What a provider can and can't say in Missouri
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | Brandt tort; 332.321.2(13) for dentists; 334.100.2(4) unprofessional conduct for physicians (inference) |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes via 332.321.2(13) (dentists) | Brandt tort; 332.321.2(13) for dentists; 334.100.2(4) unprofessional conduct for physicians (inference) |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | Brandt tort; 332.321.2(13) for dentists; 334.100.2(4) unprofessional conduct for physicians (inference) |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | Brandt tort; 332.321.2(13) for dentists; 334.100.2(4) unprofessional conduct for physicians (inference) |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | Brandt tort; 332.321.2(13) for dentists; 334.100.2(4) unprofessional conduct for physicians (inference) |
- Consumer privacy and health data law: Missouri has no comprehensive consumer privacy law in force as of October 22, 2026. [MO-005]
- Data breach notification: Its data breach notification law covers medical information. Enforcement rests with the attorney general. [MO-001]
- Patient confidentiality duties: Patient confidentiality duties come mainly from court-recognized privacy claims (Brandt) and dental ground. [MO-004, MO-002]
- Patient confidentiality duties: A board confidentiality ground was located for dentists only (332.321.2(13)). [MO-002]
- Lawsuits by individuals: Patients may be able to sue in some situations (Brandt). [MO-004]
- Research notes and gaps: Whether Missouri has a likeness statute was not researched (a gap). [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was located. [MO-003, MO-005]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [MO-002, U-97]
Sources:
- [MO-001] Mo. Rev. Stat. 407.1500.1(5), (6), (9); .2; .4 (https://revisor.mo.gov/main/OneSection.aspx?section=407.1500)
- [MO-002] Mo. Rev. Stat. 332.321.2(13)-(14) (https://revisor.mo.gov/main/OneSection.aspx?section=332.321)
- [MO-003] Mo. Rev. Stat. 334.100.2(4)(d), (4)(l), (4)(r), (5), (6) (https://revisor.mo.gov/main/OneSection.aspx?section=334.100)
- [MO-004] Brandt v. Medical Defense Associates, 856 S.W.2d 667 (Mo. 1993) (https://law.counselstack.com/opinion/brandt-v-medical-defense-associates-mo-1993)
- [MO-005] n/a (https://revisor.mo.gov/)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Missouri (MO) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | No general records-confidentiality statute located; dental 332.321.2(13) trust or confidence; Brandt fiduciary tort | Yes - applies to licensed providers regardless of HIPAA status | None in force | 407.1500: medical AND health-insurance info covered; without unreasonable delay; AG exclusive action, up to $150,000 | Brandt tort; 332.321.2(13) for dentists; 334.100.2(4) unprofessional conduct for physicians (inference) | HIPAA if covered; Brandt duty; likeness law not researched | None statutory located (common law not researched) | Yes: Brandt breach-of-confidentiality tort; none under breach law (AG only) | Board of Registration for the Healing Arts, Dental Board, Board of Nursing (Division of Professional Registration), AG | Breach: up to $150,000 per breach or series; license discipline | E4 | Medium-High | 2026-10-22 |
| Missouri (MO) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | No general records-confidentiality statute located; dental 332.321.2(13) trust or confidence; Brandt fiduciary tort | Yes via 332.321.2(13) (dentists) | None in force | 407.1500: medical AND health-insurance info covered; without unreasonable delay; AG exclusive action, up to $150,000 | Brandt tort; 332.321.2(13) for dentists; 334.100.2(4) unprofessional conduct for physicians (inference) | HIPAA if covered; Brandt duty; likeness law not researched | None statutory located (common law not researched) | Yes: Brandt breach-of-confidentiality tort; none under breach law (AG only) | Board of Registration for the Healing Arts, Dental Board, Board of Nursing (Division of Professional Registration), AG | Breach: up to $150,000 per breach or series; license discipline | E4 | Medium-High | 2026-10-22 |
| Missouri (MO) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | No general records-confidentiality statute located; dental 332.321.2(13) trust or confidence; Brandt fiduciary tort | Yes - applies to licensed providers regardless of HIPAA status | None in force | 407.1500: medical AND health-insurance info covered; without unreasonable delay; AG exclusive action, up to $150,000 | Brandt tort; 332.321.2(13) for dentists; 334.100.2(4) unprofessional conduct for physicians (inference) | HIPAA if covered; Brandt duty; likeness law not researched | None statutory located (common law not researched) | Yes: Brandt breach-of-confidentiality tort; none under breach law (AG only) | Board of Registration for the Healing Arts, Dental Board, Board of Nursing (Division of Professional Registration), AG | Breach: up to $150,000 per breach or series; license discipline | E4 | Medium-High | 2026-10-22 |
| Missouri (MO) | Medical med spa | Depends; cash-only med spas often not covered | No general records-confidentiality statute located; dental 332.321.2(13) trust or confidence; Brandt fiduciary tort | Yes - applies to licensed providers regardless of HIPAA status | None in force | 407.1500: medical AND health-insurance info covered; without unreasonable delay; AG exclusive action, up to $150,000 | Brandt tort; 332.321.2(13) for dentists; 334.100.2(4) unprofessional conduct for physicians (inference) | HIPAA if covered; Brandt duty; likeness law not researched | None statutory located (common law not researched) | Yes: Brandt breach-of-confidentiality tort; none under breach law (AG only) | Board of Registration for the Healing Arts, Dental Board, Board of Nursing (Division of Professional Registration), AG | Breach: up to $150,000 per breach or series; license discipline | E4 | Medium-High | 2026-10-22 |
| Missouri (MO) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No general records-confidentiality statute located; dental 332.321.2(13) trust or confidence; Brandt fiduciary tort | No | None in force | 407.1500: medical AND health-insurance info covered; without unreasonable delay; AG exclusive action, up to $150,000 | Brandt tort; 332.321.2(13) for dentists; 334.100.2(4) unprofessional conduct for physicians (inference) | HIPAA if covered; Brandt duty; likeness law not researched | None statutory located (common law not researched) | Yes: Brandt breach-of-confidentiality tort; none under breach law (AG only) | Board of Registration for the Healing Arts, Dental Board, Board of Nursing (Division of Professional Registration), AG | Breach: up to $150,000 per breach or series; license discipline | E4 | Medium-High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Brandt v. Medical Defense Associates
Supreme Court of Missouri · MO · 1993
- Provider type
- Physicians
- Relevant facts
- Physician had ex parte contacts with defense counsel about a patient who had sued
- Legal issues
- Fiduciary duty of confidentiality; waiver by placing condition in issue
- Holding, findings, allegations or settlement terms
- Judicial holding (per summaries): duty recognized and actionable; contacts within waiver, so no claim stated
- Consequences recorded
- None
- Procedural status
- Final
- Precedential?
- Yes (state supreme court)
- Why it is in this research
- Recognizes confidentiality tort; litigation waiver is narrow
Related pages
Topics
Healthcare industry
Sources
MO-005. n/a
Missouri has no med spa statute and no comprehensive consumer privacy law in force located (2026 privacy bills ended with the session).
Search result (negative) · Per search · Medium · Delegation governed by 334.100.2(4)(d) and APRN/PA collaborative-practice statutes (334.104, 334.735; not read).
MO-001. Mo. Rev. Stat. 407.1500.1(5), (6), (9); .2; .4
Breach law covers 'medical information' (any information on medical history, mental or physical condition, or treatment or diagnosis by a health care professional) and 'health insurance information' alongside SSN, ID and financial data. Notice without unreasonable delay; the AG has exclusive authority to sue for actual damages for willful and knowing violations and civil penalties up to $150,000 per breach or series.
Statute · Explicit · High · Unlike most batch-5 states, MO covers medical information. Notice duty is risk-based (identity theft or fraud likelihood, text not quoted). Maximum, not typical.
https://revisor.mo.gov/main/OneSection.aspx?section=407.1500
MO-004. Brandt v. Medical Defense Associates, 856 S.W.2d 667 (Mo. 1993)
Missouri Supreme Court recognized a physician's fiduciary duty of confidentiality, actionable in tort for unauthorized disclosure, waived for information placed in issue in litigation.
Judicial decision · Holding per secondary summaries (opinion not read) · Medium · Litigation waiver is not a review waiver (inference; no authority treats a public review as a waiver).
https://law.counselstack.com/opinion/brandt-v-medical-defense-associates-mo-1993
MO-002. Mo. Rev. Stat. 332.321.2(13)-(14)
Dentist discipline grounds include 'violation of any professional trust or confidence' and false, misleading or deceptive advertising.
Statute · Explicit · High · Kerwin v. Mo. Dental Bd. (2012) applied (13) to non-privacy facts (summary only).
MO-003. Mo. Rev. Stat. 334.100.2(4)(d), (4)(l), (4)(r), (5), (6)
Physician discipline grounds (334.100.2) list misconduct and unethical or unprofessional conduct, delegating to unqualified persons, failing to comply with laws relating to medical records, and false or misleading advertising; no explicit confidentiality ground was located in the text read.
Statute · Explicit (negative finding inferred from text read) · Medium-High · Confidentiality breaches would likely be charged as unprofessional conduct (inference).
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All