What a provider can and can't say in Mississippi
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 13-1-21(3) civil liability (scope beyond testimony unresolved); no board order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - 13-1-21 lists dentists | 13-1-21(3) civil liability (scope beyond testimony unresolved); no board order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 13-1-21(3) civil liability (scope beyond testimony unresolved); no board order located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 13-1-21(3) civil liability (scope beyond testimony unresolved); no board order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 13-1-21(3) civil liability (scope beyond testimony unresolved); no board order located |
- Consumer privacy and health data law: Mississippi has no comprehensive consumer privacy law in force as of October 22, 2026. Status of proposals: 2026 bills not enacted (secondary). Bills are not law. [MS-005]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: attorney general; no private action.† [MS-003]
- Patient confidentiality duties: Patient confidentiality duties come mainly from the patient privilege statute (13-1-21) and board ground.† [MS-001, MS-002]
- Patient confidentiality duties: The licensing board can discipline willful breaches of patient confidentiality (civil liability, 13-1-21).† [MS-001]
- Lawsuits by individuals: Patients may be able to sue in some situations (the scope of this civil-liability provision is uncertain).† [MS-001]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures.† [MS-004]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists.† [MS-001, U-97]
- Research notes and gaps: The Mississippi board rule text was not verified on an official source. [U-95]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [MS-001] Miss. Code 13-1-21(1), (3) (https://law.justia.com/codes/mississippi/title-13/chapter-1/in-general/section-13-1-21/)
- [MS-002] Miss. Code 73-25-29(8)(d), (13); 73-25-30 (https://www.msbml.ms.gov/sites/default/files/2026%20Law%20Documents/Mississippi_Medical_Practice_Act.pdf)
- [MS-003] Miss. Code 75-24-29(2)(b), (3), (8) (https://law.justia.com/codes/mississippi/title-75/chapter-24/general-provisions/section-75-24-29/)
- [MS-004] 30 Miss. Admin. Code Pt. 2635, R. 3.1 (https://www.law.cornell.edu/regulations/mississippi/30-Miss-Code-R-SS-2635-3-1)
- [MS-005] n/a (https://billstatus.ls.state.ms.us/)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Mississippi (MS) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Miss. Code 13-1-21 privilege with civil liability for willful/reckless disclosure; 73-25-29(8)(d) unprofessional conduct | Yes - applies to licensed providers regardless of HIPAA status | None enacted (2026 bills not enacted per secondary tracker) | 75-24-29: medical info NOT covered; without unreasonable delay; AG (UTP); no private action | 13-1-21(3) civil liability (scope beyond testimony unresolved); no board order located | HIPAA if covered; 13-1-21; likeness law not researched | None statutory located (common law not researched) | Yes (statutory, uncertain scope): 13-1-21(3) damages for willful or reckless and wanton violations | Board of Medical Licensure, Board of Dental Examiners, Board of Nursing, AG | Board monetary penalty up to $10,000 (per compilation); misdemeanor under 13-1-21(3) | E4 | Medium | 2026-10-22 |
| Mississippi (MS) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Miss. Code 13-1-21 privilege with civil liability for willful/reckless disclosure; 73-25-29(8)(d) unprofessional conduct | Yes - 13-1-21 lists dentists | None enacted (2026 bills not enacted per secondary tracker) | 75-24-29: medical info NOT covered; without unreasonable delay; AG (UTP); no private action | 13-1-21(3) civil liability (scope beyond testimony unresolved); no board order located | HIPAA if covered; 13-1-21; likeness law not researched | None statutory located (common law not researched) | Yes (statutory, uncertain scope): 13-1-21(3) damages for willful or reckless and wanton violations | Board of Medical Licensure, Board of Dental Examiners, Board of Nursing, AG | Board monetary penalty up to $10,000 (per compilation); misdemeanor under 13-1-21(3) | E4 | Medium | 2026-10-22 |
| Mississippi (MS) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Miss. Code 13-1-21 privilege with civil liability for willful/reckless disclosure; 73-25-29(8)(d) unprofessional conduct | Yes - applies to licensed providers regardless of HIPAA status | None enacted (2026 bills not enacted per secondary tracker) | 75-24-29: medical info NOT covered; without unreasonable delay; AG (UTP); no private action | 13-1-21(3) civil liability (scope beyond testimony unresolved); no board order located | HIPAA if covered; 13-1-21; likeness law not researched | None statutory located (common law not researched) | Yes (statutory, uncertain scope): 13-1-21(3) damages for willful or reckless and wanton violations | Board of Medical Licensure, Board of Dental Examiners, Board of Nursing, AG | Board monetary penalty up to $10,000 (per compilation); misdemeanor under 13-1-21(3) | E4 | Medium | 2026-10-22 |
| Mississippi (MS) | Medical med spa | Depends; cash-only med spas often not covered | Miss. Code 13-1-21 privilege with civil liability for willful/reckless disclosure; 73-25-29(8)(d) unprofessional conduct | Yes - applies to licensed providers regardless of HIPAA status | None enacted (2026 bills not enacted per secondary tracker) | 75-24-29: medical info NOT covered; without unreasonable delay; AG (UTP); no private action | 13-1-21(3) civil liability (scope beyond testimony unresolved); no board order located | HIPAA if covered; 13-1-21; likeness law not researched | None statutory located (common law not researched) | Yes (statutory, uncertain scope): 13-1-21(3) damages for willful or reckless and wanton violations | Board of Medical Licensure, Board of Dental Examiners, Board of Nursing, AG | Board monetary penalty up to $10,000 (per compilation); misdemeanor under 13-1-21(3) | E4 | Medium | 2026-10-22 |
| Mississippi (MS) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Miss. Code 13-1-21 privilege with civil liability for willful/reckless disclosure; 73-25-29(8)(d) unprofessional conduct | No | None enacted (2026 bills not enacted per secondary tracker) | 75-24-29: medical info NOT covered; without unreasonable delay; AG (UTP); no private action | 13-1-21(3) civil liability (scope beyond testimony unresolved); no board order located | HIPAA if covered; 13-1-21; likeness law not researched | None statutory located (common law not researched) | Yes (statutory, uncertain scope): 13-1-21(3) damages for willful or reckless and wanton violations | Board of Medical Licensure, Board of Dental Examiners, Board of Nursing, AG | Board monetary penalty up to $10,000 (per compilation); misdemeanor under 13-1-21(3) | E4 | Medium | 2026-10-22 |
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
MS-005. n/a
No comprehensive consumer privacy law enacted; 2026 bills (e.g., SB 2015, HB 1051) per a secondary tracker were not enacted.
Search result (negative) · Per secondary tracker · Medium · Official bill status not re-checked.
MS-003. Miss. Code 75-24-29(2)(b), (3), (8)
Breach law: personal information = name plus SSN, driver's license/state or tribal ID, or financial account with code; medical information NOT covered; notice without unreasonable delay; no notice if no likely harm; AG enforces as an unfair trade practice; no private right of action.
Statute · Explicit · Medium-High · No AG notice requirement.
https://law.justia.com/codes/mississippi/title-75/chapter-24/general-provisions/section-75-24-29/
MS-001. Miss. Code 13-1-21(1), (3)
Privilege statute: communications to a physician, osteopath, dentist, hospital, nurse and others are privileged; willful violations are a misdemeanor, and the provider is civilly liable for damages for willful or reckless and wanton acts or omissions constituting a violation.
Statute · Explicit · Medium-High · Secondary host. Whether (3) reaches out-of-court disclosures (e.g., review replies) rather than testimony is unresolved (U-74).
https://law.justia.com/codes/mississippi/title-13/chapter-1/in-general/section-13-1-21/
MS-002. Miss. Code 73-25-29(8)(d), (13); 73-25-30
Board of Medical Licensure grounds include unprofessional conduct, including dishonorable or unethical conduct likely to deceive, defraud or harm the public, and violating Board rules; monetary penalties up to $10,000 (as read in the Board's compilation). No explicit confidentiality ground located in 73-25-29.
Statute · Explicit (text) / inferred (application) · High (text) · Confidentiality discipline would rely on (8)(d) or a rule (inference).
MS-004. 30 Miss. Admin. Code Pt. 2635, R. 3.1
Board rule: laser, pulsed light or similar devices, invasive or cosmetic, are the practice of medicine and limited to physicians and those directly supervised by physicians, with a physician on the premises who would be directly involved if required.
Regulation · Explicit · Medium-High · Secondary host (LII). Injectables delegation rules not read (U-74).
https://www.law.cornell.edu/regulations/mississippi/30-Miss-Code-R-SS-2635-3-1
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All
U-95. U-95 · Open
Claims and cases that remain unverifiable from official sources (bot checks, outages or no public record): Ohio bill status (legislature.ohio.gov connection failed); Tausinga (no docket found); OSBMLS v. Larson final order; TN, AR, MS and GA code text (Justia hosts; tnsosfiles 403); KS-005 rule text (KSBHA 403); MS-004 rule; NM-001 (NMOneSource 403); WV rule 11-1A-12.1.f (LII host); Hawaii HRS text after 2017 (capitol.hawaii.gov Cloudflare, not circumvented); DC B26-0525 status; Aspen Dental final approval order; Cancelmo docket entries (PACERMonitor mirror); basis of the Amazon Ads SDK termination; case-law reproductions on secondary hosts.
High priority · All