What a provider can and can't say in Montana
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 50-16-525 (no disclosure without written authorization); 50-16-553 private action; no review exception |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 50-16-525 (no disclosure without written authorization); 50-16-553 private action; no review exception |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 50-16-525 (no disclosure without written authorization); 50-16-553 private action; no review exception |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 50-16-525 (no disclosure without written authorization); 50-16-553 private action; no review exception |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Unresolved: only if a 'health care provider' (licensed/authorized to provide health care, 50-16-504(7)); estheticians uncertain | 50-16-525 (no disclosure without written authorization); 50-16-553 private action; no review exception |
- Consumer privacy and health data law: Montana has a consumer privacy law in force (MCDPA (25k)). It exempts HIPAA-covered practices as a whole (an entity-level exemption). [MT-004, MT-005]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: an electronic copy goes to the attorney general's consumer protection office at the same time as individual notice. [MT-006]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (UHCIA). [MT-001]
- Patient confidentiality duties: The state confidentiality law applies to licensed providers. [MT-001, MT-002]
- Lawsuits by individuals: Patients may be able to sue in some situations (50-16-553, -817). [MT-003]
- Photos, names and likeness: Only a limited likeness statute was located (30-14-1714). [MT-005, MT-007]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (ARM 24.156.401 delegation (secondary host) plus board FAQ (guidance)).† [MT-009]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [MT-001, U-97]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [MT-001] Mont. Code Ann. 50-16-505; 50-16-504(4), (7); 50-16-802 (https://mca.legmt.gov/bills/mca/title_0500/chapter_0160/part_0050/section_0050/0500-0160-0050-0050.html)
- [MT-002] Mont. Code Ann. 50-16-525(1); 50-16-526(3) (https://mca.legmt.gov/bills/mca/title_0500/chapter_0160/part_0050/section_0250/0500-0160-0050-0250.html)
- [MT-003] Mont. Code Ann. 50-16-553; 50-16-817 553(6)-(8); 817(4)-(6) (https://mca.legmt.gov/bills/mca/title_0500/chapter_0160/part_0050/section_0530/0500-0160-0050-0530.html)
- [MT-004] Mont. Code Ann. 30-14-2803(1); 30-14-2804(1)(g), (2)(a) (https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0040/0300-0140-0280-0040.html)
- [MT-005] Mont. Code Ann. 30-14-2802; 30-14-2812; 30-14-2817 2817(1), (5) (https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0170/0300-0140-0280-0170.html)
- [MT-006] Mont. Code Ann. 30-14-1704(1), (4)(a), (4)(b)(i)(D), (8) (https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html)
- [MT-007] Mont. Code Ann. 30-14-1714 (1), (3)(b), (4), (10)(b) (https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0140/0300-0140-0170-0140.html)
- [MT-009] ARM 24.156.401; Board of Barbers and Cosmetologists med spa FAQ (https://boards.bsd.dli.mt.gov/)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Montana (MT) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Uniform Health Care Information Act: Part 5 (non-HIPAA providers, 50-16-505/525) and Part 8 (HIPAA providers); written authorization (50-16-526) | Yes - applies to licensed providers regardless of HIPAA status | MCDPA (30-14-2801+): ENTITY-level HIPAA exemption; thresholds 25k / 15k+25%; sensitive data needs consent | 30-14-1704: medical record information covered; without unreasonable delay; simultaneous AG copy | 50-16-525 (no disclosure without written authorization); 50-16-553 private action; no review exception | 50-16-526 written authorization; MCDPA consent if not exempt; HIPAA if covered; 30-14-1714 for AI-generated likeness | 30-14-1714 (HB 513, 2025): digital voice/visual depictions only | Yes: 50-16-553 / 50-16-817 (pecuniary loss + up to $5,000 willful/gross); 30-14-1714 (damages + profits) | Board of Medical Examiners, Board of Dentistry, Board of Nursing, Board of Barbers & Cosmetologists, DOJ Office of Consumer Protection | UHCIA: up to $5,000 add-on per claimant; MCDPA via 30-14-142 (not verified) | E4 (no UHCIA damages case vs. cosmetic provider located) | High | 2026-10-22 |
| Montana (MT) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Uniform Health Care Information Act: Part 5 (non-HIPAA providers, 50-16-505/525) and Part 8 (HIPAA providers); written authorization (50-16-526) | Yes - applies to licensed providers regardless of HIPAA status | MCDPA (30-14-2801+): ENTITY-level HIPAA exemption; thresholds 25k / 15k+25%; sensitive data needs consent | 30-14-1704: medical record information covered; without unreasonable delay; simultaneous AG copy | 50-16-525 (no disclosure without written authorization); 50-16-553 private action; no review exception | 50-16-526 written authorization; MCDPA consent if not exempt; HIPAA if covered; 30-14-1714 for AI-generated likeness | 30-14-1714 (HB 513, 2025): digital voice/visual depictions only | Yes: 50-16-553 / 50-16-817 (pecuniary loss + up to $5,000 willful/gross); 30-14-1714 (damages + profits) | Board of Medical Examiners, Board of Dentistry, Board of Nursing, Board of Barbers & Cosmetologists, DOJ Office of Consumer Protection | UHCIA: up to $5,000 add-on per claimant; MCDPA via 30-14-142 (not verified) | E4 (no UHCIA damages case vs. cosmetic provider located) | High | 2026-10-22 |
| Montana (MT) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Uniform Health Care Information Act: Part 5 (non-HIPAA providers, 50-16-505/525) and Part 8 (HIPAA providers); written authorization (50-16-526) | Yes - applies to licensed providers regardless of HIPAA status | MCDPA (30-14-2801+): ENTITY-level HIPAA exemption; thresholds 25k / 15k+25%; sensitive data needs consent | 30-14-1704: medical record information covered; without unreasonable delay; simultaneous AG copy | 50-16-525 (no disclosure without written authorization); 50-16-553 private action; no review exception | 50-16-526 written authorization; MCDPA consent if not exempt; HIPAA if covered; 30-14-1714 for AI-generated likeness | 30-14-1714 (HB 513, 2025): digital voice/visual depictions only | Yes: 50-16-553 / 50-16-817 (pecuniary loss + up to $5,000 willful/gross); 30-14-1714 (damages + profits) | Board of Medical Examiners, Board of Dentistry, Board of Nursing, Board of Barbers & Cosmetologists, DOJ Office of Consumer Protection | UHCIA: up to $5,000 add-on per claimant; MCDPA via 30-14-142 (not verified) | E4 (no UHCIA damages case vs. cosmetic provider located) | High | 2026-10-22 |
| Montana (MT) | Medical med spa | Depends; cash-only med spas often not covered | Uniform Health Care Information Act: Part 5 (non-HIPAA providers, 50-16-505/525) and Part 8 (HIPAA providers); written authorization (50-16-526) | Yes - applies to licensed providers regardless of HIPAA status | MCDPA (30-14-2801+): ENTITY-level HIPAA exemption; thresholds 25k / 15k+25%; sensitive data needs consent | 30-14-1704: medical record information covered; without unreasonable delay; simultaneous AG copy | 50-16-525 (no disclosure without written authorization); 50-16-553 private action; no review exception | 50-16-526 written authorization; MCDPA consent if not exempt; HIPAA if covered; 30-14-1714 for AI-generated likeness | 30-14-1714 (HB 513, 2025): digital voice/visual depictions only | Yes: 50-16-553 / 50-16-817 (pecuniary loss + up to $5,000 willful/gross); 30-14-1714 (damages + profits) | Board of Medical Examiners, Board of Dentistry, Board of Nursing, Board of Barbers & Cosmetologists, DOJ Office of Consumer Protection | UHCIA: up to $5,000 add-on per claimant; MCDPA via 30-14-142 (not verified) | E4 (no UHCIA damages case vs. cosmetic provider located) | High | 2026-10-22 |
| Montana (MT) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Uniform Health Care Information Act: Part 5 (non-HIPAA providers, 50-16-505/525) and Part 8 (HIPAA providers); written authorization (50-16-526) | Unresolved: only if a 'health care provider' (licensed/authorized to provide health care, 50-16-504(7)); estheticians uncertain | MCDPA (30-14-2801+): ENTITY-level HIPAA exemption; thresholds 25k / 15k+25%; sensitive data needs consent | 30-14-1704: medical record information covered; without unreasonable delay; simultaneous AG copy | 50-16-525 (no disclosure without written authorization); 50-16-553 private action; no review exception | 50-16-526 written authorization; MCDPA consent if not exempt; HIPAA if covered; 30-14-1714 for AI-generated likeness | 30-14-1714 (HB 513, 2025): digital voice/visual depictions only | Yes: 50-16-553 / 50-16-817 (pecuniary loss + up to $5,000 willful/gross); 30-14-1714 (damages + profits) | Board of Medical Examiners, Board of Dentistry, Board of Nursing, Board of Barbers & Cosmetologists, DOJ Office of Consumer Protection | UHCIA: up to $5,000 add-on per claimant; MCDPA via 30-14-142 (not verified) | E4 (no UHCIA damages case vs. cosmetic provider located) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
State v. Nelson
Montana Supreme Court · MT · 1997-06-24
- Provider type
- Health care records (criminal investigation)
- Relevant facts
- State obtained medical records by investigative subpoena
- Legal issues
- Art. II, s.10 informational privacy; standard for subpoenas
- Holding, findings, allegations or settlement terms
- Holding (per secondary summaries): medical records protected; compelling interest shown by probable cause required
- Consequences recorded
- n/a
- Procedural status
- Final
- Precedential?
- Yes (Montana Supreme Court)
- Why it is in this research
- Montana treats medical information as constitutionally private (government context only)
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
MT-004. Mont. Code Ann. 30-14-2803(1); 30-14-2804(1)(g), (2)(a)
MCDPA (as amended by SB 297, Ch. 567, L. 2025, eff. 2025-10-01) applies at 25,000 consumers (15,000 if >25% revenue from sales); exempts HIPAA covered entities and business associates at the ENTITY level and PHI at the data level.
Statute · Explicit · High · Non-covered med spas and aesthetic businesses can be in scope at low volumes.
MT-005. Mont. Code Ann. 30-14-2802; 30-14-2812; 30-14-2817
MCDPA: sensitive data includes a mental or physical health condition or diagnosis; processing requires consent; biometric data excludes photographs. AG has exclusive enforcement; no private right of action; the current text contains no cure provision.
Statute · Explicit · High · Penalty amount under 30-14-142 not verified (U-45).
MT-006. Mont. Code Ann. 30-14-1704(1), (4)(a), (4)(b)(i)(D), (8)
Breach law covers 'medical record information' (as defined in 33-19-104) with a name; notice without unreasonable delay; simultaneous electronic copy to the AG's Office of Consumer Protection; breach requires actual or reasonably believed loss or injury.
Statute · Explicit · High · No fixed day count.
MT-001. Mont. Code Ann. 50-16-505; 50-16-504(4), (7); 50-16-802
Uniform Health Care Information Act (Part 5) applies ONLY to health care providers NOT subject to HIPAA privacy; Part 8 covers HIPAA-subject providers. 'Health care' includes services that 'affect the structure or any function of the human body'; 'health care provider' is anyone licensed, certified or otherwise authorized to provide health care.
Statute · Explicit · High · Fills the HIPAA gap for cash-only licensed cosmetic providers. Whether estheticians are 'health care providers' is unresolved (U-45).
MT-002. Mont. Code Ann. 50-16-525(1); 50-16-526(3)
A Part 5 provider, its assistants, agents and employees may not disclose health care information without the patient's written authorization (dated, signed, identifying the information and recipient), except as listed.
Statute · Explicit · High · No review-response exception located.
MT-003. Mont. Code Ann. 50-16-553; 50-16-817
Private action under both Parts 5 and 8: court may order compliance; damages for pecuniary loss plus up to $5,000 for willful or grossly negligent violations; attorney fees; 3-year limitation.
Statute · Explicit · High · Maximum add-on, not typical. No reported damages decision against a cosmetic provider located.
MT-007. Mont. Code Ann. 30-14-1714
HB 513 (2025) created a property right in name, voice and visual likeness; a person who intentionally publishes an unauthorized 'digital visual depiction' (computer-generated, highly realistic) for commercial use is liable for actual damages plus profits.
Statute · Explicit · Medium-High · Covers AI-generated or digitally fabricated likeness, not ordinary photos (inference). Relevant to AI 'simulated results' using real patients (U-46).
MT-009. ARM 24.156.401; Board of Barbers and Cosmetologists med spa FAQ
Med spa: no med-spa-specific statute; ARM 24.156.401 governs physician delegation to medical assistants, and the Board of Barbers and Cosmetologists' med spa FAQ (guidance) says injectables and tissue-altering procedures fall outside cosmetology licenses.
Regulation + agency guidance · Explicit (rule text on Justia, secondary) · Low · Med spa pass, final phase part 2 (2026-10-22). Rule text read on Justia (secondary); exact FAQ page URL not recorded (V-060, U-99).
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All