What a provider can and can't say in Maine
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 1711-C(2) bar on disclosure; 20144 (from 2027) unprofessional conduct; no board order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 1711-C(2) bar on disclosure; 20144 (from 2027) unprofessional conduct; no board order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 1711-C(2) bar on disclosure; 20144 (from 2027) unprofessional conduct; no board order located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 1711-C(2) bar on disclosure; 20144 (from 2027) unprofessional conduct; no board order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 1711-C(2) bar on disclosure; 20144 (from 2027) unprofessional conduct; no board order located |
- Consumer privacy and health data law: Maine has no comprehensive consumer privacy law in force as of October 22, 2026. Status of proposals: LD 1822 died 2026. Bills are not law. [ME-001]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: attorney general or the business's primary regulator. [ME-004]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (1711-C). [ME-002]
- Patient confidentiality duties: The state confidentiality law applies to licensed providers. [ME-002]
- Lawsuits by individuals: Patients may be able to sue in some situations (1711-C(13), intentional). [ME-003]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: there is med-spa-specific law (Joint Rule ch. 15 (IV therapy and med spa/aesthetic services); text not read (403)).† [ME-007]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2) (Board of Licensure in Medicine, Smith, 2013). Not finding enforcement does not mean none exists. [ME-006]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [ME-001] LD 1822 and LD 1224 (132nd Legislature) (https://legislature.maine.gov/)
- [ME-002] 22 M.R.S. 1711-C(1), (2), (3) (https://legislature.maine.gov/statutes/22/title22sec1711-C.html)
- [ME-003] 22 M.R.S. 1711-C(13) (https://legislature.maine.gov/statutes/22/title22sec1711-C.html)
- [ME-004] 10 M.R.S. 1347(6), 1348(1), (5), 1349(2), (4) (https://legislature.maine.gov/statutes/10/title10sec1348.html)
- [ME-006] In re Charles Smith, M.D. (Maine BOLIM) (https://www.maine.gov/tools/whatsnew/index.php?id=608389&topic=Portal+News&v=article-2008)
- [ME-007] Maine Joint Rule ch. 15 (https://www.maine.gov/boardofnursing/sites/boardofnursing/files/2026-07/Chapter-15-Joint-Rule.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Maine (ME) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | 22 M.R.S. 1711-C confidentiality of health care information (all licensed practitioners) | Yes - applies to licensed providers regardless of HIPAA status | None enacted (LD 1822 died 2026-04-13; LD 1224 ONTP 2025) | 10 M.R.S. 1346-1350-B: medical info NOT covered; 30 days; AG/regulator notice | 1711-C(2) bar on disclosure; 20144 (from 2027) unprofessional conduct; no board order located | HIPAA if covered; 1711-C authorization; likeness common law (not researched) | None statutory located (common law not researched) | Partly: 1711-C(13) individual action vs. intentional discloser (injunction, costs, penalty) | Board of Licensure in Medicine, Board of Osteopathic Licensure, Board of Dental Practice, Board of Nursing, AG | 1711-C up to $5,000/violation ($10,000 practitioners / $50,000 facilities if general practice) | E2 (BOLIM Smith 2013, records custody) | High | 2026-10-22 |
| Maine (ME) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | 22 M.R.S. 1711-C confidentiality of health care information (all licensed practitioners) | Yes - applies to licensed providers regardless of HIPAA status | None enacted (LD 1822 died 2026-04-13; LD 1224 ONTP 2025) | 10 M.R.S. 1346-1350-B: medical info NOT covered; 30 days; AG/regulator notice | 1711-C(2) bar on disclosure; 20144 (from 2027) unprofessional conduct; no board order located | HIPAA if covered; 1711-C authorization; likeness common law (not researched) | None statutory located (common law not researched) | Partly: 1711-C(13) individual action vs. intentional discloser (injunction, costs, penalty) | Board of Licensure in Medicine, Board of Osteopathic Licensure, Board of Dental Practice, Board of Nursing, AG | 1711-C up to $5,000/violation ($10,000 practitioners / $50,000 facilities if general practice) | E2 (BOLIM Smith 2013, records custody) | High | 2026-10-22 |
| Maine (ME) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | 22 M.R.S. 1711-C confidentiality of health care information (all licensed practitioners) | Yes - applies to licensed providers regardless of HIPAA status | None enacted (LD 1822 died 2026-04-13; LD 1224 ONTP 2025) | 10 M.R.S. 1346-1350-B: medical info NOT covered; 30 days; AG/regulator notice | 1711-C(2) bar on disclosure; 20144 (from 2027) unprofessional conduct; no board order located | HIPAA if covered; 1711-C authorization; likeness common law (not researched) | None statutory located (common law not researched) | Partly: 1711-C(13) individual action vs. intentional discloser (injunction, costs, penalty) | Board of Licensure in Medicine, Board of Osteopathic Licensure, Board of Dental Practice, Board of Nursing, AG | 1711-C up to $5,000/violation ($10,000 practitioners / $50,000 facilities if general practice) | E2 (BOLIM Smith 2013, records custody) | High | 2026-10-22 |
| Maine (ME) | Medical med spa | Depends; cash-only med spas often not covered | 22 M.R.S. 1711-C confidentiality of health care information (all licensed practitioners) | Yes - applies to licensed providers regardless of HIPAA status | None enacted (LD 1822 died 2026-04-13; LD 1224 ONTP 2025) | 10 M.R.S. 1346-1350-B: medical info NOT covered; 30 days; AG/regulator notice | 1711-C(2) bar on disclosure; 20144 (from 2027) unprofessional conduct; no board order located | HIPAA if covered; 1711-C authorization; likeness common law (not researched) | None statutory located (common law not researched) | Partly: 1711-C(13) individual action vs. intentional discloser (injunction, costs, penalty) | Board of Licensure in Medicine, Board of Osteopathic Licensure, Board of Dental Practice, Board of Nursing, AG | 1711-C up to $5,000/violation ($10,000 practitioners / $50,000 facilities if general practice) | E2 (BOLIM Smith 2013, records custody) | High | 2026-10-22 |
| Maine (ME) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | 22 M.R.S. 1711-C confidentiality of health care information (all licensed practitioners) | No | None enacted (LD 1822 died 2026-04-13; LD 1224 ONTP 2025) | 10 M.R.S. 1346-1350-B: medical info NOT covered; 30 days; AG/regulator notice | 1711-C(2) bar on disclosure; 20144 (from 2027) unprofessional conduct; no board order located | HIPAA if covered; 1711-C authorization; likeness common law (not researched) | None statutory located (common law not researched) | Partly: 1711-C(13) individual action vs. intentional discloser (injunction, costs, penalty) | Board of Licensure in Medicine, Board of Osteopathic Licensure, Board of Dental Practice, Board of Nursing, AG | 1711-C up to $5,000/violation ($10,000 practitioners / $50,000 facilities if general practice) | E2 (BOLIM Smith 2013, records custody) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Maine BOLIM: Charles Smith, M.D.
Maine Board of Licensure in Medicine · ME (state licensing) · 2013-11-12
- Provider type
- Physician
- Relevant facts
- Unpaid storage fees put a unit holding patient records at risk of repossession
- Legal issues
- Failure to safeguard confidentiality of patient records (ethical and legal obligations)
- Holding, findings, allegations or settlement terms
- Consent agreement (admission) per official press release
- Consequences recorded
- Reprimand; $1,000 fine
- Procedural status
- Final (agreement not read)
- Precedential?
- No
- Why it is in this research
- Records-custody confidentiality discipline (E2)
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
ME-001. LD 1822 and LD 1224 (132nd Legislature)
No comprehensive consumer privacy law: LD 1822 (Maine Online Data Privacy Act) died between houses on 2026-04-13 after the House failed enactment (70-79 roll call, 2026-04-09); LD 1224 received ought-not-to-pass (2025-06-17). Proposed bills are not law.
Legislative history · Per bill-status summaries · Medium · Official LawMakerWeb status page not re-read this session (U-85).
ME-004. 10 M.R.S. 1347(6), 1348(1), (5), 1349(2), (4)
Breach law: personal information = name plus SSN, driver's license/state ID, account/card number (with or without code where it permits access), account passwords or PINs; medical information NOT covered; notice within 30 days of becoming aware; notify the AG or the DPFR regulator; up to $500 per violation, max $2,500 per day; federal-rule deemed compliance.
Statute · Explicit · High · Maximum, not typical.
https://legislature.maine.gov/statutes/10/title10sec1348.html
ME-002. 22 M.R.S. 1711-C(1), (2), (3)
Health care information is confidential and may not be disclosed by a health care practitioner or facility except as the statute provides; written authorization must meet content requirements; 'health care practitioner' includes any person licensed by the state, or otherwise lawfully providing health care.
Statute · Explicit · High · Applies regardless of HIPAA status to licensed practitioners.
https://legislature.maine.gov/statutes/22/title22sec1711-C.html
ME-003. 22 M.R.S. 1711-C(13)
1711-C enforcement: AG may seek an injunction; an aggrieved individual may sue an intentional discloser for an injunction, costs and civil penalty; civil penalties up to $5,000 per violation, rising to $10,000 (practitioners) or $50,000 (facilities) for violations found to be a general business practice, payable to the State; common-law remedies preserved.
Statute · Explicit · High · Maximum, not typical.
https://legislature.maine.gov/statutes/22/title22sec1711-C.html
ME-007. Maine Joint Rule ch. 15
Med spa: a joint board rule, 'Chapter 15 Joint Rule' (IV therapy and medical spa/aesthetic services), is posted on the Maine Board of Nursing site (July 2026 file path); 32 M.R.S. 2594-A addresses physician delegation.
Regulation (joint board rule) · Existence explicit; content NOT read · Low · Med spa pass, final phase part 2 (2026-10-22). Official PDF returned 403 to curl and was unreadable via WebFetch; content, effective date and binding status must be confirmed before relying on it (V-059, U-99).
https://www.maine.gov/boardofnursing/sites/boardofnursing/files/2026-07/Chapter-15-Joint-Rule.pdf
ME-006. In re Charles Smith, M.D. (Maine BOLIM)
Board of Licensure in Medicine consent agreement (signed 2013-11-12): reprimand and $1,000 fine for failing to safeguard the confidentiality of patient medical records (unpaid storage unit facing repossession).
Enforcement (licensing; consent agreement per official press release) · Explicit (official release; agreement not read) · High · E2 (records custody, not public disclosure).
https://www.maine.gov/tools/whatsnew/index.php?id=608389&topic=Portal+News&v=article-2008
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All