Pending bills to recheck
- MA conference bill (S.2619 / H.4746). As of Oct 22, 2026: S.2619 / H.4746 is in conference (appointed June 2026). It is not law.
What a provider can and can't say in Massachusetts
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | Common-law duty (Alberts) and 214 s.1B privacy statute; OCR NEDLC (MA) disposal case (not review) |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | Common-law duty (Alberts) and 214 s.1B privacy statute; OCR NEDLC (MA) disposal case (not review) |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | Common-law duty (Alberts) and 214 s.1B privacy statute; OCR NEDLC (MA) disposal case (not review) |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | Common-law duty (Alberts) and 214 s.1B privacy statute; OCR NEDLC (MA) disposal case (not review) |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | c.214 s.1B and s.3A apply to anyone; Alberts duty limited to physicians/providers | Common-law duty (Alberts) and 214 s.1B privacy statute; OCR NEDLC (MA) disposal case (not review) |
- Consumer privacy and health data law: Massachusetts has no comprehensive consumer privacy law in force as of October 22, 2026. Status of proposals: S.2619 / H.4746 conference (appointed June 2026). Bills are not law. [MA-007]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: attorney general and Office of Consumer Affairs and Business Regulation. [MA-005]
- Patient confidentiality duties: Patient confidentiality duties come mainly from court decisions (Alberts) and c.214 s.1B. [MA-004, MA-001]
- Research notes and gaps: A specific board confidentiality ground was not read or not located; this is a research gap, not a finding that none exists. [U-98]
- Lawsuits by individuals: Patients may be able to sue in some situations (s.1B; s.3A; Alberts). [MA-001, MA-004]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (c.214 s.3A). [MA-002]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (DPH clinic licensure 105 CMR 140.000 unless practitioner-owned plus DPH advisory (guidance)). [MA-009]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2) (Attorney General, Comstar). Not finding enforcement does not mean none exists. [MA-008]
- Research notes and gaps: Pending Massachusetts privacy legislation should be re-checked before relying on this summary; bills are not law. [U-96]
Sources:
- [MA-001] M.G.L. c.214, s.1B (https://malegislature.gov/Laws/GeneralLaws/PartIII/TitleI/Chapter214/Section1B)
- [MA-002] M.G.L. c.214, s.3A (https://malegislature.gov/Laws/GeneralLaws/PartIII/TitleI/Chapter214/Section3A)
- [MA-004] 395 Mass. 59, 479 N.E.2d 113 (1985) pinpoint not verified (https://www.courtlistener.com/opinion/2050692/alberts-v-devine/)
- [MA-005] M.G.L. c.93H, ss.1, 3 1; 3(a)-(b) (https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section3)
- [MA-007] S.2619 / H.5479 (194th General Court) (https://malegislature.gov/Bills/194/S2619)
- [MA-008] Suffolk Superior Court (filed 2026-01-28) (https://www.mass.gov/news/ag-campbell-secures-515000-settlement-with-ambulance-billing-vendor-for-failing-to-safeguard-sensitive-patient-medical-information)
- [MA-009] 105 CMR 140.000; DPH Medical Spa Services Advisory (https://www.mass.gov/advisory/medical-spa-services-advisory)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Massachusetts (MA) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Alberts v. Devine (common-law confidentiality); c.111 s.70E (licensed facilities); c.214 s.1B | Yes - applies to licensed providers regardless of HIPAA status | None enacted (MA Data Privacy Act in conference committee); 201 CMR 17.00 security for 'personal information' (excludes medical) | c.93H: medical info NOT covered; AG, OCABR and residents as soon as practicable | Common-law duty (Alberts) and 214 s.1B privacy statute; OCR NEDLC (MA) disposal case (not review) | c.214 s.3A written consent for advertising/trade; HIPAA if covered | c.214 s.3A (damages; treble if knowing) | Yes: 214 s.1B; 214 s.3A; Alberts tort; 93A s.9 consumer actions (not analyzed) | Board of Registration in Medicine, Board of Registration in Dentistry, Board of Nursing, DPH, AG | 93A s.4: up to $5,000 per violation; license discipline | E2 (MA AG Comstar consent judgment, medical data; OCR NEDLC dermatology, federal) | High | 2026-10-22 |
| Massachusetts (MA) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Alberts v. Devine (common-law confidentiality); c.111 s.70E (licensed facilities); c.214 s.1B | Yes - applies to licensed providers regardless of HIPAA status | None enacted (MA Data Privacy Act in conference committee); 201 CMR 17.00 security for 'personal information' (excludes medical) | c.93H: medical info NOT covered; AG, OCABR and residents as soon as practicable | Common-law duty (Alberts) and 214 s.1B privacy statute; OCR NEDLC (MA) disposal case (not review) | c.214 s.3A written consent for advertising/trade; HIPAA if covered | c.214 s.3A (damages; treble if knowing) | Yes: 214 s.1B; 214 s.3A; Alberts tort; 93A s.9 consumer actions (not analyzed) | Board of Registration in Medicine, Board of Registration in Dentistry, Board of Nursing, DPH, AG | 93A s.4: up to $5,000 per violation; license discipline | E2 (MA AG Comstar consent judgment, medical data; OCR NEDLC dermatology, federal) | High | 2026-10-22 |
| Massachusetts (MA) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Alberts v. Devine (common-law confidentiality); c.111 s.70E (licensed facilities); c.214 s.1B | Yes - applies to licensed providers regardless of HIPAA status | None enacted (MA Data Privacy Act in conference committee); 201 CMR 17.00 security for 'personal information' (excludes medical) | c.93H: medical info NOT covered; AG, OCABR and residents as soon as practicable | Common-law duty (Alberts) and 214 s.1B privacy statute; OCR NEDLC (MA) disposal case (not review) | c.214 s.3A written consent for advertising/trade; HIPAA if covered | c.214 s.3A (damages; treble if knowing) | Yes: 214 s.1B; 214 s.3A; Alberts tort; 93A s.9 consumer actions (not analyzed) | Board of Registration in Medicine, Board of Registration in Dentistry, Board of Nursing, DPH, AG | 93A s.4: up to $5,000 per violation; license discipline | E2 (MA AG Comstar consent judgment, medical data; OCR NEDLC dermatology, federal) | High | 2026-10-22 |
| Massachusetts (MA) | Medical med spa | Depends; cash-only med spas often not covered | Alberts v. Devine (common-law confidentiality); c.111 s.70E (licensed facilities); c.214 s.1B | Yes - applies to licensed providers regardless of HIPAA status | None enacted (MA Data Privacy Act in conference committee); 201 CMR 17.00 security for 'personal information' (excludes medical) | c.93H: medical info NOT covered; AG, OCABR and residents as soon as practicable | Common-law duty (Alberts) and 214 s.1B privacy statute; OCR NEDLC (MA) disposal case (not review) | c.214 s.3A written consent for advertising/trade; HIPAA if covered | c.214 s.3A (damages; treble if knowing) | Yes: 214 s.1B; 214 s.3A; Alberts tort; 93A s.9 consumer actions (not analyzed) | Board of Registration in Medicine, Board of Registration in Dentistry, Board of Nursing, DPH, AG | 93A s.4: up to $5,000 per violation; license discipline | E2 (MA AG Comstar consent judgment, medical data; OCR NEDLC dermatology, federal) | High | 2026-10-22 |
| Massachusetts (MA) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Alberts v. Devine (common-law confidentiality); c.111 s.70E (licensed facilities); c.214 s.1B | c.214 s.1B and s.3A apply to anyone; Alberts duty limited to physicians/providers | None enacted (MA Data Privacy Act in conference committee); 201 CMR 17.00 security for 'personal information' (excludes medical) | c.93H: medical info NOT covered; AG, OCABR and residents as soon as practicable | Common-law duty (Alberts) and 214 s.1B privacy statute; OCR NEDLC (MA) disposal case (not review) | c.214 s.3A written consent for advertising/trade; HIPAA if covered | c.214 s.3A (damages; treble if knowing) | Yes: 214 s.1B; 214 s.3A; Alberts tort; 93A s.9 consumer actions (not analyzed) | Board of Registration in Medicine, Board of Registration in Dentistry, Board of Nursing, DPH, AG | 93A s.4: up to $5,000 per violation; license discipline | E2 (MA AG Comstar consent judgment, medical data; OCR NEDLC dermatology, federal) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
New England Dermatology and Laser Center
HHS OCR · MA (federal action) · 2022-08-23
- Provider type
- Dermatology/laser
- Relevant facts
- Specimen containers with PHI labels discarded in parking-lot dumpster 2011-2021
- Legal issues
- Impermissible disclosure/safeguards (see OCR page; section list not re-verified)
- Holding, findings, allegations or settlement terms
- Settlement (no admission); admission of liability: No
- Consequences recorded
- $300,640; 2-year CAP
- Procedural status
- Closed: resolution agreement; CAP monitoring period (status not re-checked)
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Disposal/safeguards (NOT review response)
Alberts v. Devine
Massachusetts Supreme Judicial Court · MA · 1985-06-04
- Provider type
- Psychiatrist
- Relevant facts
- Physician disclosed patient information to patient's employer/clergy
- Legal issues
- Physician duty of confidentiality; third-party inducement liability
- Holding, findings, allegations or settlement terms
- Duty recognized; third party who induces breach may be liable (pinpoints unverified)
- Consequences recorded
- n/a
- Procedural status
- Final
- Precedential?
- Yes (SJC)
- Why it is in this research
- Tort exposure for unauthorized disclosures in MA
Related pages
Topics
Sources
MA-007. S.2619 / H.5479 (194th General Court)
No comprehensive Massachusetts consumer data privacy law is enacted: S.2619 (Senate, 2025-09-25) and H.5479 (House, 2026-06-04) were in conference committee as of the research date.
Legislative history · Explicit · High · Official bill history read 2026-10-22 (V-027): Senate 40-0 (2025-09-25); House amendment 146-0 (2026-06-04); conference committee appointed 2026-06-11 and 2026-06-17; no later action. Not law; date-sensitive.
MA-005. M.G.L. c.93H, ss.1, 3
Breach law 'personal information' is limited to name plus SSN, driver's license/state ID, or financial account/card number; medical information alone is not covered. Notice to AG, OCABR and residents as soon as practicable and without unreasonable delay.
Statute · Explicit · High · HIPAA breach rules still apply to covered practices.
https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section3
MA-004. 395 Mass. 59, 479 N.E.2d 113 (1985)
SJC recognized a physician's duty of confidentiality and liability of third parties who induce a breach (Alberts v. Devine).
Judicial decision · Explicit (case located) · Medium-High · Precedential.
https://www.courtlistener.com/opinion/2050692/alberts-v-devine/
MA-001. M.G.L. c.214, s.1B
Statutory right against unreasonable, substantial or serious interference with privacy, enforceable in Superior Court with damages.
Statute · Explicit · High · Applies to any person, including nonmedical businesses.
https://malegislature.gov/Laws/GeneralLaws/PartIII/TitleI/Chapter214/Section1B
MA-002. M.G.L. c.214, s.3A
Unauthorized use of name, portrait or picture for advertising or trade without written consent: injunction and damages; treble damages for knowing use.
Statute · Explicit · High
https://malegislature.gov/Laws/GeneralLaws/PartIII/TitleI/Chapter214/Section3A
MA-009. 105 CMR 140.000; DPH Medical Spa Services Advisory
Med spa: no med-spa-specific statute; DPH's Medical Spa Services Advisory (guidance) states that a med spa offering medical services generally needs DPH clinic licensure under 105 CMR 140.000 unless it is wholly owned by licensed practitioners; Board of Registration in Nursing Advisory Ruling 1301 and a Board of Cosmetology policy (amended 2025-12-23) address scope.
Regulation + agency guidance · Explicit (advisory); application of 105 CMR 140 to med spas per the advisory · Medium · Med spa pass, final phase part 2 (2026-10-22). AR 1301 read on a secondary host (V-058).
MA-008. Suffolk Superior Court (filed 2026-01-28)
MA AG (with CT AG) consent judgment with ambulance billing vendor Comstar: $515,000 total ($415,000 to MA) over a 2022 breach of medical and other data; alleged violations of 93A, 93H, 201 CMR 17.00 and HIPAA; no admission; awaiting court approval when announced.
Enforcement (state AG consent judgment) · Explicit · High · Business associate/vendor, not aesthetic practice. Court approval status not verified (U-37).
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-96. U-96 · Open
Date-sensitive items to re-check immediately before publication: NY S9269/A10357 (Governor action); PA HB 78 (Senate); MA S.2619/H.4746 conference; DC B26-0525; MI SB 359; Cancelmo trial (jury selection 2027-06-22); Comstar MA approval; Nebraska v. Change Healthcare; Ohio Formal Action Reports after Sept. 2026 (Bhalla); new OCR resolution agreements after 2026-10-09; CA CPPA threshold adjustments.
High priority · All