What a provider can and can't say in Nebraska
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 38-179(8) knowingly; no board order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 38-179(8) knowingly; no board order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 38-179(8) knowingly; no board order located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 38-179(8) knowingly; no board order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Partly: 38-179(8) may reach UCA-licensed estheticians (inference); NDPA if not an SBA small business | 38-179(8) knowingly; no board order located |
- Consumer privacy and health data law: Nebraska has a consumer privacy law in force (NDPA (no volume threshold)). It exempts HIPAA-covered practices as a whole (an entity-level exemption). [NE-001, NE-002]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: attorney general, no later than notice to residents. [NE-003]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules (all credential holders). [NE-004]
- Patient confidentiality duties: The licensing board can discipline knowing disclosures of confidential information (38-179(8)). [NE-004]
- Lawsuits by individuals: Patients may be able to sue in some situations (20-202). [NE-006]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (20-202). [NE-006]
- Med spa rules: Med spas: only agency guidance was found (nursing advisory); the binding rules are the general professional practice acts. [NE-005]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2) (Attorney General v. Change Healthcare: allegations only; a motion to dismiss was overruled on 2025-11-10; pending). Not finding enforcement does not mean none exists. [NE-007]
Sources:
- [NE-001] Neb. Rev. Stat. 87-1102, 87-1103(2), 87-1104, 87-1107, 87-1118 (https://nebraskalegislature.gov/laws/display_html.php?begin_section=87-1101&end_section=87-1130)
- [NE-002] Neb. Rev. Stat. 87-1122, 87-1124, 87-1125 (https://nebraskalegislature.gov/laws/display_html.php?begin_section=87-1101&end_section=87-1130)
- [NE-003] Neb. Rev. Stat. 87-802(5), 87-803(1)-(2), 87-804(2), 87-806, 87-808(3)(b) (https://nebraskalegislature.gov/laws/display_html.php?begin_section=87-801&end_section=87-808)
- [NE-004] Neb. Rev. Stat. 38-179(8) (https://nebraskalegislature.gov/laws/statutes.php?statute=38-179)
- [NE-005] Nebraska Board of Nursing, Advisory Opinion: Cosmetic and Dermatologic Procedures (https://dhhs.ne.gov/licensure/Documents/CosmAndDerm.pdf)
- [NE-006] Neb. Rev. Stat. 20-202, 20-208, 20-211 (https://nebraskalegislature.gov/laws/display_html.php?begin_section=20-201&end_section=20-211)
- [NE-007] State ex rel. Hilgers v. Change Healthcare Inc. et al. (https://ago.nebraska.gov/news/attorney-general-mike-hilgers-files-lawsuit-against-change-healthcare-critical-failures)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Nebraska (NE) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Neb. Rev. Stat. 38-179(8) knowingly disclosing confidential information (all UCA credential holders) | Yes - applies to licensed providers regardless of HIPAA status | NDPA (87-1101), eff. 2025-01-01: ENTITY-level HIPAA CE/BA exemption; no volume threshold (SBA small-business carve-out) | 87-801: medical info NOT covered; AG notice no later than residents; HIPAA satisfies security duty | 38-179(8) knowingly; no board order located | HIPAA if covered; 20-202 commercial exploitation | Neb. Rev. Stat. 20-202 (exploitation for advertising; 1-year limitation) | Yes: 20-202 invasion-of-privacy action; none under NDPA or breach law | DHHS Licensure Unit / Board of Medicine and Surgery, Board of Dentistry, Board of Nursing, AG | NDPA up to $7,500/violation (30-day cure) | E2 (AG v. Change Healthcare, allegations; MTD overruled 2025) | Medium-High | 2026-10-22 |
| Nebraska (NE) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Neb. Rev. Stat. 38-179(8) knowingly disclosing confidential information (all UCA credential holders) | Yes - applies to licensed providers regardless of HIPAA status | NDPA (87-1101), eff. 2025-01-01: ENTITY-level HIPAA CE/BA exemption; no volume threshold (SBA small-business carve-out) | 87-801: medical info NOT covered; AG notice no later than residents; HIPAA satisfies security duty | 38-179(8) knowingly; no board order located | HIPAA if covered; 20-202 commercial exploitation | Neb. Rev. Stat. 20-202 (exploitation for advertising; 1-year limitation) | Yes: 20-202 invasion-of-privacy action; none under NDPA or breach law | DHHS Licensure Unit / Board of Medicine and Surgery, Board of Dentistry, Board of Nursing, AG | NDPA up to $7,500/violation (30-day cure) | E2 (AG v. Change Healthcare, allegations; MTD overruled 2025) | Medium-High | 2026-10-22 |
| Nebraska (NE) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Neb. Rev. Stat. 38-179(8) knowingly disclosing confidential information (all UCA credential holders) | Yes - applies to licensed providers regardless of HIPAA status | NDPA (87-1101), eff. 2025-01-01: ENTITY-level HIPAA CE/BA exemption; no volume threshold (SBA small-business carve-out) | 87-801: medical info NOT covered; AG notice no later than residents; HIPAA satisfies security duty | 38-179(8) knowingly; no board order located | HIPAA if covered; 20-202 commercial exploitation | Neb. Rev. Stat. 20-202 (exploitation for advertising; 1-year limitation) | Yes: 20-202 invasion-of-privacy action; none under NDPA or breach law | DHHS Licensure Unit / Board of Medicine and Surgery, Board of Dentistry, Board of Nursing, AG | NDPA up to $7,500/violation (30-day cure) | E2 (AG v. Change Healthcare, allegations; MTD overruled 2025) | Medium-High | 2026-10-22 |
| Nebraska (NE) | Medical med spa | Depends; cash-only med spas often not covered | Neb. Rev. Stat. 38-179(8) knowingly disclosing confidential information (all UCA credential holders) | Yes - applies to licensed providers regardless of HIPAA status | NDPA (87-1101), eff. 2025-01-01: ENTITY-level HIPAA CE/BA exemption; no volume threshold (SBA small-business carve-out) | 87-801: medical info NOT covered; AG notice no later than residents; HIPAA satisfies security duty | 38-179(8) knowingly; no board order located | HIPAA if covered; 20-202 commercial exploitation | Neb. Rev. Stat. 20-202 (exploitation for advertising; 1-year limitation) | Yes: 20-202 invasion-of-privacy action; none under NDPA or breach law | DHHS Licensure Unit / Board of Medicine and Surgery, Board of Dentistry, Board of Nursing, AG | NDPA up to $7,500/violation (30-day cure) | E2 (AG v. Change Healthcare, allegations; MTD overruled 2025) | Medium-High | 2026-10-22 |
| Nebraska (NE) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Neb. Rev. Stat. 38-179(8) knowingly disclosing confidential information (all UCA credential holders) | Partly: 38-179(8) may reach UCA-licensed estheticians (inference); NDPA if not an SBA small business | NDPA (87-1101), eff. 2025-01-01: ENTITY-level HIPAA CE/BA exemption; no volume threshold (SBA small-business carve-out) | 87-801: medical info NOT covered; AG notice no later than residents; HIPAA satisfies security duty | 38-179(8) knowingly; no board order located | HIPAA if covered; 20-202 commercial exploitation | Neb. Rev. Stat. 20-202 (exploitation for advertising; 1-year limitation) | Yes: 20-202 invasion-of-privacy action; none under NDPA or breach law | DHHS Licensure Unit / Board of Medicine and Surgery, Board of Dentistry, Board of Nursing, AG | NDPA up to $7,500/violation (30-day cure) | E2 (AG v. Change Healthcare, allegations; MTD overruled 2025) | Medium-High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
State of Nebraska ex rel. Hilgers v. Change Healthcare Inc., UnitedHealth Group Inc. and Optum, Inc.
District Court of Lancaster County, Nebraska (AG plaintiff) · NE (state AG) · Filed 2024-12-16; MTD overruled 2025-11-10
- Provider type
- Health care clearinghouse / business associate
- Relevant facts
- ALLEGED: inadequate security and delayed notice in the February 2024 ransomware attack affecting hundreds of thousands of Nebraskans
- Legal issues
- Nebraska Consumer Protection Act; data-security/breach law 87-801 et seq.; Uniform Deceptive Trade Practices Act
- Holding, findings, allegations or settlement terms
- Allegations; motion to dismiss overruled (per AG release)
- Consequences recorded
- None final
- Procedural status
- Pending. Motion to dismiss overruled 2025-11-10; no later ruling located (V-018). Allegations only.
- Precedential?
- No
- Why it is in this research
- State AG uses state breach and UDTPA law against a HIPAA entity (E2)
Related pages
Topics
Healthcare industry
Sources
NE-001. Neb. Rev. Stat. 87-1102, 87-1103(2), 87-1104, 87-1107, 87-1118
Nebraska Data Privacy Act (LB 1074, Laws 2024), Neb. Rev. Stat. 87-1101 to 87-1130, operative January 1, 2025. Applies to persons doing business in Nebraska that process or sell personal data and are NOT small businesses under the SBA definition (no volume threshold); small businesses still may not sell sensitive data without consent. Exempts at ENTITY level HIPAA covered entities and business associates, and at DATA level PHI and listed health records. Sensitive data (including mental or physical health diagnosis) needs consent.
Statute · Explicit · High · Because there is no consumer-count threshold, a non-HIPAA med spa or nonmedical aesthetic business that is larger than an SBA small business can be covered (inference).
https://nebraskalegislature.gov/laws/display_html.php?begin_section=87-1101&end_section=87-1130
NE-002. Neb. Rev. Stat. 87-1122, 87-1124, 87-1125
NDPA enforcement: AG exclusive; before an action the AG must give 30 days' notice and allow cure; civil penalty up to $7,500 per violation; no private right of action.
Statute · Explicit · High · Maximum, not typical. Cure period is not sunset in the text read.
https://nebraskalegislature.gov/laws/display_html.php?begin_section=87-1101&end_section=87-1130
NE-003. Neb. Rev. Stat. 87-802(5), 87-803(1)-(2), 87-804(2), 87-806, 87-808(3)(b)
Breach law: personal information = name plus SSN, driver's license/state ID, account/card number with code, unique electronic ID or routing code, or unique biometric data; OR username/email plus password; medical information NOT covered. Notice as soon as possible after a reasonable investigation if misuse occurred or is reasonably likely; AG notice no later than resident notice; regulator-procedure deemed compliance; HIPAA-compliant entities satisfy the reasonable-security duty; AG may recover direct economic damages.
Statute · Explicit · High · No private right of action stated.
https://nebraskalegislature.gov/laws/display_html.php?begin_section=87-801&end_section=87-808
NE-004. Neb. Rev. Stat. 38-179(8)
Uniform Credentialing Act ground: 'knowingly disclosing confidential information except as otherwise permitted by law' is unprofessional conduct for every credential holder under the Act.
Statute · Explicit · High · The UCA covers physicians, dentists, nurses and (per 38-121, not re-read) cosmetology and esthetics licensees, so it may reach licensed estheticians in nonmedical businesses (inference; U-81).
https://nebraskalegislature.gov/laws/statutes.php?statute=38-179
NE-006. Neb. Rev. Stat. 20-202, 20-208, 20-211
Privacy statute: any person or firm that exploits a natural person's name, picture, portrait or personality for advertising or commercial purposes is liable for invasion of privacy; one-year limitation; the 20-202 action survives death.
Statute · Explicit · High · Before/after photos or testimonials in ads without consent are exposed (application inferred). Damages section 20-204 not re-read.
https://nebraskalegislature.gov/laws/display_html.php?begin_section=20-201&end_section=20-211
NE-005. Nebraska Board of Nursing, Advisory Opinion: Cosmetic and Dermatologic Procedures
Board of Nursing advisory opinion on cosmetic and dermatologic procedures (adopted Feb. 2012, revised Oct. 2015) is expressly not binding; it adopts the 2011 Joint Board Dermatologic Workgroup report on which nurses may perform cosmetic procedures and under what supervision.
Guidance (board advisory opinion) · Explicit · High · Guidance only. No Nebraska med spa statute enacted 2025-2026 (secondary search).
NE-007. State ex rel. Hilgers v. Change Healthcare Inc. et al.
Nebraska AG sued Change Healthcare, UnitedHealth Group and Optum (Lancaster County District Court, filed 2024-12-16) ALLEGING Consumer Protection Act, data-security/breach-notice and Uniform Deceptive Trade Practices Act violations over the February 2024 ransomware attack; the court overruled the motion to dismiss on 2025-11-10.
Enforcement (state AG; allegations; MTD ruling) · Explicit (AG press releases; order PDF listed, not read) · High · Allegations, no finding. Shows the AG uses state breach/UDTPA law against HIPAA entities.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
V-018. V-018
This reference id is cited in the publication and is not a row in the claim register supplied with it.