What a provider can and can't say in North Dakota
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 43-17-31(1)(m); 43-28-18(8) |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 43-17-31(1)(m); 43-28-18(8) |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 43-17-31(1)(m); 43-28-18(8) |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 43-17-31(1)(m); 43-28-18(8) |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 43-17-31(1)(m); 43-28-18(8) |
- Consumer privacy and health data law: North Dakota has no comprehensive consumer privacy law in force as of October 22, 2026. [U-98]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general if more than 250 residents affected. [ND-002]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules. [ND-001]
- Patient confidentiality duties: Board discipline for confidentiality breaches rests on a general professional-conduct ground (43-17-31(1)(m)). [ND-001]
- Lawsuits by individuals: No private right of action was located in the statutes reviewed; other claims, such as privacy torts, may still exist. [U-98]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (NDAC 32-03-01 nonablative laser safety program plus NDBON guidance). [ND-004]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [ND-001, U-97]
Sources:
- [ND-001] N.D.C.C. 43-17-31(1)(m); 43-28-18(8) (https://www.ndlegis.gov/cencode/t43c17.pdf)
- [ND-002] N.D.C.C. 51-30-01(3), (4); 51-30-02; 51-30-06 (https://www.ndlegis.gov/cencode/t51c30.pdf)
- [ND-004] N.D. Admin. Code ch. 32-03-01; NDBON practice guidance (2026-01) (https://ndlegis.gov/prod/acdata/pdf/32-03-01.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| North Dakota (ND) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | N.D.C.C. 43-17-31(1)(m) (physicians); 43-28-18(8) (dentists) | Yes - applies to licensed providers regardless of HIPAA status | None | 51-30: medical + health insurance info covered; most expedient time; AG if >250; HIPAA entities considered compliant | 43-17-31(1)(m); 43-28-18(8) | HIPAA if covered; otherwise licensee confidentiality grounds | None located | None statutory located | Board of Medicine, Board of Dental Examiners, Board of Nursing, AG Consumer Protection | Breach: up to $5,000/violation (51-15-11); license discipline | E4 | High | 2026-10-22 |
| North Dakota (ND) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | N.D.C.C. 43-17-31(1)(m) (physicians); 43-28-18(8) (dentists) | Yes - applies to licensed providers regardless of HIPAA status | None | 51-30: medical + health insurance info covered; most expedient time; AG if >250; HIPAA entities considered compliant | 43-17-31(1)(m); 43-28-18(8) | HIPAA if covered; otherwise licensee confidentiality grounds | None located | None statutory located | Board of Medicine, Board of Dental Examiners, Board of Nursing, AG Consumer Protection | Breach: up to $5,000/violation (51-15-11); license discipline | E4 | High | 2026-10-22 |
| North Dakota (ND) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | N.D.C.C. 43-17-31(1)(m) (physicians); 43-28-18(8) (dentists) | Yes - applies to licensed providers regardless of HIPAA status | None | 51-30: medical + health insurance info covered; most expedient time; AG if >250; HIPAA entities considered compliant | 43-17-31(1)(m); 43-28-18(8) | HIPAA if covered; otherwise licensee confidentiality grounds | None located | None statutory located | Board of Medicine, Board of Dental Examiners, Board of Nursing, AG Consumer Protection | Breach: up to $5,000/violation (51-15-11); license discipline | E4 | High | 2026-10-22 |
| North Dakota (ND) | Medical med spa | Depends; cash-only med spas often not covered | N.D.C.C. 43-17-31(1)(m) (physicians); 43-28-18(8) (dentists) | Yes - applies to licensed providers regardless of HIPAA status | None | 51-30: medical + health insurance info covered; most expedient time; AG if >250; HIPAA entities considered compliant | 43-17-31(1)(m); 43-28-18(8) | HIPAA if covered; otherwise licensee confidentiality grounds | None located | None statutory located | Board of Medicine, Board of Dental Examiners, Board of Nursing, AG Consumer Protection | Breach: up to $5,000/violation (51-15-11); license discipline | E4 | High | 2026-10-22 |
| North Dakota (ND) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | N.D.C.C. 43-17-31(1)(m) (physicians); 43-28-18(8) (dentists) | No | None | 51-30: medical + health insurance info covered; most expedient time; AG if >250; HIPAA entities considered compliant | 43-17-31(1)(m); 43-28-18(8) | HIPAA if covered; otherwise licensee confidentiality grounds | None located | None statutory located | Board of Medicine, Board of Dental Examiners, Board of Nursing, AG Consumer Protection | Breach: up to $5,000/violation (51-15-11); license discipline | E4 | High | 2026-10-22 |
Related pages
Topics
Healthcare industry
Sources
ND-002. N.D.C.C. 51-30-01(3), (4); 51-30-02; 51-30-06
Breach law personal information includes medical information and health insurance information (also date of birth, mother's maiden name, electronic signature); notice in the most expedient time possible; AG notice if more than 250; HIPAA covered entities, business associates and subcontractors subject to HIPAA breach rules are considered compliant.
Statute · Explicit · High
ND-001. N.D.C.C. 43-17-31(1)(m); 43-28-18(8)
Physician discipline ground: 'willful or negligent violation of the confidentiality between physician and patient, except as required by law'; dentist discipline ground: 'Disclosed confidential information'.
Statute · Explicit · High
ND-004. N.D. Admin. Code ch. 32-03-01; NDBON practice guidance (2026-01)
Med spa: no med-spa-specific statute located. Cosmetology board establishment rules require establishments or licensees performing nonablative laser procedures to keep a written laser safety program consistent with ANSI Z136.3 (N.D. Admin. Code 32-03-01); Board of Nursing practice guidance (Jan. 2026) addresses nurses in retail aesthetic settings.
Regulation + agency guidance · Explicit · Medium · Med spa pass, final phase part 2 (2026-10-22). Official rule text read 2026-10-22 (V-065); nursing guidance not read in full.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All