What a provider can and can't say in Louisiana
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 37:1285(A)(13) unprofessional conduct (inferred); no board order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 37:1285(A)(13) unprofessional conduct (inferred); no board order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 37:1285(A)(13) unprofessional conduct (inferred); no board order located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 37:1285(A)(13) unprofessional conduct (inferred); no board order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 37:1285(A)(13) unprofessional conduct (inferred); no board order located |
- Consumer privacy and health data law: Louisiana has enacted a consumer privacy law that is not yet in effect (LDPA (Act 502 of 2026), eff. 2027-01-01); it binds no one until its effective date. Once effective, it exempts HIPAA-covered practices as a whole (an entity-level exemption). [LA-001, LA-002]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: attorney general within 10 days. [LA-003]
- Patient confidentiality duties: Patient confidentiality duties appear to come mainly from the health care provider privilege (Code of Evidence article 510), which was not read in this research (a gap). [U-98]
- Research notes and gaps: A specific board confidentiality ground was not read or not located (none located in La. R.S. 37:1285); this is a research gap, not a finding that none exists. [U-98]
- Lawsuits by individuals: A limited right to sue may exist (breach actual damages). [LA-003]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (Toussaint Act). [LA-007]
- Med spa rules: Med spas: only agency guidance was found (Guidance (board statement) plus statute grounds); the binding rules are the general professional practice acts.† [LA-005, LA-006]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [LA-005, U-97]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [LA-001] La. SB 386 (2026), Act 502; R.S. 51:1780.1(29), 1780.2 Sec. 2 (effective 2027-01-01) (https://legis.la.gov/LEGIS/ViewDocument.aspx?d=1480202)
- [LA-002] R.S. 51:1780.5(A)-(D) (https://legis.la.gov/LEGIS/ViewDocument.aspx?d=1480202)
- [LA-003] La. R.S. 51:3073(4)(a); 51:3074; 51:3075 (https://www.legis.la.gov/legis/Law.aspx?d=322030)
- [LA-005] La. R.S. 37:1285(A)(13)-(14) (https://www.legis.la.gov/legis/Law.aspx?d=93167)
- [LA-006] LSBME Statement of Position, Use of Medical Lasers, Chemical Skin Treatments (https://www.jjclaw.com/wp-content/uploads/2026/03/LSBME-Opinion.pdf)
- [LA-007] La. R.S. 51:470.3 (https://www.legis.la.gov/Legis/Law.aspx?d=1295749)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Louisiana (LA) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | No general confidentiality ground located in 37:1285; La. Code Evid. art. 510 privilege (not read) | Yes - applies to licensed providers regardless of HIPAA status | LDPA (Act 502 of 2026): enacted, NOT yet effective (2027-01-01); ENTITY-level HIPAA CE/BA exemption; $25M OR 75k OR 50% revenue | 51:3071-3077: medical info NOT covered; <=60 days; AG within 10 days of resident notice (LAC 16:III.701); actual-damages action | 37:1285(A)(13) unprofessional conduct (inferred); no board order located | HIPAA if covered; Toussaint Act 51:470.3 identity right | Allen Toussaint Legacy Act, R.S. 51:470.1 et seq. (property right in identity) | Partly: 51:3075 actual damages for late breach notice; none under LDPA | LSBME, State Board of Dentistry, Board of Nursing, AG | AG breach-notice fine up to $5,000/day late; LUTPA remedies (amount not verified) | E4 | Medium-High | 2026-10-22 |
| Louisiana (LA) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | No general confidentiality ground located in 37:1285; La. Code Evid. art. 510 privilege (not read) | Yes - applies to licensed providers regardless of HIPAA status | LDPA (Act 502 of 2026): enacted, NOT yet effective (2027-01-01); ENTITY-level HIPAA CE/BA exemption; $25M OR 75k OR 50% revenue | 51:3071-3077: medical info NOT covered; <=60 days; AG within 10 days of resident notice (LAC 16:III.701); actual-damages action | 37:1285(A)(13) unprofessional conduct (inferred); no board order located | HIPAA if covered; Toussaint Act 51:470.3 identity right | Allen Toussaint Legacy Act, R.S. 51:470.1 et seq. (property right in identity) | Partly: 51:3075 actual damages for late breach notice; none under LDPA | LSBME, State Board of Dentistry, Board of Nursing, AG | AG breach-notice fine up to $5,000/day late; LUTPA remedies (amount not verified) | E4 | Medium-High | 2026-10-22 |
| Louisiana (LA) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | No general confidentiality ground located in 37:1285; La. Code Evid. art. 510 privilege (not read) | Yes - applies to licensed providers regardless of HIPAA status | LDPA (Act 502 of 2026): enacted, NOT yet effective (2027-01-01); ENTITY-level HIPAA CE/BA exemption; $25M OR 75k OR 50% revenue | 51:3071-3077: medical info NOT covered; <=60 days; AG within 10 days of resident notice (LAC 16:III.701); actual-damages action | 37:1285(A)(13) unprofessional conduct (inferred); no board order located | HIPAA if covered; Toussaint Act 51:470.3 identity right | Allen Toussaint Legacy Act, R.S. 51:470.1 et seq. (property right in identity) | Partly: 51:3075 actual damages for late breach notice; none under LDPA | LSBME, State Board of Dentistry, Board of Nursing, AG | AG breach-notice fine up to $5,000/day late; LUTPA remedies (amount not verified) | E4 | Medium-High | 2026-10-22 |
| Louisiana (LA) | Medical med spa | Depends; cash-only med spas often not covered | No general confidentiality ground located in 37:1285; La. Code Evid. art. 510 privilege (not read) | Yes - applies to licensed providers regardless of HIPAA status | LDPA (Act 502 of 2026): enacted, NOT yet effective (2027-01-01); ENTITY-level HIPAA CE/BA exemption; $25M OR 75k OR 50% revenue | 51:3071-3077: medical info NOT covered; <=60 days; AG within 10 days of resident notice (LAC 16:III.701); actual-damages action | 37:1285(A)(13) unprofessional conduct (inferred); no board order located | HIPAA if covered; Toussaint Act 51:470.3 identity right | Allen Toussaint Legacy Act, R.S. 51:470.1 et seq. (property right in identity) | Partly: 51:3075 actual damages for late breach notice; none under LDPA | LSBME, State Board of Dentistry, Board of Nursing, AG | AG breach-notice fine up to $5,000/day late; LUTPA remedies (amount not verified) | E4 | Medium-High | 2026-10-22 |
| Louisiana (LA) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No general confidentiality ground located in 37:1285; La. Code Evid. art. 510 privilege (not read) | No | LDPA (Act 502 of 2026): enacted, NOT yet effective (2027-01-01); ENTITY-level HIPAA CE/BA exemption; $25M OR 75k OR 50% revenue | 51:3071-3077: medical info NOT covered; <=60 days; AG within 10 days of resident notice (LAC 16:III.701); actual-damages action | 37:1285(A)(13) unprofessional conduct (inferred); no board order located | HIPAA if covered; Toussaint Act 51:470.3 identity right | Allen Toussaint Legacy Act, R.S. 51:470.1 et seq. (property right in identity) | Partly: 51:3075 actual damages for late breach notice; none under LDPA | LSBME, State Board of Dentistry, Board of Nursing, AG | AG breach-notice fine up to $5,000/day late; LUTPA remedies (amount not verified) | E4 | Medium-High | 2026-10-22 |
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
LA-001. La. SB 386 (2026), Act 502; R.S. 51:1780.1(29), 1780.2
Louisiana Data Privacy Act (SB 386, Act 502 of 2026), R.S. 51:1780.1-1780.5, signed 2026-05-29; enacted, NOT YET EFFECTIVE (effective January 1, 2027). Applies to businesses with gross revenue over $25 million, OR personal information of 75,000+ consumers, households or devices, OR 50%+ of revenue from selling personal information. Exempts at ENTITY level HIPAA covered entities and business associates governed by the HHS rules, and at DATA level PHI and health records. Sensitive data (including mental or physical health diagnosis) requires consent.
Statute (enrolled act) · Explicit · High · The $25M revenue trigger alone can sweep in mid-size non-HIPAA aesthetic chains (inference). Biometric definition excludes HIPAA TPO data.
LA-002. R.S. 51:1780.5(A)-(D)
LDPA enforcement: AG exclusive; a violation is an unfair and deceptive practice under LUTPA, excluding LUTPA private actions (51:1409, 1409.1); from January 1 to July 31, 2027 the AG must give 30 days' notice and may not proceed if the violation is cured with a written statement and documentation.
Statute (enrolled act) · Explicit · High · LUTPA civil penalty amount not verified here (U-75).
LA-003. La. R.S. 51:3073(4)(a); 51:3074; 51:3075
Breach law: personal information = name plus SSN, driver's license/state ID, financial account with code, passport number or biometric data; medical information NOT covered; notice not later than 60 days after discovery (written reasons to AG if delayed); no notice if no reasonable likelihood of harm (documentation kept 5 years); violation is an unfair act under LUTPA; a civil action lies to recover actual damages from failure to disclose timely.
Statute · Explicit · High · No HIPAA deemed-compliance provision located in 3074. Courts require actual damages (secondary).
LA-007. La. R.S. 51:470.3
Allen Toussaint Legacy Act: every individual has a property right in the commercial use of their identity, which survives death; transfers must be in writing.
Statute · Explicit · High · Remedies sections not read.
LA-005. La. R.S. 37:1285(A)(13)-(14)
LSBME grounds include unprofessional conduct (including improper delegation and failing to maintain independent medical judgment) and medical incompetency; fines and costs available. No explicit confidentiality item located in the text read.
Statute · Explicit (text) / inferred (application) · Medium-High · Confidentiality discipline would rely on (13) or LSBME rules (U-75).
LA-006. LSBME Statement of Position, Use of Medical Lasers, Chemical Skin Treatments
LSBME Statement of Position (revised 2001-11-13): medical lasers and chemical treatments affecting tissue below the stratum corneum are the practice of medicine; non-physicians may perform them only under a physician's direction and immediate personal supervision, meaning the physician is physically present on the premises and immediately available at all times.
Guidance (board statement of position) · Explicit (law-firm-hosted copy) · Medium · Guidance; official LSBME copy not retrieved (U-75).
https://www.jjclaw.com/wp-content/uploads/2026/03/LSBME-Opinion.pdf
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All