What a provider can and can't say in New Jersey
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | No NJ statute specific to reviews located; common-law duty (Hague) and board rules (not verified); OCR Manasa (NJ) federal case |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | No NJ statute specific to reviews located; common-law duty (Hague) and board rules (not verified); OCR Manasa (NJ) federal case |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | No NJ statute specific to reviews located; common-law duty (Hague) and board rules (not verified); OCR Manasa (NJ) federal case |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | No NJ statute specific to reviews located; common-law duty (Hague) and board rules (not verified); OCR Manasa (NJ) federal case |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Licensee rules do not reach unlicensed businesses; NJDPA if thresholds met | No NJ statute specific to reviews located; common-law duty (Hague) and board rules (not verified); OCR Manasa (NJ) federal case |
- Consumer privacy and health data law: New Jersey has a consumer privacy law in force (NJDPA (health data opt-in)). It exempts only HIPAA-protected health information (a data-level exemption), so a covered practice's other data, such as website or marketing data, can still fall under it. [NJ-001, NJ-002]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: the Division of State Police must be notified before individuals. [NJ-005]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a court-recognized duty of confidentiality (Hague). [NJ-007]
- Research notes and gaps: A specific board confidentiality ground was not read or not located; this is a research gap, not a finding that none exists. [U-98]
- Lawsuits by individuals: Court decisions recognize patient privacy or confidentiality lawsuits in some situations (Hague). [NJ-007]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (N.J.A.C. 13:35-6.4, 13:28-2.15 (LII host); no aesthetic-specific BME rule).† [NJ-008]
- Enforcement located: Strongest state enforcement evidence located: official enforcement against comparable conduct (E1) (Division of Consumer Affairs, Diamond). Not finding enforcement does not mean none exists. [NJ-006]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [NJ-001] N.J.S.A. 56:8-166.13(a) (P.L.2023, c.266, s.10) s.10(a) (https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)
- [NJ-002] N.J.S.A. 56:8-166.5 (P.L.2023, c.266, s.2) (https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM)
- [NJ-005] N.J.S.A. 56:8-161, 56:8-163 163(a),(c) (https://pub.njleg.state.nj.us/bills/2018/PL19/95_.HTM)
- [NJ-006] NJ DCA Consent Order filed 2021-10-12 (https://www.nj.gov/oag/newsreleases21/Diamond-Institute.pdf)
- [NJ-007] 37 N.J. 328, 181 A.2d 345 (1962) pinpoint not verified (https://www.courtlistener.com/opinion/1957974/hague-v-williams/)
- [NJ-008] N.J.A.C. 13:35-6.4; 13:28-2.15 (https://www.law.cornell.edu/regulations/new-jersey/N-J-A-C-13-28-2-15)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| New Jersey (NJ) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Hague v. Williams duty of confidentiality; Board of Medical Examiners rules (N.J.A.C. 13:35, not verified); privilege N.J.S.A. 2A:84A-22.2 (not verified) | Yes - applies to licensed providers regardless of HIPAA status | NJDPA (P.L.2023 c.266): DATA-level PHI exemption only; sensitive (health, biometric) data requires consent; thresholds 100k/25k | N.J.S.A. 56:8-161/-163: medical info NOT covered; State Police before customers; most expedient time | No NJ statute specific to reviews located; common-law duty (Hague) and board rules (not verified); OCR Manasa (NJ) federal case | HIPAA if covered; NJDPA consent for sensitive data; common-law appropriation (no NJ likeness statute located) | None located (common law; verify) | No NJDPA private action; CFA private action (56:8-19) not analyzed; common-law torts | Board of Medical Examiners, Board of Dentistry, Board of Nursing, Division of Consumer Affairs, AG | CFA civil penalties (amounts not verified). Example outcome, not a maximum: Diamond Institute $412,300 civil penalties (settlement) | E1 (NJ DCA Diamond Institute consent order vs. medical practice, HIPAA+CFA); E1 (OCR Manasa, review replies, federal) | Medium-High | 2026-10-22 |
| New Jersey (NJ) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Hague v. Williams duty of confidentiality; Board of Medical Examiners rules (N.J.A.C. 13:35, not verified); privilege N.J.S.A. 2A:84A-22.2 (not verified) | Yes - applies to licensed providers regardless of HIPAA status | NJDPA (P.L.2023 c.266): DATA-level PHI exemption only; sensitive (health, biometric) data requires consent; thresholds 100k/25k | N.J.S.A. 56:8-161/-163: medical info NOT covered; State Police before customers; most expedient time | No NJ statute specific to reviews located; common-law duty (Hague) and board rules (not verified); OCR Manasa (NJ) federal case | HIPAA if covered; NJDPA consent for sensitive data; common-law appropriation (no NJ likeness statute located) | None located (common law; verify) | No NJDPA private action; CFA private action (56:8-19) not analyzed; common-law torts | Board of Medical Examiners, Board of Dentistry, Board of Nursing, Division of Consumer Affairs, AG | CFA civil penalties (amounts not verified). Example outcome, not a maximum: Diamond Institute $412,300 civil penalties (settlement) | E1 (NJ DCA Diamond Institute consent order vs. medical practice, HIPAA+CFA); E1 (OCR Manasa, review replies, federal) | Medium-High | 2026-10-22 |
| New Jersey (NJ) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Hague v. Williams duty of confidentiality; Board of Medical Examiners rules (N.J.A.C. 13:35, not verified); privilege N.J.S.A. 2A:84A-22.2 (not verified) | Yes - applies to licensed providers regardless of HIPAA status | NJDPA (P.L.2023 c.266): DATA-level PHI exemption only; sensitive (health, biometric) data requires consent; thresholds 100k/25k | N.J.S.A. 56:8-161/-163: medical info NOT covered; State Police before customers; most expedient time | No NJ statute specific to reviews located; common-law duty (Hague) and board rules (not verified); OCR Manasa (NJ) federal case | HIPAA if covered; NJDPA consent for sensitive data; common-law appropriation (no NJ likeness statute located) | None located (common law; verify) | No NJDPA private action; CFA private action (56:8-19) not analyzed; common-law torts | Board of Medical Examiners, Board of Dentistry, Board of Nursing, Division of Consumer Affairs, AG | CFA civil penalties (amounts not verified). Example outcome, not a maximum: Diamond Institute $412,300 civil penalties (settlement) | E1 (NJ DCA Diamond Institute consent order vs. medical practice, HIPAA+CFA); E1 (OCR Manasa, review replies, federal) | Medium-High | 2026-10-22 |
| New Jersey (NJ) | Medical med spa | Depends; cash-only med spas often not covered | Hague v. Williams duty of confidentiality; Board of Medical Examiners rules (N.J.A.C. 13:35, not verified); privilege N.J.S.A. 2A:84A-22.2 (not verified) | Yes - applies to licensed providers regardless of HIPAA status | NJDPA (P.L.2023 c.266): DATA-level PHI exemption only; sensitive (health, biometric) data requires consent; thresholds 100k/25k | N.J.S.A. 56:8-161/-163: medical info NOT covered; State Police before customers; most expedient time | No NJ statute specific to reviews located; common-law duty (Hague) and board rules (not verified); OCR Manasa (NJ) federal case | HIPAA if covered; NJDPA consent for sensitive data; common-law appropriation (no NJ likeness statute located) | None located (common law; verify) | No NJDPA private action; CFA private action (56:8-19) not analyzed; common-law torts | Board of Medical Examiners, Board of Dentistry, Board of Nursing, Division of Consumer Affairs, AG | CFA civil penalties (amounts not verified). Example outcome, not a maximum: Diamond Institute $412,300 civil penalties (settlement) | E1 (NJ DCA Diamond Institute consent order vs. medical practice, HIPAA+CFA); E1 (OCR Manasa, review replies, federal) | Medium-High | 2026-10-22 |
| New Jersey (NJ) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Hague v. Williams duty of confidentiality; Board of Medical Examiners rules (N.J.A.C. 13:35, not verified); privilege N.J.S.A. 2A:84A-22.2 (not verified) | Licensee rules do not reach unlicensed businesses; NJDPA if thresholds met | NJDPA (P.L.2023 c.266): DATA-level PHI exemption only; sensitive (health, biometric) data requires consent; thresholds 100k/25k | N.J.S.A. 56:8-161/-163: medical info NOT covered; State Police before customers; most expedient time | No NJ statute specific to reviews located; common-law duty (Hague) and board rules (not verified); OCR Manasa (NJ) federal case | HIPAA if covered; NJDPA consent for sensitive data; common-law appropriation (no NJ likeness statute located) | None located (common law; verify) | No NJDPA private action; CFA private action (56:8-19) not analyzed; common-law torts | Board of Medical Examiners, Board of Dentistry, Board of Nursing, Division of Consumer Affairs, AG | CFA civil penalties (amounts not verified). Example outcome, not a maximum: Diamond Institute $412,300 civil penalties (settlement) | E1 (NJ DCA Diamond Institute consent order vs. medical practice, HIPAA+CFA); E1 (OCR Manasa, review replies, federal) | Medium-High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Manasa Health Center
HHS OCR · NJ (federal action) · 2023-06-05
- Provider type
- Psychiatric
- Relevant facts
- Google review replies disclosed PHI of four patients
- Legal issues
- 45 CFR 164.502(a), 164.530(i)
- Holding, findings, allegations or settlement terms
- Settlement (no admission); admission of liability: No
- Consequences recorded
- $30,000; 2-year CAP
- Procedural status
- Closed: resolution agreement; CAP monitoring period (status not re-checked)
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Review response
In re Diamond Institute for Infertility and Menopause, LLC
NJ Division of Consumer Affairs (AG) · NJ (state) · 2021-10-12
- Provider type
- Fertility medical practice
- Relevant facts
- Unencrypted ePHI accessed by intruders Aug 2016-Jan 2017; 14,663 patients
- Legal issues
- CFA, ITPA, HIPAA Privacy/Security Rules (state AG authority)
- Holding, findings, allegations or settlement terms
- Consent order; allegations disputed by Diamond
- Consequences recorded
- $495,000 ($412,300 civil penalties + $82,700 costs/fees); security program, HIPAA officer
- Procedural status
- Closed (consent order)
- Precedential?
- No
- Why it is in this research
- State AGs can enforce HIPAA against private practices
Hague v. Williams
Supreme Court of New Jersey · NJ · 1962-05-21
- Provider type
- Physician (pediatrician)
- Relevant facts
- Physician disclosed child's heart condition to insurer
- Legal issues
- Physician's duty not to divulge confidential information; justified disclosure
- Holding, findings, allegations or settlement terms
- Duty of confidentiality recognized, subject to exceptions; disclosure justified on facts (pinpoints unverified)
- Consequences recorded
- None (defendant not liable)
- Procedural status
- Final
- Precedential?
- Yes (NJ Supreme Court)
- Why it is in this research
- Common-law confidentiality duty in NJ
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
NJ-001. N.J.S.A. 56:8-166.13(a) (P.L.2023, c.266, s.10)
NJ Data Privacy Act does not apply to PHI collected by a HIPAA covered entity or business associate (a DATA-level exemption; no entity-level exemption for covered entities was found).
Statute · Explicit · High · Non-PHI data of a covered practice (e.g., marketing lists, website data) may remain in scope if thresholds are met.
NJ-002. N.J.S.A. 56:8-166.5 (P.L.2023, c.266, s.2)
NJDPA applies to controllers doing business in NJ that control or process data of 100,000+ consumers (excluding payment-only data) or 25,000+ consumers with revenue/discount from sale of data.
Statute · Explicit · High · Most single-location aesthetic practices likely fall below thresholds (inference).
NJ-005. N.J.S.A. 56:8-161, 56:8-163
NJ breach law: personal information is name plus SSN, driver's license/state ID, financial account with code, or online credentials; medical information is NOT a listed element; report to the Division of State Police before notifying customers; notice in the most expedient time possible without unreasonable delay.
Statute · Explicit · High · Verified against official chapter law P.L.2019, c.95 (amending 56:8-161, -163); medical information not listed. Later amendments not checked.
NJ-007. 37 N.J. 328, 181 A.2d 345 (1962)
Supreme Court of New Jersey recognized a physician's duty not to divulge confidential patient information, subject to exceptions where disclosure serves a legitimate interest (Hague v. Williams).
Judicial decision · Explicit (case located) · Medium · Precedential; old; pinpoints unverified.
https://www.courtlistener.com/opinion/1957974/hague-v-williams/
NJ-008. N.J.A.C. 13:35-6.4; 13:28-2.15
Med spa: no adopted Board of Medical Examiners rule specific to aesthetic procedures (a 2015 laser/filler proposal was not adopted, per secondary reporting). Binding general rules apply: N.J.A.C. 13:35-6.4 (delegation to certified medical assistants) and N.J.A.C. 13:28-2.15 (cosmetology rule listing Botox and similar injections and laser hair removal as practices outside cosmetology).
Regulation · Explicit (rule text on LII, secondary host) · Medium · Med spa pass, final phase part 2 (2026-10-22). Read on LII (secondary host); official NJ code text not read (V-062, U-99).
https://www.law.cornell.edu/regulations/new-jersey/N-J-A-C-13-28-2-15
NJ-006. NJ DCA Consent Order filed 2021-10-12
NJ Division of Consumer Affairs consent order: Diamond Institute for Infertility and Menopause paid $495,000 ($412,300 civil penalties + $82,700 costs/fees) and agreed to security reforms after a 2016-17 breach; alleged CFA and HIPAA violations; Diamond disputed the allegations.
Enforcement (state administrative consent order; HIPAA via state AG authority) · Explicit · High · Medical practice (fertility); settlement, not a finding.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All