What a provider can and can't say in Ohio
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 4731.22(B)(4); Desai consent agreement 2026 (review-retaliation post sanctioned); Biddle tort |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Partly: Biddle tort reaches physicians/hospitals; no dental confidentiality ground located in 4715.30 | 4731.22(B)(4); Desai consent agreement 2026 (review-retaliation post sanctioned); Biddle tort |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 4731.22(B)(4); Desai consent agreement 2026 (review-retaliation post sanctioned); Biddle tort |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 4731.22(B)(4); Desai consent agreement 2026 (review-retaliation post sanctioned); Biddle tort |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 4731.22(B)(4); Desai consent agreement 2026 (review-retaliation post sanctioned); Biddle tort |
- Consumer privacy and health data law: Ohio has no comprehensive consumer privacy law in force as of October 22, 2026. Status of proposals: HB 376 not enacted (official status unverifiable). Bills are not law. [OH-007]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). [OH-005]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules and tort (Biddle). [OH-001, OH-004]
- Patient confidentiality duties: The licensing board can discipline willful breaches of patient confidentiality (4731.22(B)(4)). [OH-001]
- Lawsuits by individuals: Patients may be able to sue in some situations (Biddle; 2741.07). [OH-004, OH-008]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (ch. 2741: written consent; $2,500-$10,000 statutory damages). [OH-008]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures. [OH-006]
- Enforcement located: Strongest state enforcement evidence located: official enforcement against comparable conduct (E1) (State Medical Board, Desai). Not finding enforcement does not mean none exists. [OH-002, OH-003]
Sources:
- [OH-001] Ohio Rev. Code 4731.22(B)(4) (https://codes.ohio.gov/ohio-revised-code/section-4731.22)
- [OH-002] In re Sonia Praful Desai, M.D. (#35.125659CTR) Formal Action Report, Consent Agreements (https://dam.assets.ohio.gov/image/upload/med.ohio.gov/laws-and-regulations/MFAL/2026/September_MFAL.pdf)
- [OH-003] In re Vivek Bhalla, M.D. (#35.093869) Formal Action Report, Citations (https://dam.assets.ohio.gov/image/upload/med.ohio.gov/laws-and-regulations/MFAL/2026/April_2026_MFAL.pdf)
- [OH-004] Biddle v. Warren Gen. Hosp., 86 Ohio St.3d 395, 1999-Ohio-115 Syllabus paras. 1-3 (https://www.supremecourt.ohio.gov/rod/docs/pdf/0/1999/1999-ohio-115.pdf)
- [OH-005] Ohio Rev. Code 1349.19(A)(7), (B)(2) (https://codes.ohio.gov/ohio-revised-code/section-1349.19)
- [OH-006] Ohio Admin. Code 4731-18-01 to -04; Ohio Rev. Code 4731.33 (https://codes.ohio.gov/ohio-revised-code/section-4731.33)
- [OH-007] n/a (https://www.legislature.ohio.gov/)
- [OH-008] ORC 2741.02(A)-(B); 2741.07(A)(1) (https://codes.ohio.gov/ohio-revised-code/section-2741.02)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Ohio (OH) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | No general records-confidentiality statute located; Medical Board ground 4731.22(B)(4) (willful betrayal of confidence); Biddle tort | Yes - applies to licensed providers regardless of HIPAA status | None in force (HB 376 not enacted) | 1349.19: medical info NOT covered; not later than 45 days; 1354 cybersecurity affirmative defense | 4731.22(B)(4); Desai consent agreement 2026 (review-retaliation post sanctioned); Biddle tort | HIPAA if covered; 4731.22(B)(4) and Biddle for unauthorized disclosure; ORC 2741.02 written consent for commercial use of persona | ORC ch. 2741: prior written consent for commercial use of persona; actual damages or $2,500-$10,000 statutory damages (official text read 2026-10-22) | Yes: Biddle tort (common law); none under breach law | State Medical Board, State Dental Board, Board of Nursing, AG | Board fines (Desai $4,000; statutory maximum not verified); license discipline | E1 (Ohio Medical Board, Desai 2026: retaliatory review post; reprimand, probation, $4,000) | High | 2026-10-22 |
| Ohio (OH) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | No general records-confidentiality statute located; Medical Board ground 4731.22(B)(4) (willful betrayal of confidence); Biddle tort | Partly: Biddle tort reaches physicians/hospitals; no dental confidentiality ground located in 4715.30 | None in force (HB 376 not enacted) | 1349.19: medical info NOT covered; not later than 45 days; 1354 cybersecurity affirmative defense | 4731.22(B)(4); Desai consent agreement 2026 (review-retaliation post sanctioned); Biddle tort | HIPAA if covered; 4731.22(B)(4) and Biddle for unauthorized disclosure; ORC 2741.02 written consent for commercial use of persona | ORC ch. 2741: prior written consent for commercial use of persona; actual damages or $2,500-$10,000 statutory damages (official text read 2026-10-22) | Yes: Biddle tort (common law); none under breach law | State Medical Board, State Dental Board, Board of Nursing, AG | Board fines (Desai $4,000; statutory maximum not verified); license discipline | E1 (Ohio Medical Board, Desai 2026: retaliatory review post; reprimand, probation, $4,000) | High | 2026-10-22 |
| Ohio (OH) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | No general records-confidentiality statute located; Medical Board ground 4731.22(B)(4) (willful betrayal of confidence); Biddle tort | Yes - applies to licensed providers regardless of HIPAA status | None in force (HB 376 not enacted) | 1349.19: medical info NOT covered; not later than 45 days; 1354 cybersecurity affirmative defense | 4731.22(B)(4); Desai consent agreement 2026 (review-retaliation post sanctioned); Biddle tort | HIPAA if covered; 4731.22(B)(4) and Biddle for unauthorized disclosure; ORC 2741.02 written consent for commercial use of persona | ORC ch. 2741: prior written consent for commercial use of persona; actual damages or $2,500-$10,000 statutory damages (official text read 2026-10-22) | Yes: Biddle tort (common law); none under breach law | State Medical Board, State Dental Board, Board of Nursing, AG | Board fines (Desai $4,000; statutory maximum not verified); license discipline | E1 (Ohio Medical Board, Desai 2026: retaliatory review post; reprimand, probation, $4,000) | High | 2026-10-22 |
| Ohio (OH) | Medical med spa | Depends; cash-only med spas often not covered | No general records-confidentiality statute located; Medical Board ground 4731.22(B)(4) (willful betrayal of confidence); Biddle tort | Yes - applies to licensed providers regardless of HIPAA status | None in force (HB 376 not enacted) | 1349.19: medical info NOT covered; not later than 45 days; 1354 cybersecurity affirmative defense | 4731.22(B)(4); Desai consent agreement 2026 (review-retaliation post sanctioned); Biddle tort | HIPAA if covered; 4731.22(B)(4) and Biddle for unauthorized disclosure; ORC 2741.02 written consent for commercial use of persona | ORC ch. 2741: prior written consent for commercial use of persona; actual damages or $2,500-$10,000 statutory damages (official text read 2026-10-22) | Yes: Biddle tort (common law); none under breach law | State Medical Board, State Dental Board, Board of Nursing, AG | Board fines (Desai $4,000; statutory maximum not verified); license discipline | E1 (Ohio Medical Board, Desai 2026: retaliatory review post; reprimand, probation, $4,000) | High | 2026-10-22 |
| Ohio (OH) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No general records-confidentiality statute located; Medical Board ground 4731.22(B)(4) (willful betrayal of confidence); Biddle tort | No | None in force (HB 376 not enacted) | 1349.19: medical info NOT covered; not later than 45 days; 1354 cybersecurity affirmative defense | 4731.22(B)(4); Desai consent agreement 2026 (review-retaliation post sanctioned); Biddle tort | HIPAA if covered; 4731.22(B)(4) and Biddle for unauthorized disclosure; ORC 2741.02 written consent for commercial use of persona | ORC ch. 2741: prior written consent for commercial use of persona; actual damages or $2,500-$10,000 statutory damages (official text read 2026-10-22) | Yes: Biddle tort (common law); none under breach law | State Medical Board, State Dental Board, Board of Nursing, AG | Board fines (Desai $4,000; statutory maximum not verified); license discipline | E1 (Ohio Medical Board, Desai 2026: retaliatory review post; reprimand, probation, $4,000) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
State Medical Board of Ohio: Sonia Praful Desai, M.D.
State Medical Board of Ohio · OH (state licensing) · 2026-09-09
- Provider type
- Physician (specialty not stated)
- Relevant facts
- After a patient posted a negative review of the doctor, the doctor publicly posted a negative review of the patient without permission (per Board summary)
- Legal issues
- Ohio Rev. Code 4731.22(B)(4) willfully betraying a professional confidence; code-of-ethics violation
- Holding, findings, allegations or settlement terms
- Consent agreement based on the doctor's admission
- Consequences recorded
- Reprimand; probation; ethics and boundaries courses; $4,000 fine
- Procedural status
- Final (consent agreement; terms per Board summary)
- Precedential?
- No
- Why it is in this research
- Direct: a retaliatory reply to a reviewer was sanctioned as a confidentiality breach
State Medical Board of Ohio: Vivek Bhalla, M.D. (citation)
State Medical Board of Ohio · OH (state licensing) · 2026-04-08
- Provider type
- Physician (specialty not stated)
- Relevant facts
- ALLEGED: texted screenshots of a patient's PHI to the patient's neighbor; guilty plea to nonconsensual dissemination of private sexual images
- Legal issues
- Ohio Rev. Code 4731.22(B)(4); felony plea ground
- Holding, findings, allegations or settlement terms
- Allegations only (citation)
- Consequences recorded
- None yet located
- Procedural status
- Pending. No final action in the May to September 2026 Formal Action Reports (V-023). Allegations only.
- Precedential?
- No
- Why it is in this research
- Board charges texting PHI to a neighbor as betrayal of confidence
Biddle v. Warren General Hospital
Supreme Court of Ohio · OH · 1999-09-15
- Provider type
- Hospital and its law firm
- Relevant facts
- Hospital released patient registration records to a law firm to screen for SSI eligibility without consent
- Legal issues
- Independent tort of unauthorized, unprivileged disclosure of nonpublic medical information; third-party inducement
- Holding, findings, allegations or settlement terms
- Judicial holding (syllabus paras. 1-3): tort recognized; privilege only for statutory/common-law duty or overriding interest
- Consequences recorded
- n/a (remanded on liability issues)
- Procedural status
- Final (precedent)
- Precedential?
- Yes (state supreme court)
- Why it is in this research
- Private tort exposure in Ohio for disclosing patient information in a review reply (application inferred)
Related pages
Topics
Sources
OH-007. n/a
Ohio has no comprehensive consumer privacy law in force; the Ohio Personal Privacy Act (HB 376) was not enacted.
Search result (negative) · Per secondary tracker · Medium · Bill status from secondary sources.
OH-005. Ohio Rev. Code 1349.19(A)(7), (B)(2)
Breach law: 'personal information' = name plus SSN, driver's license/state ID, or financial account with code; medical information is NOT covered. Notice in the most expedient time possible but not later than 45 days.
Statute · Explicit · High · Ohio's Data Protection Act (1354.01-.05) gives an affirmative defense to data-breach tort claims for a written cybersecurity program that reasonably conforms to a recognized framework (1354.02).
OH-001. Ohio Rev. Code 4731.22(B)(4)
Medical Board grounds include 'willfully betraying a professional confidence' (with statutory exclusions for child fatality and similar review boards) and violating a code of ethics of the AMA or another national professional organization the Board specifies.
Statute · Explicit · High · Applies to physicians, PAs (by cross-reference, not verified) and other Medical Board licensees. No explicit confidentiality ground located in the dental statute 4715.30.
OH-004. Biddle v. Warren Gen. Hosp., 86 Ohio St.3d 395, 1999-Ohio-115
Ohio Supreme Court: an independent tort exists for the unauthorized, unprivileged disclosure to a third party of nonpublic medical information a physician or hospital learned within the physician-patient relationship; disclosure without authorization is privileged only where required by statute or common-law duty, or necessary to protect a countervailing interest that outweighs confidentiality; third parties who induce disclosure can be liable.
Judicial decision · Explicit (opinion read) · High · Private exposure for review replies disclosing patient information (application inferred). Reputation defense is not a listed privilege.
https://www.supremecourt.ohio.gov/rod/docs/pdf/0/1999/1999-ohio-115.pdf
OH-008. ORC 2741.02(A)-(B); 2741.07(A)(1)
Right of publicity: no one may use any aspect of an individual's persona for a commercial purpose during life (and 60 years after death) without prior written consent (ORC 2741.02). A violator is liable for actual damages including attributable profits or, at the plaintiff's election, statutory damages of $2,500 to $10,000, plus possible punitive damages (2741.07).
Statute · Explicit · High · Applies to any business, including nonmedical aesthetics and med spas using client images in advertising (application inferred). Exceptions in 2741.02(D) and 2741.09 not read. Added 2026-10-22 (V-051).
OH-006. Ohio Admin. Code 4731-18-01 to -04; Ohio Rev. Code 4731.33
Light-based medical devices: applying them is the practice of medicine; ablative procedures may not be delegated; non-ablative vascular laser procedures may be delegated only to a PA or nurse with 8 hours of education, 15 observed and 20 directly overseen procedures, and the physician must see the patient before and after the first treatment. Laser hair removal may be delegated only to a PA, nurse or 'laser hair removal professional' meeting training criteria (statute effective 2026-08-26).
Regulation; Statute · Explicit · High · Binding med spa / delegation rules for lasers. Injectables delegation not researched (U-62).
OH-002. In re Sonia Praful Desai, M.D. (#35.125659CTR)
State Medical Board of Ohio consent agreement (effective 2026-09-09): a physician who 'publicly posted a negative review of a patient without permission after that patient had posted a negative review of the doctor' was reprimanded, placed on probation, required to take ethics and boundaries courses and fined $4,000; the Board treated the conduct as willfully betraying a professional confidence and a code-of-ethics violation, based on the doctor's admission.
Enforcement (licensing; consent agreement) · Explicit (official Board summary; agreement itself not read) · High · Closest official match yet to retaliation against a reviewer. Specialty and content of the post not stated in the summary (U-62).
OH-003. In re Vivek Bhalla, M.D. (#35.093869)
State Medical Board citation (notice of opportunity for hearing, 2026-04-08) ALLEGES a physician texted screenshots of a patient's PHI to the patient's neighbor, and cites a guilty plea to nonconsensual dissemination of private sexual images; charged as willfully betraying a professional confidence and a felony plea.
Enforcement (licensing; citation = allegations) · Explicit (official summary) · High · Allegations only; outcome not located.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
V-023. V-023
This reference id is cited in the publication and is not a row in the claim register supplied with it.