What a provider can and can't say in Maryland
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | MCMRA 4-302 (no reputation exception; 4-305 counsel/insurer only); 14-404(a)(3)(ii) unprofessional conduct |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | MCMRA 4-302 (no reputation exception; 4-305 counsel/insurer only); 14-404(a)(3)(ii) unprofessional conduct |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | MCMRA 4-302 (no reputation exception; 4-305 counsel/insurer only); 14-404(a)(3)(ii) unprofessional conduct |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | MCMRA 4-302 (no reputation exception; 4-305 counsel/insurer only); 14-404(a)(3)(ii) unprofessional conduct |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No (unless licensed under the Health Occupations Article) | MCMRA 4-302 (no reputation exception; 4-305 counsel/insurer only); 14-404(a)(3)(ii) unprofessional conduct |
- Consumer privacy and health data law: Maryland has a consumer privacy law in force (MODPA (strict necessity)). It exempts only HIPAA-protected health information (a data-level exemption), so a covered practice's other data, such as website or marketing data, can still fall under it. [MD-006, MD-007]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: the attorney general must be notified before individuals. [MD-005]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (MCMRA). [MD-001]
- Patient confidentiality duties: The state confidentiality law applies to licensed providers. [MD-001, MD-003]
- Lawsuits by individuals: Patients may be able to sue in some situations (4-309(f)). [MD-002]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (COMAR 10.32.09). [MD-004]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2) (Maryland Board of Physicians, Sedlak consent order). Not finding enforcement does not mean none exists. [MD-009]
Sources:
- [MD-001] Md. Code, Health-Gen. 4-301(g), (h), (k); 4-302(a) (https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg§ion=4-302)
- [MD-002] Md. Code, Health-Gen. 4-309(c)-(f) (https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg§ion=4-309)
- [MD-003] Md. Code, Health Occ. 14-404(a); 4-315 (https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gho§ion=14-404)
- [MD-004] COMAR 10.32.09.04A, .05A, .07 (https://regs.maryland.gov/us/md/exec/comar/10.32.09.05)
- [MD-005] Md. Code, Com. Law 14-3501; 14-3504; 14-3508 (https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3504)
- [MD-006] Md. Code, Com. Law 14-4702; 14-4703(b)(1), (b)(6)(ii) (https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4703)
- [MD-007] Md. Code, Com. Law 14-4701; 14-4707(a)(1)-(2); 14-4704 (https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4707)
- [MD-009] Md. Bd. of Physicians, In re Thomas Sedlak, M.D., Case No. 2226-0115A (https://www.mbp.state.md.us/BPQAPP/Orders/D006385906.186.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Maryland (MD) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Confidentiality of Medical Records Act, Health-Gen. 4-301 to 4-309 (all Health Occupations licensees) | Yes - applies to licensed providers regardless of HIPAA status | MODPA (Com. Law 14-4701+): DATA-level exemptions only; thresholds 35k / 10k+20%; sensitive data only if strictly necessary; no sale | 14-3504: health info, health insurance, biometric covered; 45 days; AG notice before individuals | MCMRA 4-302 (no reputation exception; 4-305 counsel/insurer only); 14-404(a)(3)(ii) unprofessional conduct | MCMRA authorization; MODPA strict-necessity limit if in scope; COMAR 10.32.09 records duty; HIPAA if covered | None statutory located (common law not researched) | Yes: MCMRA 4-309(f) actual damages; MODPA excludes 13-408 private action | Board of Physicians, Board of Dental Examiners, Board of Nursing, AG Consumer Protection Division | MCMRA criminal fines up to $50,000-$250,000 (willful disclosure tiers); MODPA via Title 13 (amount not verified) | E2 (MBP Sedlak consent order: records access by physician; conclusion cites prescribing); E4 for review cases | High | 2026-10-22 |
| Maryland (MD) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Confidentiality of Medical Records Act, Health-Gen. 4-301 to 4-309 (all Health Occupations licensees) | Yes - applies to licensed providers regardless of HIPAA status | MODPA (Com. Law 14-4701+): DATA-level exemptions only; thresholds 35k / 10k+20%; sensitive data only if strictly necessary; no sale | 14-3504: health info, health insurance, biometric covered; 45 days; AG notice before individuals | MCMRA 4-302 (no reputation exception; 4-305 counsel/insurer only); 14-404(a)(3)(ii) unprofessional conduct | MCMRA authorization; MODPA strict-necessity limit if in scope; COMAR 10.32.09 records duty; HIPAA if covered | None statutory located (common law not researched) | Yes: MCMRA 4-309(f) actual damages; MODPA excludes 13-408 private action | Board of Physicians, Board of Dental Examiners, Board of Nursing, AG Consumer Protection Division | MCMRA criminal fines up to $50,000-$250,000 (willful disclosure tiers); MODPA via Title 13 (amount not verified) | E2 (MBP Sedlak consent order: records access by physician; conclusion cites prescribing); E4 for review cases | High | 2026-10-22 |
| Maryland (MD) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Confidentiality of Medical Records Act, Health-Gen. 4-301 to 4-309 (all Health Occupations licensees) | Yes - applies to licensed providers regardless of HIPAA status | MODPA (Com. Law 14-4701+): DATA-level exemptions only; thresholds 35k / 10k+20%; sensitive data only if strictly necessary; no sale | 14-3504: health info, health insurance, biometric covered; 45 days; AG notice before individuals | MCMRA 4-302 (no reputation exception; 4-305 counsel/insurer only); 14-404(a)(3)(ii) unprofessional conduct | MCMRA authorization; MODPA strict-necessity limit if in scope; COMAR 10.32.09 records duty; HIPAA if covered | None statutory located (common law not researched) | Yes: MCMRA 4-309(f) actual damages; MODPA excludes 13-408 private action | Board of Physicians, Board of Dental Examiners, Board of Nursing, AG Consumer Protection Division | MCMRA criminal fines up to $50,000-$250,000 (willful disclosure tiers); MODPA via Title 13 (amount not verified) | E2 (MBP Sedlak consent order: records access by physician; conclusion cites prescribing); E4 for review cases | High | 2026-10-22 |
| Maryland (MD) | Medical med spa | Depends; cash-only med spas often not covered | Confidentiality of Medical Records Act, Health-Gen. 4-301 to 4-309 (all Health Occupations licensees) | Yes - applies to licensed providers regardless of HIPAA status | MODPA (Com. Law 14-4701+): DATA-level exemptions only; thresholds 35k / 10k+20%; sensitive data only if strictly necessary; no sale | 14-3504: health info, health insurance, biometric covered; 45 days; AG notice before individuals | MCMRA 4-302 (no reputation exception; 4-305 counsel/insurer only); 14-404(a)(3)(ii) unprofessional conduct | MCMRA authorization; MODPA strict-necessity limit if in scope; COMAR 10.32.09 records duty; HIPAA if covered | None statutory located (common law not researched) | Yes: MCMRA 4-309(f) actual damages; MODPA excludes 13-408 private action | Board of Physicians, Board of Dental Examiners, Board of Nursing, AG Consumer Protection Division | MCMRA criminal fines up to $50,000-$250,000 (willful disclosure tiers); MODPA via Title 13 (amount not verified) | E2 (MBP Sedlak consent order: records access by physician; conclusion cites prescribing); E4 for review cases | High | 2026-10-22 |
| Maryland (MD) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Confidentiality of Medical Records Act, Health-Gen. 4-301 to 4-309 (all Health Occupations licensees) | No (unless licensed under the Health Occupations Article) | MODPA (Com. Law 14-4701+): DATA-level exemptions only; thresholds 35k / 10k+20%; sensitive data only if strictly necessary; no sale | 14-3504: health info, health insurance, biometric covered; 45 days; AG notice before individuals | MCMRA 4-302 (no reputation exception; 4-305 counsel/insurer only); 14-404(a)(3)(ii) unprofessional conduct | MCMRA authorization; MODPA strict-necessity limit if in scope; COMAR 10.32.09 records duty; HIPAA if covered | None statutory located (common law not researched) | Yes: MCMRA 4-309(f) actual damages; MODPA excludes 13-408 private action | Board of Physicians, Board of Dental Examiners, Board of Nursing, AG Consumer Protection Division | MCMRA criminal fines up to $50,000-$250,000 (willful disclosure tiers); MODPA via Title 13 (amount not verified) | E2 (MBP Sedlak consent order: records access by physician; conclusion cites prescribing); E4 for review cases | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Maryland Board of Physicians: Thomas Sedlak, M.D.
Maryland State Board of Physicians (Panel A) · MD (state licensing) · Date not extracted (complaint 2025-08-07)
- Provider type
- Physician (hospital staff)
- Relevant facts
- Complaint that the physician accessed a family member's hospital records; investigation also found prescribing for the family member
- Legal issues
- Health Occ. 14-404(a)(3)(ii); order recites HIPAA provisions
- Holding, findings, allegations or settlement terms
- Consent-order findings; conclusion of law cites unprofessional conduct 'including but not limited to' prescribing
- Consequences recorded
- Reprimand
- Procedural status
- Final (consent order)
- Precedential?
- No
- Why it is in this research
- Maryland board treats improper record access in its findings; not a review or marketing case
Related pages
Topics
Healthcare industry
Sources
MD-006. Md. Code, Com. Law 14-4702; 14-4703(b)(1), (b)(6)(ii)
MODPA applies at 35,000 consumers (or 10,000 with 20%+ revenue from data sales); exemptions are DATA-level only (PHI; MCMRA records held by a CE/BA applying HIPAA standards); no entity-level covered-entity exemption.
Statute · Explicit · High · Non-PHI marketing data of a covered cosmetic practice can be in scope if thresholds are met (inference).
https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4703
MD-007. Md. Code, Com. Law 14-4701; 14-4707(a)(1)-(2); 14-4704
MODPA: 'consumer health data' and biometric data are sensitive data; a controller may collect or process sensitive data only where STRICTLY NECESSARY to provide or maintain a product or service the consumer requested, and may not sell sensitive data. Staff with access to consumer health data owe a confidentiality duty; geofencing within 1,750 feet of health facilities is banned.
Statute · Explicit · High · Consent does not cure processing beyond strict necessity. Using health data for ad targeting is likely barred (inference).
https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4707
MD-005. Md. Code, Com. Law 14-3501; 14-3504; 14-3508
Breach law 'personal information' includes health information (including mental health), health insurance numbers and biometric data; a misuse-likelihood investigation is required; notice within 45 days; the AG must be notified before individuals; a no-notice determination must be kept 3 years; violations are unfair or deceptive trade practices.
Statute · Explicit · High · HIPAA deemed-compliance provision (14-3507) not verified (U-55).
https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3504
MD-001. Md. Code, Health-Gen. 4-301(g), (h), (k); 4-302(a)
Confidentiality of Medical Records Act: a health care provider must keep the medical record confidential and disclose it only as the subtitle or other law allows. 'Provider' covers anyone licensed, certified or otherwise authorized under the Health Occupations Article, plus facilities and their agents and employees; 'health care' includes services affecting the structure or any function of the body; 'medical record' includes oral information entered in the record.
Statute · Explicit · High · Applies regardless of HIPAA status; cosmetic services fall within 'health care' (structure/function language). 4-305 permits disclosure to counsel or insurer for a claim; no general reputation exception.
https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg§ion=4-302
MD-003. Md. Code, Health Occ. 14-404(a); 4-315
Physician discipline: no explicit confidentiality ground in 14-404(a); relevant grounds are unprofessional conduct ((3)(ii)), advertising ((5)), and violating Board rules. Dentist grounds (4-315) contain no confidentiality text.
Statute · Explicit · High · Confidentiality breaches would be charged as unprofessional conduct or via MCMRA (inference).
https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gho§ion=14-404
MD-002. Md. Code, Health-Gen. 4-309(c)-(f)
MCMRA remedies: knowing and willful violation is a misdemeanor (fine up to $1,000 first offense, $5,000 later); knowing and willful disclosure up to $50,000 and 1 year (higher for false pretenses or commercial/malicious purpose); a provider who knowingly violates the subtitle is civilly liable for actual damages.
Statute · Explicit · High · Maximums, not typical. No reported MCMRA damages case against a cosmetic practice located.
https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg§ion=4-309
MD-004. COMAR 10.32.09.04A, .05A, .07
Cosmetic delegation (COMAR 10.32.09): a physician may delegate cosmetic medical procedures only to a PA, or assign them to another Health Occupations licensee whose board finds the procedure within scope; the physician must personally perform the initial assessment, write a treatment plan, obtain informed consent to treatment by a non-physician, supervise onsite (PA exception), and keep records under Health-General Title 4 and HIPAA.
Regulation · Explicit (via regs.maryland.gov search extract) · Medium-High · Official text read through search extract, not a direct page fetch (U-55). Binding med spa rule: unlicensed staff cannot perform cosmetic medical procedures.
MD-009. Md. Bd. of Physicians, In re Thomas Sedlak, M.D., Case No. 2226-0115A
Maryland Board of Physicians consent order (Case No. 2226-0115A): reprimand of a physician after a complaint that he accessed a family member's hospital records; the conclusion of law cites unprofessional conduct (Health Occ. 14-404(a)(3)(ii)).
Enforcement (licensing; consent order) · Explicit · Medium · Med spa pass, final phase part 2 (2026-10-22). Consent order; findings include prescribing for the family member, and the conclusion of law cites unprofessional conduct 'including but not limited to' prescribing. Not a review or marketing case. Registered from cases.csv.
https://www.mbp.state.md.us/BPQAPP/Orders/D006385906.186.pdf
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All