including minors and x-rays) without authorization
- Legal issues
- HIPAA Privacy/Security/Breach rules; Indiana breach law IC 24-4.9; Deceptive Consumer Sales Act
- Holding, findings, allegations or settlement terms
- Consent judgment (no admission): bar on PHI in review replies, social media and ads without authorization; policies; security program; third-party assessments
- Consequences recorded
- $350,000 payment to the State (per proposed judgment para. 75; installments per secondary)
- Procedural status
- Final. Consent Judgment and Order signed by Judge Matthew P. Brookman 2025-01-02 (S.D. Ind. docket; V-013).
- Precedential?
- No
- Why it is in this research
- Direct: state AG enforcement treating review-reply PHI disclosure as a HIPAA and consumer-protection violation by a dental practice
Medical Licensing Board of Indiana: Caitlin Bernard, M.D.
Medical Licensing Board of Indiana · IN (state licensing) · Order signed 2023-07-27
- Provider type
- Physician (OB/GYN)
- Relevant facts
- Physician discussed a 10-year-old patient's case with a colleague and a newspaper reporter; Board found the details, taken together, could identify the patient
- Legal issues
- HIPAA; 844 IAC 5-2-2 via Ind. Code 25-1-9-4(a)(3); child-abuse reporting (not proven)
- Holding, findings, allegations or settlement terms
- Findings after contested hearing: confidentiality and HIPAA violations; reporting and fitness counts not proven
- Consequences recorded
- Letter of reprimand; $3,000 fine
- Procedural status
- Final. Neither party sought judicial review; matter reported closed Aug. 2023 (secondary news; V-020).
- Precedential?
- No
- Why it is in this research
- Board finding that a public account without names was still identifying
Walgreen Co. v. Hinchy
Indiana Court of Appeals · IN · 2014-11-14
- Provider type
- Pharmacy and pharmacist
- Relevant facts
- Pharmacist accessed a customer's prescription records for personal reasons and disclosed information to the customer's ex-boyfriend
- Legal issues
- Negligence/invasion of privacy; employer respondeat superior
- Holding, findings, allegations or settlement terms
- Judicial holding (per summaries): jury verdict affirmed; scope of employment a jury question
- Consequences recorded
- Jury damages affirmed (amount not verified here)
- Procedural status
- Final (per summaries; later history not verified)
- Precedential?
- Yes (intermediate appellate)
- Why it is in this research
- Employer liability for staff misuse of patient information (application inferred)
Related pages
Topics
Sources
IN-001. Ind. Code 24-15-1-1(a), (b)(3)-(4); 24-15-1-2; 24-15-2-28; 24-15-4-1(5)
Indiana Consumer Data Protection Act applies to persons controlling or processing personal data of 100,000 Indiana consumers, or 25,000 with over 50% of revenue from sales; it does NOT apply (ENTITY level) to HIPAA covered entities or business associates, nonprofits or higher education; PHI and related data are also exempt. Sensitive data includes 'a mental or physical health diagnosis made by a health care provider' and biometric data used to identify; processing sensitive data requires consent.
Statute · Explicit (text); effective date per secondary annotation · High (text) / Medium-High (date) · HIPAA-covered surgeons and dentists are outside the Act entirely; a non-HIPAA med spa above the thresholds is in scope (inference: most are below).
IN-002. Ind. Code 24-15-10-1 to -3
ICDPA enforcement: AG has exclusive authority; 30 days' written notice and opportunity to cure before suit; civil penalty up to $7,500 per violation, injunction and investigative costs.
Statute · Explicit · High · Maximum, not typical.
IN-003. Ind. Code 24-4.9-2-10; 24-4.9-3-1(c); 24-4.9-3-3(a); 24-4.9-4-2
Breach law: 'personal information' = unencrypted SSN, or name plus driver's license/state ID, credit card, or financial account with code; medical information is NOT covered. Notice without unreasonable delay and not more than 45 days after discovery; the AG must be notified whenever residents are; AG civil penalty up to $150,000 per deceptive act.
Statute · Explicit · High · A HIPAA-compliant data base owner is exempt from parts of the article if it follows its compliance plan (text partly read; scope not fully analyzed, U-64).
IN-006. State of Indiana ex rel. Rokita v. Westend Dental LLC, No. 1:24-cv-02255 (S.D. Ind.)
Indiana AG suit against a dental group ALLEGED, among other things, that public replies to online patient reviews on Google and Facebook posts disclosed patients' PHI (including minors and x-rays) without authorization, pleaded under HIPAA (42 U.S.C. 1320d-5(d)), the breach law and the Deceptive Consumer Sales Act. A consent judgment entered 2025-01-02 (no admission) bars disclosing PHI 'in response to online reviews' or in ads without patient authorization, requires social-media and review policies, and requires a $350,000 payment.
Enforcement (state AG; federal-court consent judgment) · Explicit (complaint and proposed judgment read; entered version not read) · High · Settlement, not a finding. Dental practice (cosmetic status not stated). State AG HIPAA enforcement against review replies; the payment also resolves breach claims.
https://storage.courtlistener.com/recap/gov.uscourts.insd.218861/gov.uscourts.insd.218861.1.0.pdf
IN-004. Ind. Code 16-39-5-3(c)-(d)
Health records: the provider owns the original record and may use it without specific written authorization for legitimate business purposes including claims, collection of accounts and litigation defense, but must at all times protect confidentiality and may disclose the patient's identity only when essential to that business use.
Statute · Explicit · High · 'Litigation defense' is not a review-response exception (inference); HIPAA controls for covered entities.
https://iga.in.gov/ic/2026/Title_16/Article_39/Chapter_5.pdf
IN-008. Walgreen Co. v. Hinchy, 21 N.E.3d 99 (Ind. Ct. App. 2014)
Indiana Court of Appeals affirmed a jury verdict against a pharmacy and its pharmacist for a pharmacist's personal-purpose access to and disclosure of a customer's prescription information (negligence and invasion of privacy), treating the employer's respondeat superior liability as a jury question.
Judicial decision · Explicit (per court case summary) · Medium · Med spa pass, final phase part 2 (2026-10-22). Holding taken from the Indiana courts' case summary and secondary summaries; opinion text not re-read. Pharmacy facts; application to practices inferred. Registered from cases.csv for Deliverable E.
https://caseclips.courts.in.gov/2014/11/20/walgreen-v-hinchy/
IN-007. Ind. Code 25-22.5-12.5-1 to -6
Medical spa registration statute (added 2026): a 'medical spa' is a facility or practice offering medical services, using prescription drugs by IV, IM or subcutaneous delivery, and holding itself out as cosmetic or lifestyle focused (weight loss, wellness, botulinum toxin and fillers, hormones, cosmetic laser or energy devices including hair removal); physician offices and otherwise state-licensed facilities are excluded. Registration is required from January 1, 2027 (fine up to $5,000 for unregistered operation); each spa must designate a responsible practitioner with prescriptive authority and relevant training who is physically present enough to ensure compliance and that every worker is licensed for and trained in their services; serious adverse events must be reported; the public database must redact personally identifying health information.
Statute · Explicit · High · Binding, but the registration duty is future-dated. Board implementing procedure (due 2026-10-01) not read (U-64).
IN-005. In re Caitlin Bernard, M.D., Cause No. 2022 MLB 0024
Medical Licensing Board final order: an OB/GYN's disclosures about a 10-year-old patient to a colleague and a newspaper reporter, taken together, contained identifying information; the Board found HIPAA violations and a violation of 844 IAC 5-2-2 (failing to maintain the confidentiality of all knowledge and information regarding the patient) under Ind. Code 25-1-9-4(a)(3); letter of reprimand and $3,000 fine ($1,000 per violation). Child-abuse reporting and fitness counts were not proven.
Enforcement (licensing; contested hearing, final order) · Explicit (order read from a media-hosted copy) · Medium-High · Not cosmetic and not online, but shows a board treating a de-identified-sounding public account as identifying. 844 IAC 5-2-2 text not read (U-64). Later appeal history not verified.
https://indianacapitalchronicle.com/wp-content/uploads/2023/07/01078719A202306275.pdf
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
V-013. V-013
This reference id is cited in the publication and is not a row in the claim register supplied with it.
V-020. V-020
This reference id is cited in the publication and is not a row in the claim register supplied with it.
CT-950. CT-950
This reference id is cited in the publication and is not a row in the claim register supplied with it.
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All