What a provider can and can't say in Kentucky
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 311.595(16) willful; 311.597(4) via AMA ethics; no board order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Partly: dental grounds not read | 311.595(16) willful; 311.597(4) via AMA ethics; no board order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 311.595(16) willful; 311.597(4) via AMA ethics; no board order located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 311.595(16) willful; 311.597(4) via AMA ethics; no board order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 311.595(16) willful; 311.597(4) via AMA ethics; no board order located |
- Consumer privacy and health data law: Kentucky has a consumer privacy law in force (KCDPA eff. 2026-01-01). It exempts HIPAA-covered practices as a whole (an entity-level exemption). [KY-001]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Persons subject to HIPAA are excluded. [KY-003]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules. [KY-002]
- Patient confidentiality duties: The licensing board can discipline willful breaches of patient confidentiality (311.595(16)). [KY-002]
- Lawsuits by individuals: No private right of action was located in the statutes reviewed; other claims, such as privacy torts, may still exist. [U-98]
- Research notes and gaps: Kentucky has a reported, limited likeness statute (KRS 391.170), but its text was not read in this research (a gap). [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (Procedure rules (binding esthetician statute) plus board opinion). [KY-004, KY-005]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [KY-002, U-97]
Sources:
- [KY-001] 2024 Ky. Acts ch. 72 (HB 15), secs. 1-12 Sec. 12 (effective 2026-01-01) (https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf)
- [KY-002] KRS 311.595(9), (16); 311.597(4) (https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=57426)
- [KY-003] KRS 365.732(1)(c), (2), (7), (8) (https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326)
- [KY-004] KRS 317A.130(2), as amended by 2025 Ky. Acts ch. 68 (SB 22) (https://apps.legislature.ky.gov/law/acts/25RS/documents/0068.pdf)
- [KY-005] KBML Board Opinion Relating to Laser Surgery Part IX (https://kbml.ky.gov/board/Documents/Board%20Opinion%20Laser%20Surgery.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Kentucky (KY) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | KRS 311.595(16) (willful violation of confidential communication); 311.597(4) AMA ethics | Yes - applies to licensed providers regardless of HIPAA status | KCDPA (KRS 367.3611), eff. 2026-01-01: ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50%; sensitive data needs consent | 365.732: medical info NOT covered; most expedient time; HIPAA-subject persons excluded | 311.595(16) willful; 311.597(4) via AMA ethics; no board order located | HIPAA if covered; 311.595(16)/(9); likeness law not read | KRS 391.170 (limited; not read) | None statutory located (common law not researched) | Board of Medical Licensure, Board of Dentistry, Board of Nursing, AG | KCDPA up to $7,500 per continued violation; license discipline (fine amounts not verified) | E4 | Medium-High | 2026-10-22 |
| Kentucky (KY) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | KRS 311.595(16) (willful violation of confidential communication); 311.597(4) AMA ethics | Partly: dental grounds not read | KCDPA (KRS 367.3611), eff. 2026-01-01: ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50%; sensitive data needs consent | 365.732: medical info NOT covered; most expedient time; HIPAA-subject persons excluded | 311.595(16) willful; 311.597(4) via AMA ethics; no board order located | HIPAA if covered; 311.595(16)/(9); likeness law not read | KRS 391.170 (limited; not read) | None statutory located (common law not researched) | Board of Medical Licensure, Board of Dentistry, Board of Nursing, AG | KCDPA up to $7,500 per continued violation; license discipline (fine amounts not verified) | E4 | Medium-High | 2026-10-22 |
| Kentucky (KY) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | KRS 311.595(16) (willful violation of confidential communication); 311.597(4) AMA ethics | Yes - applies to licensed providers regardless of HIPAA status | KCDPA (KRS 367.3611), eff. 2026-01-01: ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50%; sensitive data needs consent | 365.732: medical info NOT covered; most expedient time; HIPAA-subject persons excluded | 311.595(16) willful; 311.597(4) via AMA ethics; no board order located | HIPAA if covered; 311.595(16)/(9); likeness law not read | KRS 391.170 (limited; not read) | None statutory located (common law not researched) | Board of Medical Licensure, Board of Dentistry, Board of Nursing, AG | KCDPA up to $7,500 per continued violation; license discipline (fine amounts not verified) | E4 | Medium-High | 2026-10-22 |
| Kentucky (KY) | Medical med spa | Depends; cash-only med spas often not covered | KRS 311.595(16) (willful violation of confidential communication); 311.597(4) AMA ethics | Yes - applies to licensed providers regardless of HIPAA status | KCDPA (KRS 367.3611), eff. 2026-01-01: ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50%; sensitive data needs consent | 365.732: medical info NOT covered; most expedient time; HIPAA-subject persons excluded | 311.595(16) willful; 311.597(4) via AMA ethics; no board order located | HIPAA if covered; 311.595(16)/(9); likeness law not read | KRS 391.170 (limited; not read) | None statutory located (common law not researched) | Board of Medical Licensure, Board of Dentistry, Board of Nursing, AG | KCDPA up to $7,500 per continued violation; license discipline (fine amounts not verified) | E4 | Medium-High | 2026-10-22 |
| Kentucky (KY) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | KRS 311.595(16) (willful violation of confidential communication); 311.597(4) AMA ethics | No | KCDPA (KRS 367.3611), eff. 2026-01-01: ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50%; sensitive data needs consent | 365.732: medical info NOT covered; most expedient time; HIPAA-subject persons excluded | 311.595(16) willful; 311.597(4) via AMA ethics; no board order located | HIPAA if covered; 311.595(16)/(9); likeness law not read | KRS 391.170 (limited; not read) | None statutory located (common law not researched) | Board of Medical Licensure, Board of Dentistry, Board of Nursing, AG | KCDPA up to $7,500 per continued violation; license discipline (fine amounts not verified) | E4 | Medium-High | 2026-10-22 |
Related pages
Topics
Healthcare industry
Sources
KY-001. 2024 Ky. Acts ch. 72 (HB 15), secs. 1-12
Kentucky Consumer Data Protection Act, KRS 367.3611-367.3629, effective January 1, 2026. Applies at 100,000 consumers, or 25,000 with over 50% of gross revenue from selling personal data. Exempts at ENTITY level HIPAA covered entities and business associates; PHI and health records are exempt data. Sensitive data (mental or physical health diagnosis; biometric data used to identify) requires consent. AG exclusive enforcement with a 30-day cure; up to $7,500 per continued violation plus expenses; no private right of action.
Statute (session law) · Explicit · High · Amended by 2025 Ky. Acts ch. 13 (HB 473; HIPAA exemption retained) and 2026 Ky. Acts ch. 118 (HB 692; automatic content recognition data; effective 2027-07-01, signed 2026-04-13). Neither changes the health exemptions as read.
https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf
KY-003. KRS 365.732(1)(c), (2), (7), (8)
Breach law: 'personally identifiable information' = name plus SSN, driver's license, or financial account/card with code; medical information is NOT covered; notice in the most expedient time possible; consumer reporting agencies if more than 1,000; the section does not apply to persons subject to HIPAA.
Statute · Explicit · High · HIPAA practices excluded entirely.
https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326
KY-002. KRS 311.595(9), (16); 311.597(4)
Board of Medical Licensure may discipline a licensee who 'willfully violated a confidential communication', or engaged in dishonorable, unethical or unprofessional conduct likely to deceive, defraud or harm the public, which includes departures from the AMA or AOA codes of ethics.
Statute · Explicit · High · Willfulness required for (16); (9)/597(4) can reach other disclosures via AMA ethics (inference).
https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=57426
KY-004. KRS 317A.130(2), as amended by 2025 Ky. Acts ch. 68 (SB 22)
Esthetician statute (as amended 2025): no esthetician may perform Botox or collagen injections, laser treatments, electrolysis, tattoo, permanent makeup, microblading or piercing unless practicing under the immediate supervision of a licensed physician.
Statute (session law) · Explicit · High · 'Immediate supervision' definition (201 KAR 12:280, per search) not read.
https://apps.legislature.ky.gov/law/acts/25RS/documents/0068.pdf
KY-005. KBML Board Opinion Relating to Laser Surgery
KBML Board Opinion on laser surgery (issued under KRS 311.602): laser use is medicine; a physician may delegate certain procedures (e.g., laser hair removal) to certified or licensed non-physicians with documented training and must supervise. The opinion states it is not a statute or regulation and does not have the force of law.
Guidance (board opinion) · Explicit · High · Guidance, not binding; indicates how 311.595 will be applied.
https://kbml.ky.gov/board/Documents/Board%20Opinion%20Laser%20Surgery.pdf
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All