What a provider can and can't say in New Hampshire
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 332-I:2 I(e) consent rule; 329:17 VI(d)/(k); AMA ethics via Med 501.02(h); no board order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 332-I:2 I(e) consent rule; 329:17 VI(d)/(k); AMA ethics via Med 501.02(h); no board order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 332-I:2 I(e) consent rule; 329:17 VI(d)/(k); AMA ethics via Med 501.02(h); no board order located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 332-I:2 I(e) consent rule; 329:17 VI(d)/(k); AMA ethics via Med 501.02(h); no board order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 332-I:2 I(e) consent rule; 329:17 VI(d)/(k); AMA ethics via Med 501.02(h); no board order located |
- Consumer privacy and health data law: New Hampshire has a consumer privacy law in force (RSA 507-H). It exempts HIPAA-covered practices as a whole (an entity-level exemption). [NH-001, NH-002]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: attorney general. [NH-007]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (332-I). [NH-003]
- Patient confidentiality duties: The state confidentiality law applies to licensed providers (Statute plus board ethics). [NH-003, NH-006]
- Lawsuits by individuals: Patients may be able to sue in some situations (332-I:6, :4 and :5 only). [NH-004]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (RSA 329:1 laser tissue alteration is surgery; no med-spa-specific law). [NH-008]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4) (Cancelmo: a pleading-stage court ruling, not enforcement; trial set for 2027). Not finding enforcement does not mean none exists. [NH-003, U-97]
Sources:
- [NH-001] RSA 507-H:2, 507-H:3 I(f), 507-H:3 II, 507-H:4 (https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)
- [NH-002] RSA 507-H:11 (https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)
- [NH-003] RSA 332-I:1 III, 332-I:2 I(e), 332-I:4, 332-I:5 (https://gc.nh.gov/rsa/html/XXX/332-I/332-I-mrg.htm)
- [NH-004] RSA 332-I:6 (https://gc.nh.gov/rsa/html/XXX/332-I/332-I-mrg.htm)
- [NH-006] RSA 329:17 VI(d), (k); N.H. Admin. R. Med 501.01, 501.02(h), 102.04 (https://gc.nh.gov/rsa/html/XXX/329/329-17.htm)
- [NH-007] RSA 359-C:19 IV(a); 359-C:20 I, VI, V (https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-19.htm)
- [NH-008] RSA 329:1 (https://www.gc.nh.gov/rsa/html/XXX/329/329-1.htm)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| New Hampshire (NH) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | RSA 332-I:2 I(e) provider confidentiality; 332-I:4 marketing authorization; 329:17 VI(k) discipline for violating 332-I | Yes - applies to licensed providers regardless of HIPAA status | RSA 507-H, eff. 2025-01-01: ENTITY-level CE/BA exemption; 35k / 10k+25%; cure discretionary from 2026 | 359-C:19/20: medical info NOT covered; AG notice; regulator deemed compliance | 332-I:2 I(e) consent rule; 329:17 VI(d)/(k); AMA ethics via Med 501.02(h); no board order located | HIPAA if covered; 332-I:4 written authorization for marketing; likeness common law (not researched) | None statutory located (common law not researched) | Yes (narrow): 332-I:6 $1,000+ per violation of :4 or :5 (Cancelmo 2025 dismissal w/o prejudice) | OPLC Board of Medicine, Board of Dental Examiners, Board of Nursing, AG | 332-I:6 minimum $1,000/violation (private); 507-H via 358-A | E4 (Cancelmo = court ruling, no finding) | High | 2026-10-22 |
| New Hampshire (NH) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | RSA 332-I:2 I(e) provider confidentiality; 332-I:4 marketing authorization; 329:17 VI(k) discipline for violating 332-I | Yes - applies to licensed providers regardless of HIPAA status | RSA 507-H, eff. 2025-01-01: ENTITY-level CE/BA exemption; 35k / 10k+25%; cure discretionary from 2026 | 359-C:19/20: medical info NOT covered; AG notice; regulator deemed compliance | 332-I:2 I(e) consent rule; 329:17 VI(d)/(k); AMA ethics via Med 501.02(h); no board order located | HIPAA if covered; 332-I:4 written authorization for marketing; likeness common law (not researched) | None statutory located (common law not researched) | Yes (narrow): 332-I:6 $1,000+ per violation of :4 or :5 (Cancelmo 2025 dismissal w/o prejudice) | OPLC Board of Medicine, Board of Dental Examiners, Board of Nursing, AG | 332-I:6 minimum $1,000/violation (private); 507-H via 358-A | E4 (Cancelmo = court ruling, no finding) | High | 2026-10-22 |
| New Hampshire (NH) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | RSA 332-I:2 I(e) provider confidentiality; 332-I:4 marketing authorization; 329:17 VI(k) discipline for violating 332-I | Yes - applies to licensed providers regardless of HIPAA status | RSA 507-H, eff. 2025-01-01: ENTITY-level CE/BA exemption; 35k / 10k+25%; cure discretionary from 2026 | 359-C:19/20: medical info NOT covered; AG notice; regulator deemed compliance | 332-I:2 I(e) consent rule; 329:17 VI(d)/(k); AMA ethics via Med 501.02(h); no board order located | HIPAA if covered; 332-I:4 written authorization for marketing; likeness common law (not researched) | None statutory located (common law not researched) | Yes (narrow): 332-I:6 $1,000+ per violation of :4 or :5 (Cancelmo 2025 dismissal w/o prejudice) | OPLC Board of Medicine, Board of Dental Examiners, Board of Nursing, AG | 332-I:6 minimum $1,000/violation (private); 507-H via 358-A | E4 (Cancelmo = court ruling, no finding) | High | 2026-10-22 |
| New Hampshire (NH) | Medical med spa | Depends; cash-only med spas often not covered | RSA 332-I:2 I(e) provider confidentiality; 332-I:4 marketing authorization; 329:17 VI(k) discipline for violating 332-I | Yes - applies to licensed providers regardless of HIPAA status | RSA 507-H, eff. 2025-01-01: ENTITY-level CE/BA exemption; 35k / 10k+25%; cure discretionary from 2026 | 359-C:19/20: medical info NOT covered; AG notice; regulator deemed compliance | 332-I:2 I(e) consent rule; 329:17 VI(d)/(k); AMA ethics via Med 501.02(h); no board order located | HIPAA if covered; 332-I:4 written authorization for marketing; likeness common law (not researched) | None statutory located (common law not researched) | Yes (narrow): 332-I:6 $1,000+ per violation of :4 or :5 (Cancelmo 2025 dismissal w/o prejudice) | OPLC Board of Medicine, Board of Dental Examiners, Board of Nursing, AG | 332-I:6 minimum $1,000/violation (private); 507-H via 358-A | E4 (Cancelmo = court ruling, no finding) | High | 2026-10-22 |
| New Hampshire (NH) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | RSA 332-I:2 I(e) provider confidentiality; 332-I:4 marketing authorization; 329:17 VI(k) discipline for violating 332-I | No | RSA 507-H, eff. 2025-01-01: ENTITY-level CE/BA exemption; 35k / 10k+25%; cure discretionary from 2026 | 359-C:19/20: medical info NOT covered; AG notice; regulator deemed compliance | 332-I:2 I(e) consent rule; 329:17 VI(d)/(k); AMA ethics via Med 501.02(h); no board order located | HIPAA if covered; 332-I:4 written authorization for marketing; likeness common law (not researched) | None statutory located (common law not researched) | Yes (narrow): 332-I:6 $1,000+ per violation of :4 or :5 (Cancelmo 2025 dismissal w/o prejudice) | OPLC Board of Medicine, Board of Dental Examiners, Board of Nursing, AG | 332-I:6 minimum $1,000/violation (private); 507-H via 358-A | E4 (Cancelmo = court ruling, no finding) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Cancelmo v. Southern New Hampshire Medical Center
U.S. District Court, District of New Hampshire · NH (federal court, state-law claims) · 2025-09-30
- Provider type
- Hospital system
- Relevant facts
- Website shared visitors' search data with Google (tracking pixels/analytics)
- Legal issues
- RSA 332-I:4, I (marketing use of PHI); NH Wiretap Act RSA 570-A
- Holding, findings, allegations or settlement terms
- Ruling on motion to dismiss: 332-I:4 count dismissed without prejudice (no plausible disclosure of plaintiff's own PHI for marketing); Wiretap claims survived
- Consequences recorded
- None
- Procedural status
- Pending. Plaintiff filed notice of intent not to amend (2025-10-29); answer filed 2025-11-19; jury selection set for 2027-06-22 (docket mirror, secondary; V-017).
- Precedential?
- No (trial-court order)
- Why it is in this research
- First reported treatment of 332-I:4, I; tracking-pixel exposure for practice websites
Related pages
Topics
Healthcare industry
Sources
NH-001. RSA 507-H:2, 507-H:3 I(f), 507-H:3 II, 507-H:4
NH privacy law, RSA 507-H (SB 255, 2024), effective 2025-01-01. Applies to persons controlling or processing data of 35,000+ unique consumers (excluding payment-only data), or 10,000+ with more than 25% of gross revenue from selling personal data. Exempts at ENTITY level covered entities and business associates (45 CFR 160.103) and at DATA level PHI. Sensitive data (including mental or physical health condition or diagnosis) requires consent.
Statute · Explicit · High · Thresholds exclude most single-site aesthetic businesses (inference).
NH-002. RSA 507-H:11
RSA 507-H enforcement: AG exclusive; violation is an unfair or deceptive act under RSA 358-A:2; mandatory 60-day cure in 2025, discretionary from 2026-01-01; no private right of action.
Statute · Explicit · High · 358-A penalty amounts not re-read.
NH-007. RSA 359-C:19 IV(a); 359-C:20 I, VI, V
Breach law: personal information = name plus SSN, driver's license/government ID, or account/card number with code; medical information NOT covered; notify affected individuals as soon as possible and the AG (or primary regulator); consumer reporting agencies if more than 1,000; regulator-procedure deemed compliance.
Statute · Explicit · High · Private action under 359-C:21 not re-read.
NH-003. RSA 332-I:1 III, 332-I:2 I(e), 332-I:4, 332-I:5
RSA 332-I: a health care provider shall not reveal confidential communications or information without the patient's consent, except as provided by law or as necessary to protect the welfare of the individual or the public interest; release or use of patient-identifiable information for sales or marketing requires written authorization; marketing use of PHI requires a HIPAA-type authorization; notice duty for certain disclosures.
Statute · Explicit · High · 'Health care provider' is broad (state-licensed providers); PHI defined by HIPAA reference (332-I:1 II(a)(4)), so reach of :4 to non-HIPAA providers is uncertain (U-84).
NH-006. RSA 329:17 VI(d), (k); N.H. Admin. R. Med 501.01, 501.02(h), 102.04
Board of Medicine grounds include dishonest or unprofessional conduct and violating RSA 332-I; Med 501.01 makes the ethical standards binding as unprofessional conduct, and Med 501.02(h) requires adherence to the AMA Code of Medical Ethics (June 2016 edition). Med 102.04 defines the practice of medicine to include laser procedures.
Statute + regulation · Explicit · High · Explicit 332-I discipline hook is unusual. No med spa or delegation rule located (U-84).
NH-004. RSA 332-I:6
RSA 332-I:6 private civil action: a person aggrieved by a violation of 332-I:4 or :5 may recover damages of not less than $1,000 per violation, plus costs and reasonable attorney's fees.
Statute · Explicit · High · Private action covers the marketing/notice sections, not 332-I:2 generally (as read).
NH-008. RSA 329:1
Med spa: no med-spa-specific law located. RSA 329:1 defines 'surgery' (practice of medicine) to include any procedure, including laser, in which human tissue is cut, shaped, burned, vaporized or otherwise structurally altered, except where another statute authorizes the act.
Statute · Explicit · High · Med spa pass, final phase part 2 (2026-10-22). Official text read 2026-10-22 (V-061). Absence of a med spa statute rests on a secondary summary.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
V-017. V-017
This reference id is cited in the publication and is not a row in the claim register supplied with it.
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All