What a provider can and can't say in Kansas
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 65-2837(b)(6) (willful); 65-6825 for covered entities; no board order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Partly: dental grounds not read | 65-2837(b)(6) (willful); 65-6825 for covered entities; no board order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 65-2837(b)(6) (willful); 65-6825 for covered entities; no board order located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 65-2837(b)(6) (willful); 65-6825 for covered entities; no board order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 65-2837(b)(6) (willful); 65-6825 for covered entities; no board order located |
- Consumer privacy and health data law: Kansas has no comprehensive consumer privacy law in force as of October 22, 2026. [KS-001]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). No attorney general notice is required; entities that follow their federal regulator's procedures are deemed compliant. [KS-002]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules and 65-6825 (HIPAA rules as state law). [KS-003, KS-004]
- Patient confidentiality duties: The licensing board can discipline willful breaches of patient confidentiality (65-2837(b)(6)). [KS-003]
- Lawsuits by individuals: No private right of action was located in the statutes reviewed; other claims, such as privacy torts, may still exist. [U-98]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (Procedure rules (binding) plus FAQ guidance).† [KS-005, KS-006]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [KS-003, U-97]
- Research notes and gaps: The Kansas board rule text was not verified on an official source. [U-95]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [KS-001] n/a (https://kslegislature.gov/)
- [KS-002] K.S.A. 50-7a01(g); 50-7a02(a), (e), (f), (g) (https://ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html)
- [KS-003] K.S.A. 65-2837(b)(6) (https://kslegislature.gov/media/statute/065_000_0000_chapter/065_028_0000_article/065_028_0037_section/065_028_0037_k.pdf)
- [KS-004] K.S.A. 65-6825(a) (https://kslegislature.gov/media/statute/065_000_0000_chapter/065_068_0000_article/065_068_0025_section/065_068_0025_k.pdf)
- [KS-005] K.A.R. 100-27-1 (https://www.law.cornell.edu/regulations/kansas/K-A-R-100-27-1)
- [KS-006] KSBHA General Counsel FAQs, Medical Spas (https://www.ksbha.ks.gov/departments/general-counsel/general-counsel-faqs/medical-spas)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Kansas (KS) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | K.S.A. 65-2837(b)(6) willful betrayal of confidential information; 65-6825 HIPAA use/disclosure rules as state law (covered entities) | Yes - applies to licensed providers regardless of HIPAA status | None enacted (negative finding, secondary) | 50-7a01: medical info NOT covered; regulator deemed compliance; no AG notice | 65-2837(b)(6) (willful); 65-6825 for covered entities; no board order located | HIPAA if covered; 65-6825; likeness statute none located | None statutory located (common law not researched) | None statutory located | Board of Healing Arts, Dental Board, Board of Nursing, AG | License discipline (fine amounts not read) | E4 | Medium-High | 2026-10-22 |
| Kansas (KS) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | K.S.A. 65-2837(b)(6) willful betrayal of confidential information; 65-6825 HIPAA use/disclosure rules as state law (covered entities) | Partly: dental grounds not read | None enacted (negative finding, secondary) | 50-7a01: medical info NOT covered; regulator deemed compliance; no AG notice | 65-2837(b)(6) (willful); 65-6825 for covered entities; no board order located | HIPAA if covered; 65-6825; likeness statute none located | None statutory located (common law not researched) | None statutory located | Board of Healing Arts, Dental Board, Board of Nursing, AG | License discipline (fine amounts not read) | E4 | Medium-High | 2026-10-22 |
| Kansas (KS) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | K.S.A. 65-2837(b)(6) willful betrayal of confidential information; 65-6825 HIPAA use/disclosure rules as state law (covered entities) | Yes - applies to licensed providers regardless of HIPAA status | None enacted (negative finding, secondary) | 50-7a01: medical info NOT covered; regulator deemed compliance; no AG notice | 65-2837(b)(6) (willful); 65-6825 for covered entities; no board order located | HIPAA if covered; 65-6825; likeness statute none located | None statutory located (common law not researched) | None statutory located | Board of Healing Arts, Dental Board, Board of Nursing, AG | License discipline (fine amounts not read) | E4 | Medium-High | 2026-10-22 |
| Kansas (KS) | Medical med spa | Depends; cash-only med spas often not covered | K.S.A. 65-2837(b)(6) willful betrayal of confidential information; 65-6825 HIPAA use/disclosure rules as state law (covered entities) | Yes - applies to licensed providers regardless of HIPAA status | None enacted (negative finding, secondary) | 50-7a01: medical info NOT covered; regulator deemed compliance; no AG notice | 65-2837(b)(6) (willful); 65-6825 for covered entities; no board order located | HIPAA if covered; 65-6825; likeness statute none located | None statutory located (common law not researched) | None statutory located | Board of Healing Arts, Dental Board, Board of Nursing, AG | License discipline (fine amounts not read) | E4 | Medium-High | 2026-10-22 |
| Kansas (KS) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | K.S.A. 65-2837(b)(6) willful betrayal of confidential information; 65-6825 HIPAA use/disclosure rules as state law (covered entities) | No | None enacted (negative finding, secondary) | 50-7a01: medical info NOT covered; regulator deemed compliance; no AG notice | 65-2837(b)(6) (willful); 65-6825 for covered entities; no board order located | HIPAA if covered; 65-6825; likeness statute none located | None statutory located (common law not researched) | None statutory located | Board of Healing Arts, Dental Board, Board of Nursing, AG | License discipline (fine amounts not read) | E4 | Medium-High | 2026-10-22 |
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
KS-001. n/a
No comprehensive consumer data privacy law enacted in Kansas through the 2026 session (negative finding).
Search result (negative) · Per secondary trackers · Medium · Official bill-status search not run; ksrevisor.gov returned a bot check (not circumvented).
KS-002. K.S.A. 50-7a01(g); 50-7a02(a), (e), (f), (g)
Breach law: 'personal information' = name plus SSN, driver's license/state ID, or financial account/card number with code; medical information is NOT covered. Notice is triggered when misuse has occurred or is reasonably likely; consumer reporting agencies if more than 1,000; AG may bring an action. An entity that follows its primary or functional regulator's procedures is deemed compliant. No AG notice requirement located.
Statute · Explicit · Medium-High · ksrevisor.gov page blocked to curl; text read via fetch tool. Medical-information gap means a review reply disclosing health details is not a 'breach' under 50-7a01 (it can still be a HIPAA/board violation).
https://ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html
KS-003. K.S.A. 65-2837(b)(6)
Healing Arts Act: 'willful betrayal of confidential information' is unprofessional conduct and grounds for discipline of physicians (MD/DO/DC).
Statute · Explicit · High · 'Willful' element; no board order applying (b)(6) to a review reply was located (E4).
KS-004. K.S.A. 65-6825(a)
Health Information Technology Act: a covered entity may use or disclose protected health information only consistent with a HIPAA-compliant authorization (45 CFR 164.508) or as permitted or required by 45 CFR 164.502, .506, .508, .510 and .512, which makes the HIPAA Privacy Rule use/disclosure standards a matter of Kansas statute for covered entities.
Statute · Explicit · High · Applies to HIPAA covered entities only (definition ties to HIPAA); remedies for violation not read (U-80).
KS-005. K.A.R. 100-27-1
KSBHA light-based medical treatment rule: a physician may delegate light-based (laser/IPL) treatments only if the physician is 'immediately available' (same building or within 5 minutes) or has a signed written protocol meeting listed requirements, including informed consent, operating parameters, the physician's practice location, and chart review within 14 days; Class III/IV lasers and IPL require physical presence or immediate availability with a protocol.
Regulation · Explicit · Medium-High · Secondary host (LII); official Kansas Register copy not read.
https://www.law.cornell.edu/regulations/kansas/K-A-R-100-27-1
KS-006. KSBHA General Counsel FAQs, Medical Spas
KSBHA General Counsel FAQ on medical spas: only physicians (or physicians with specified licensed co-owners) may own a business offering medical services; corporate practice violations can be a felony (K.S.A. 65-2867); fee-splitting ground 65-2837(b)(19).
Guidance (board FAQ) · Explicit (guidance) · Medium · Guidance, not binding; ksbha.ks.gov blocked curl; read via fetch tool. Ownership limits matter for nonmedical aesthetic owners (inference).
https://www.ksbha.ks.gov/departments/general-counsel/general-counsel-faqs/medical-spas
R-100. R-100
This reference id is cited in the publication and is not a row in the claim register supplied with it.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All
U-95. U-95 · Open
Claims and cases that remain unverifiable from official sources (bot checks, outages or no public record): Ohio bill status (legislature.ohio.gov connection failed); Tausinga (no docket found); OSBMLS v. Larson final order; TN, AR, MS and GA code text (Justia hosts; tnsosfiles 403); KS-005 rule text (KSBHA 403); MS-004 rule; NM-001 (NMOneSource 403); WV rule 11-1A-12.1.f (LII host); Hawaii HRS text after 2017 (capitol.hawaii.gov Cloudflare, not circumvented); DC B26-0525 status; Aspen Dental final approval order; Cancelmo docket entries (PACERMonitor mirror); basis of the Amazon Ads SDK termination; case-law reproductions on secondary hosts.
High priority · All