What a provider can and can't say in North Carolina
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 90-14(a)(6) ethics; 8-53; Acosta (HIPAA as standard of care, pleading stage) |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Partly: 90-41(a)(6) rules ground; 8-53 covers Art. 1 ch. 90 practitioners (physicians) | 90-14(a)(6) ethics; 8-53; Acosta (HIPAA as standard of care, pleading stage) |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 90-14(a)(6) ethics; 8-53; Acosta (HIPAA as standard of care, pleading stage) |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 90-14(a)(6) ethics; 8-53; Acosta (HIPAA as standard of care, pleading stage) |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 90-14(a)(6) ethics; 8-53; Acosta (HIPAA as standard of care, pleading stage) |
- Consumer privacy and health data law: North Carolina has no comprehensive consumer privacy law in force as of October 22, 2026.† [NC-007]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: attorney general whenever notice given. [NC-003]
- Patient confidentiality duties: Patient confidentiality duties come mainly from privilege and board ethics rules. [NC-001, NC-002]
- Patient confidentiality duties: The board can discipline unethical conduct, which can include confidentiality breaches (90-14(a)(6)). [NC-002]
- Lawsuits by individuals: Patients may be able to sue in some situations (Negligence/NIED (pleading stage)). [NC-006]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: only agency guidance was found (position statement); the binding rules are the general professional practice acts. [NC-005]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2) (N.C. Medical Board, Lynch). Not finding enforcement does not mean none exists. [NC-004]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [NC-001] N.C. Gen. Stat. 8-53 (https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_8/GS_8-53.html)
- [NC-002] N.C. Gen. Stat. 90-14(a)(6); 90-41(a)(6) (https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_90/GS_90-14.html)
- [NC-003] N.C. Gen. Stat. 75-61(10); 14-113.20(b); 75-65(e1), (f) (https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html)
- [NC-004] In re Sean Michael Lynch, M.D. (NCMB Consent Order) Findings; Conclusions; Order 1-2 (https://portal.ncmedboard.org/file/fileDisplay.aspx?FileID=hBB4qrGkpiI%3D&TYPE=DISCLIC)
- [NC-005] NCMB Position Statements 5.1.2, 3.1.1 (https://www.ncmedboard.org/resources-information/professional-resources/laws-rules-position-statements/position-statements/laser_surgery)
- [NC-006] Acosta v. Byrum, 180 N.C. App. 562, 638 S.E.2d 246 (2006) (https://www.courtlistener.com/opinion/1266254/acosta-v-byrum/)
- [NC-007] IAPP US State Privacy Legislation Tracker (secondary); synthesis.csv (https://iapp.org/resources/article/us-state-privacy-legislation-tracker/)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| North Carolina (NC) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | G.S. 8-53 (records only on patient authorization; physicians); 90-14(a)(6) ethics ground | Yes - applies to licensed providers regardless of HIPAA status | None | 75-61/75-65: medical info NOT covered; AG notice whenever notice is given; AG + CRAs if >1,000 | 90-14(a)(6) ethics; 8-53; Acosta (HIPAA as standard of care, pleading stage) | HIPAA if covered; 90-14(a)(6) (Lynch 2024: de-identified photo shown without consent sanctioned) | None statutory located (common law not researched) | Common-law negligence/NIED theories (Acosta, pleading stage); breach-law UDTP action if injured (not quoted) | NC Medical Board, Board of Dental Examiners, Board of Nursing, AG Consumer Protection | Breach via 75-1.1 (amount not verified); license discipline | E2 (NCMB Lynch consent order 2024: patient photo/information shared; stayed suspension); E1 federal (OCR UPI, NC dental review reply) | High | 2026-10-22 |
| North Carolina (NC) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | G.S. 8-53 (records only on patient authorization; physicians); 90-14(a)(6) ethics ground | Partly: 90-41(a)(6) rules ground; 8-53 covers Art. 1 ch. 90 practitioners (physicians) | None | 75-61/75-65: medical info NOT covered; AG notice whenever notice is given; AG + CRAs if >1,000 | 90-14(a)(6) ethics; 8-53; Acosta (HIPAA as standard of care, pleading stage) | HIPAA if covered; 90-14(a)(6) (Lynch 2024: de-identified photo shown without consent sanctioned) | None statutory located (common law not researched) | Common-law negligence/NIED theories (Acosta, pleading stage); breach-law UDTP action if injured (not quoted) | NC Medical Board, Board of Dental Examiners, Board of Nursing, AG Consumer Protection | Breach via 75-1.1 (amount not verified); license discipline | E2 (NCMB Lynch consent order 2024: patient photo/information shared; stayed suspension); E1 federal (OCR UPI, NC dental review reply) | High | 2026-10-22 |
| North Carolina (NC) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | G.S. 8-53 (records only on patient authorization; physicians); 90-14(a)(6) ethics ground | Yes - applies to licensed providers regardless of HIPAA status | None | 75-61/75-65: medical info NOT covered; AG notice whenever notice is given; AG + CRAs if >1,000 | 90-14(a)(6) ethics; 8-53; Acosta (HIPAA as standard of care, pleading stage) | HIPAA if covered; 90-14(a)(6) (Lynch 2024: de-identified photo shown without consent sanctioned) | None statutory located (common law not researched) | Common-law negligence/NIED theories (Acosta, pleading stage); breach-law UDTP action if injured (not quoted) | NC Medical Board, Board of Dental Examiners, Board of Nursing, AG Consumer Protection | Breach via 75-1.1 (amount not verified); license discipline | E2 (NCMB Lynch consent order 2024: patient photo/information shared; stayed suspension); E1 federal (OCR UPI, NC dental review reply) | High | 2026-10-22 |
| North Carolina (NC) | Medical med spa | Depends; cash-only med spas often not covered | G.S. 8-53 (records only on patient authorization; physicians); 90-14(a)(6) ethics ground | Yes - applies to licensed providers regardless of HIPAA status | None | 75-61/75-65: medical info NOT covered; AG notice whenever notice is given; AG + CRAs if >1,000 | 90-14(a)(6) ethics; 8-53; Acosta (HIPAA as standard of care, pleading stage) | HIPAA if covered; 90-14(a)(6) (Lynch 2024: de-identified photo shown without consent sanctioned) | None statutory located (common law not researched) | Common-law negligence/NIED theories (Acosta, pleading stage); breach-law UDTP action if injured (not quoted) | NC Medical Board, Board of Dental Examiners, Board of Nursing, AG Consumer Protection | Breach via 75-1.1 (amount not verified); license discipline | E2 (NCMB Lynch consent order 2024: patient photo/information shared; stayed suspension); E1 federal (OCR UPI, NC dental review reply) | High | 2026-10-22 |
| North Carolina (NC) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | G.S. 8-53 (records only on patient authorization; physicians); 90-14(a)(6) ethics ground | No | None | 75-61/75-65: medical info NOT covered; AG notice whenever notice is given; AG + CRAs if >1,000 | 90-14(a)(6) ethics; 8-53; Acosta (HIPAA as standard of care, pleading stage) | HIPAA if covered; 90-14(a)(6) (Lynch 2024: de-identified photo shown without consent sanctioned) | None statutory located (common law not researched) | Common-law negligence/NIED theories (Acosta, pleading stage); breach-law UDTP action if injured (not quoted) | NC Medical Board, Board of Dental Examiners, Board of Nursing, AG Consumer Protection | Breach via 75-1.1 (amount not verified); license discipline | E2 (NCMB Lynch consent order 2024: patient photo/information shared; stayed suspension); E1 federal (OCR UPI, NC dental review reply) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Dr. U. Phillip Igbinadolor, DMD & Associates (UPI)
HHS OCR · NC (federal action) · 2022-03-28 (announced)
- Provider type
- Dental
- Relevant facts
- Webpage reply to negative review disclosed PHI; no response to OCR subpoena
- Legal issues
- Impermissible disclosure (see OCR notice; section list not re-verified)
- Holding, findings, allegations or settlement terms
- CMP imposed; hearing waived (not judicial finding)
- Consequences recorded
- $50,000
- Procedural status
- Final CMP (hearing waived)
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Review response
North Carolina Medical Board: Sean Michael Lynch, M.D.
North Carolina Medical Board · NC (state licensing) · 2024-10-21
- Provider type
- Physician (OB/GYN)
- Relevant facts
- Showed a bar patron a graphic photo of an unconscious patient (no face or identifiers), taken without her knowledge and shown without consent or medical purpose; complaints also alleged sharing patient details
- Legal issues
- N.C. Gen. Stat. 90-14(a)(6) (ethics; honesty, justice, good morals)
- Holding, findings, allegations or settlement terms
- Findings and conclusions in consent order (admissions)
- Consequences recorded
- Reprimand; indefinite suspension stayed on conditions (NCPHP contract, 16-hour CME)
- Procedural status
- Final (consent order)
- Precedential?
- No
- Why it is in this research
- De-identified patient photos shared outside care can still draw discipline; relevant to before/after photo handling
Acosta v. Byrum
North Carolina Court of Appeals · NC · 2006-12-19
- Provider type
- Physician (psychiatry)
- Relevant facts
- Psychiatrist allegedly let an office manager use his access code; she obtained and disclosed the plaintiff's records
- Legal issues
- Negligent infliction of emotional distress; HIPAA as evidence of standard of care; Rule 9(j)
- Holding, findings, allegations or settlement terms
- Pleading-stage ruling: claim allowed to proceed; HIPAA gives no private action
- Consequences recorded
- n/a
- Procedural status
- Remanded; later history not verified
- Precedential?
- Yes (intermediate appellate)
- Why it is in this research
- Plaintiffs can use HIPAA standards to frame state negligence claims (pleading stage only)
Related pages
Topics
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
NC-007. IAPP US State Privacy Legislation Tracker (secondary); synthesis.csv
North Carolina has no comprehensive consumer privacy law in force as of 2026-10-22 (negative search).
Search result (negative) · Inferred from negative search · Medium · Med spa pass, final phase part 2 (2026-10-22). Negative finding from a secondary tracker and earlier batch research; pending bills not reviewed. Re-check before publication (U-96).
https://iapp.org/resources/article/us-state-privacy-legislation-tracker/
NC-003. N.C. Gen. Stat. 75-61(10); 14-113.20(b); 75-65(e1), (f)
Breach law 'personal information' = name plus 'identifying information' (SSN, DL/passport, account numbers, PINs, e-IDs, digital signatures, biometric data, fingerprints, passwords, parent's maiden name); medical information is NOT covered. Whenever notice is given, the AG Consumer Protection Division must be notified; AG and CRAs if more than 1,000.
Statute · Explicit · High · Violations treated under 75-1.1 (not quoted). No HIPAA deemed-compliance text located.
https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html
NC-001. N.C. Gen. Stat. 8-53
G.S. 8-53: physician-patient privilege, plus 'Confidential information obtained in medical records shall be furnished only on the authorization of the patient' (or estate representative); a judge may compel disclosure when necessary to the proper administration of justice.
Statute · Explicit · High · Covers practitioners under Article 1 of Chapter 90 (physicians). Whether a review reply 'furnishes' medical-record information is untested (inference).
https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_8/GS_8-53.html
NC-002. N.C. Gen. Stat. 90-14(a)(6); 90-41(a)(6)
Physician discipline: no explicit confidentiality ground; 'unprofessional conduct' in 90-14(a)(6) includes departing from the ethics of the medical profession or committing any act contrary to honesty, justice or good morals. Dentists: violating the Article or Board rules (90-41(a)(6)).
Statute · Explicit · High · The Board used (a)(6) for a patient photo/information-sharing case (NC-004).
https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_90/GS_90-14.html
NC-006. Acosta v. Byrum, 180 N.C. App. 562, 638 S.E.2d 246 (2006)
Court of Appeals: a claim that a psychiatrist let an office manager use his access code to obtain and disclose a patient's records stated a negligent-infliction claim; HIPAA creates no private right of action but may evidence the standard of care.
Judicial decision · Holding per opinion summary (full text not read) · Medium · Pleading-stage ruling, not a merits finding.
https://www.courtlistener.com/opinion/1266254/acosta-v-byrum/
NC-005. NCMB Position Statements 5.1.2, 3.1.1
NC Medical Board Position Statement 5.1.2 (Laser Surgery): laser hair removal may be performed by a physician or a person the physician designates as adequately trained and experienced, with the physician fully responsible and on site or readily available. Statement 3.1.1 addresses professional use of social media.
Guidance · Per search extract (site blocks automated fetch) · Medium · Guidance, not law. 3.1.1 text not read (U-54).
NC-004. In re Sean Michael Lynch, M.D. (NCMB Consent Order)
NC Medical Board consent order (findings and admissions): an OB/GYN showed a bar patron a graphic photo of an unconscious patient (no face or identifiers) taken without her knowledge, not in her record, shown without consent and with no medical purpose; unprofessional conduct under 90-14(a)(6); reprimand and indefinite suspension, stayed on conditions (NCPHP contract, 16-hour CME).
Enforcement (licensing; consent order with findings) · Explicit (order read) · High · Not cosmetic, not online. Notable: a de-identified photo still supported discipline.
https://portal.ncmedboard.org/file/fileDisplay.aspx?FileID=hBB4qrGkpiI%3D&TYPE=DISCLIC
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All