What a provider can and can't say in Iowa
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 147.55(3) + board rules; Iowa Dental Board Phan 2026 (review replies with patient info; settlement per media) |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 147.55(3) + board rules; Iowa Dental Board Phan 2026 (review replies with patient info; settlement per media) |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 147.55(3) + board rules; Iowa Dental Board Phan 2026 (review replies with patient info; settlement per media) |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 147.55(3) + board rules; Iowa Dental Board Phan 2026 (review replies with patient info; settlement per media) |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Partly: 653 IAC 13.6 reaches medical spas and laser technicians (licensing standards, not confidentiality) | 147.55(3) + board rules; Iowa Dental Board Phan 2026 (review replies with patient info; settlement per media) |
- Consumer privacy and health data law: Iowa has a consumer privacy law in force (ICDPA). It exempts HIPAA-covered practices as a whole (an entity-level exemption). [IA-001, IA-002]
- Data breach notification: Whether its breach law covers medical information was not confirmed in this research. Regulator notice: attorney general within 5 business days if more than 500 residents affected; HIPAA deemed compliant. [IA-003]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules (rules not read). [IA-004]
- Research notes and gaps: A specific board confidentiality ground was not read or not located; this is a research gap, not a finding that none exists. [U-98]
- Lawsuits by individuals: No private right of action was located in the statutes reviewed (None under ICDPA); other claims, such as privacy torts, may still exist. [IA-002, U-98]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: there is med-spa-specific law (Board of Medicine). [IA-005]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2) (provisional: the Dental Board's official action list names the case; the conduct details come from media reports only). Not finding enforcement does not mean none exists. [IA-006]
Sources:
- [IA-001] Iowa Code 715D.1(26); 715D.2(1)-(3) (https://www.legis.iowa.gov/docs/code/715D.2.pdf)
- [IA-002] Iowa Code 715D.8(2)-(4) (https://www.legis.iowa.gov/docs/code/715D.8.pdf)
- [IA-003] Iowa Code 715C.2(6), (7)(d), (8), (9) (https://www.legis.iowa.gov/docs/code/715C.2.pdf)
- [IA-004] Iowa Code 147.55(3), (6), (10) (https://www.legis.iowa.gov/docs/code/147.55.pdf)
- [IA-005] Iowa Admin. Code r. 653-13.6 (1)-(2) (https://www.legis.iowa.gov/docs/iac/rule/04-16-2025.653.13.6.pdf)
- [IA-006] Iowa Dental Board, In re Trung Phan, D.D.S., Case 2026-0013 (https://dial.iowa.gov/i-need/board-actions)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Iowa (IA) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | No general records-confidentiality statute located; 147.55 unethical conduct; board rules (not read) | Yes - applies to licensed providers regardless of HIPAA status | ICDPA (715D), eff. 2025-01-01: ENTITY-level exemption for persons subject to and complying with HIPAA; 100k / 25k+50% | 715C: AG within 5 business days if >500; HIPAA-compliant deemed compliant; financial-harm exception | 147.55(3) + board rules; Iowa Dental Board Phan 2026 (review replies with patient info; settlement per media) | HIPAA if covered; 653 IAC 13.6 informed-consent and records duties at med spas | None statutory located (common law not researched) | None located (ICDPA expressly none) | Board of Medicine, Dental Board, Board of Nursing, Board of Cosmetology Arts and Sciences (DIAL), AG | ICDPA up to $7,500/violation; Phan $1,000 civil penalty (per media); license discipline | E2 provisional (Iowa Dental Board, Phan 2026: official action list names the case; review-reply conduct per media only) | Medium-High | 2026-10-22 |
| Iowa (IA) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | No general records-confidentiality statute located; 147.55 unethical conduct; board rules (not read) | Yes - applies to licensed providers regardless of HIPAA status | ICDPA (715D), eff. 2025-01-01: ENTITY-level exemption for persons subject to and complying with HIPAA; 100k / 25k+50% | 715C: AG within 5 business days if >500; HIPAA-compliant deemed compliant; financial-harm exception | 147.55(3) + board rules; Iowa Dental Board Phan 2026 (review replies with patient info; settlement per media) | HIPAA if covered; 653 IAC 13.6 informed-consent and records duties at med spas | None statutory located (common law not researched) | None located (ICDPA expressly none) | Board of Medicine, Dental Board, Board of Nursing, Board of Cosmetology Arts and Sciences (DIAL), AG | ICDPA up to $7,500/violation; Phan $1,000 civil penalty (per media); license discipline | E2 provisional (Iowa Dental Board, Phan 2026: official action list names the case; review-reply conduct per media only) | Medium-High | 2026-10-22 |
| Iowa (IA) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | No general records-confidentiality statute located; 147.55 unethical conduct; board rules (not read) | Yes - applies to licensed providers regardless of HIPAA status | ICDPA (715D), eff. 2025-01-01: ENTITY-level exemption for persons subject to and complying with HIPAA; 100k / 25k+50% | 715C: AG within 5 business days if >500; HIPAA-compliant deemed compliant; financial-harm exception | 147.55(3) + board rules; Iowa Dental Board Phan 2026 (review replies with patient info; settlement per media) | HIPAA if covered; 653 IAC 13.6 informed-consent and records duties at med spas | None statutory located (common law not researched) | None located (ICDPA expressly none) | Board of Medicine, Dental Board, Board of Nursing, Board of Cosmetology Arts and Sciences (DIAL), AG | ICDPA up to $7,500/violation; Phan $1,000 civil penalty (per media); license discipline | E2 provisional (Iowa Dental Board, Phan 2026: official action list names the case; review-reply conduct per media only) | Medium-High | 2026-10-22 |
| Iowa (IA) | Medical med spa | Depends; cash-only med spas often not covered | No general records-confidentiality statute located; 147.55 unethical conduct; board rules (not read) | Yes - applies to licensed providers regardless of HIPAA status | ICDPA (715D), eff. 2025-01-01: ENTITY-level exemption for persons subject to and complying with HIPAA; 100k / 25k+50% | 715C: AG within 5 business days if >500; HIPAA-compliant deemed compliant; financial-harm exception | 147.55(3) + board rules; Iowa Dental Board Phan 2026 (review replies with patient info; settlement per media) | HIPAA if covered; 653 IAC 13.6 informed-consent and records duties at med spas | None statutory located (common law not researched) | None located (ICDPA expressly none) | Board of Medicine, Dental Board, Board of Nursing, Board of Cosmetology Arts and Sciences (DIAL), AG | ICDPA up to $7,500/violation; Phan $1,000 civil penalty (per media); license discipline | E2 provisional (Iowa Dental Board, Phan 2026: official action list names the case; review-reply conduct per media only) | Medium-High | 2026-10-22 |
| Iowa (IA) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No general records-confidentiality statute located; 147.55 unethical conduct; board rules (not read) | Partly: 653 IAC 13.6 reaches medical spas and laser technicians (licensing standards, not confidentiality) | ICDPA (715D), eff. 2025-01-01: ENTITY-level exemption for persons subject to and complying with HIPAA; 100k / 25k+50% | 715C: AG within 5 business days if >500; HIPAA-compliant deemed compliant; financial-harm exception | 147.55(3) + board rules; Iowa Dental Board Phan 2026 (review replies with patient info; settlement per media) | HIPAA if covered; 653 IAC 13.6 informed-consent and records duties at med spas | None statutory located (common law not researched) | None located (ICDPA expressly none) | Board of Medicine, Dental Board, Board of Nursing, Board of Cosmetology Arts and Sciences (DIAL), AG | ICDPA up to $7,500/violation; Phan $1,000 civil penalty (per media); license discipline | E2 provisional (Iowa Dental Board, Phan 2026: official action list names the case; review-reply conduct per media only) | Medium-High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Iowa Dental Board: Trung Phan, D.D.S.
Iowa Dental Board (DIAL) · IA (state licensing) · 2026-08-19
- Provider type
- Dentist
- Relevant facts
- ALLEGED (per media): posted unprofessional responses to negative online reviews that included patient information
- Legal issues
- Unprofessional conduct; failure to preserve confidentiality of patient information (rule cites not verified)
- Holding, findings, allegations or settlement terms
- Charges (allegations) resolved by settlement (per media)
- Consequences recorded
- Warning; ethics program; $1,000 civil penalty (per media)
- Procedural status
- Final (settlement per media); order not read
- Precedential?
- No
- Why it is in this research
- Direct: dental board action over review replies containing patient information
Related pages
Topics
Healthcare industry
Sources
IA-001. Iowa Code 715D.1(26); 715D.2(1)-(3)
Iowa Consumer Data Protection Act applies at 100,000 consumers, or 25,000 with over 50% of revenue from sales; it does not apply (ENTITY level) to persons who are subject to and comply with HIPAA/HITECH regulations, nonprofits or higher education; PHI and 'health records' are exempt data. Sensitive data includes mental or physical health diagnosis and biometric data used to identify.
Statute · Explicit (text) · High (text) / Medium-High (date) · 'Subject to and comply with' wording: a noncompliant covered entity's exemption is uncertain (inference).
IA-002. Iowa Code 715D.8(2)-(4)
ICDPA enforcement: AG exclusive; 90 days' written notice and opportunity to cure; civil penalty up to $7,500 per violation; no private right of action under this chapter or any other law.
Statute · Explicit · High · Maximum, not typical.
IA-003. Iowa Code 715C.2(6), (7)(d), (8), (9)
Breach law: notice to the AG consumer protection division within 5 business days after notifying consumers when more than 500 residents are notified; persons subject to and complying with HIPAA/HITECH are deemed compliant; no notice if, after investigation, there is no reasonable likelihood of financial harm (documented and kept 5 years); violations are unlawful practices under 714.16.
Statute · Explicit · High · PI definition (715C.1(11)) read in part; medical information not seen among listed elements (U-67).
IA-004. Iowa Code 147.55(3), (6), (10)
Grounds for all licensed health professions include unethical conduct or practice harmful or detrimental to the public, untruthful advertising, and other acts specified by board rule; no explicit confidentiality item in the statute.
Statute · Explicit · High · Board confidentiality rules (medicine, dentistry) not read (U-67).
IA-005. Iowa Admin. Code r. 653-13.6
Board of Medicine medical spa rule: a 'medical spa' (excluding wholly physician-owned dermatology practices with an owner practicing at each site) may have 'medical aesthetic services' (injectables, botulinum toxin, fillers, microneedling, cryolipolysis, nonsuperficial laser/IPL/RF/ultrasound, tattoo removal; hair removal excluded) performed by nonphysicians only if delegated by a physician medical director, who must give documented in-person on-site supervision at least 4 hours a week, review services weekly and at least 10% of charts, stay within 60 miles, ensure records and informed consent, and verify training; a 'qualified laser technician' needs 120 hours of accredited training and may only use lasers.
Regulation · Explicit · High · Binding med spa rule; the most detailed located so far.
https://www.legis.iowa.gov/docs/iac/rule/04-16-2025.653.13.6.pdf
IA-006. Iowa Dental Board, In re Trung Phan, D.D.S., Case 2026-0013
Iowa Dental Board action list (2026-08-19) names a dentist in Case 2026-0013; media report that the Board charged unprofessional conduct and failure to preserve the confidentiality of patient information, ALLEGING he 'posted unprofessional responses to negative online reviews of him and included patient information', and that he settled with a warning, an ethics program and a $1,000 civil penalty.
Enforcement (licensing; charges and settlement) · Official listing (name/case only) + secondary media for content · Medium · Charges are allegations; settlement terms per Iowa Capital Dispatch. Order in the Board's AMANDA portal not read (U-67). Dentist; cosmetic status not stated. [Audit D 2026-10-22: evidence label lowered from E1 provisional to E2 provisional; conduct details come from media]
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All