What a provider can and can't say in Oklahoma
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 59 O.S. 509(3) (detriment element); no board order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Partly: dental grounds not read | 59 O.S. 509(3) (detriment element); no board order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 59 O.S. 509(3) (detriment element); no board order located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 59 O.S. 509(3) (detriment element); no board order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 59 O.S. 509(3) (detriment element); no board order located |
- Consumer privacy and health data law: Oklahoma has enacted a consumer privacy law that is not yet in effect (SB 546, eff. 2027-01-01); it binds no one until its effective date. Once effective, it exempts HIPAA-covered practices as a whole (an entity-level exemption). [OK-001]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: attorney general within 60 days unless fewer than 500 residents affected; HIPAA-compliant deemed compliant only if attorney general notified. [OK-002]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules. [OK-003]
- Patient confidentiality duties: The board can discipline betraying a professional secret to a patient's detriment (59 O.S. 509(3)). [OK-003]
- Lawsuits by individuals: No private right of action was located in the statutes reviewed (None under breach law); other claims, such as privacy torts, may still exist. [OK-002, U-98]
- Research notes and gaps: Oklahoma has a reported likeness statute (12 O.S. 1449), but its text was not read in this research (a gap). [U-98]
- Med spa rules: Med spas: only agency guidance was found (osteopathic policy); the binding rules are the general professional practice acts. [OK-004, OK-005]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2) (Larson: allegations only). Not finding enforcement does not mean none exists. [OK-005]
Sources:
- [OK-001] Okla. SB 546 (2026), secs. 13-16, 22 (https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF)
- [OK-002] 24 O.S. 162-165 as amended by SB 626 (2025) 163(E), 164(B)(2), 165(B)-(C) (https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF)
- [OK-003] 59 O.S. 509(3) (https://www.oscn.net/applications/oscn/DeliverDocument.asp?CiteID=439941)
- [OK-004] OSBOE-P004 Policy for Osteopathic Medical Spas (https://oklahoma.gov/content/dam/ok/en/osboe/documents/policy/OSBOE-P004%20Policy%20for%20Osteopathic%20Medical%20Spas.pdf)
- [OK-005] State ex rel. OSBMLS v. Adam Lyman Larson, M.D., No. 24-03-6301 (https://secure.okmedicalboard.org/subscriber/disc_pdfs/39461_2024_07_30_Adam_Larson_MD.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Oklahoma (OK) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | 59 O.S. 509(3) willfully betraying a professional secret to the patient's detriment | Yes - applies to licensed providers regardless of HIPAA status | SB 546 (2026): enacted, NOT yet effective (2027-01-01); ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50% | 24 O.S. 161+ (SB 626, eff. 2026-01-01): medical info NOT covered; AG within 60 days unless fewer than 500 residents (1,000 for breaches of credit-bureau systems); HIPAA-compliant entities deemed compliant only if they also notify the AG | 59 O.S. 509(3) (detriment element); no board order located | HIPAA if covered; 509(3); publicity statute 12 O.S. 1449 not read | 12 O.S. 1449 (living persons; not read) | None located under breach law (AG/DA exclusive) | OSBMLS, Board of Osteopathic Examiners, Board of Dentistry, Board of Nursing, AG | Breach: up to $150,000 per breach; SB 546 up to $7,500/violation (from 2027) | E2 med spa delegation (OSBMLS v. Larson 2024, allegations) | Medium-High | 2026-10-22 |
| Oklahoma (OK) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | 59 O.S. 509(3) willfully betraying a professional secret to the patient's detriment | Partly: dental grounds not read | SB 546 (2026): enacted, NOT yet effective (2027-01-01); ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50% | 24 O.S. 161+ (SB 626, eff. 2026-01-01): medical info NOT covered; AG within 60 days unless fewer than 500 residents (1,000 for breaches of credit-bureau systems); HIPAA-compliant entities deemed compliant only if they also notify the AG | 59 O.S. 509(3) (detriment element); no board order located | HIPAA if covered; 509(3); publicity statute 12 O.S. 1449 not read | 12 O.S. 1449 (living persons; not read) | None located under breach law (AG/DA exclusive) | OSBMLS, Board of Osteopathic Examiners, Board of Dentistry, Board of Nursing, AG | Breach: up to $150,000 per breach; SB 546 up to $7,500/violation (from 2027) | E2 med spa delegation (OSBMLS v. Larson 2024, allegations) | Medium-High | 2026-10-22 |
| Oklahoma (OK) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | 59 O.S. 509(3) willfully betraying a professional secret to the patient's detriment | Yes - applies to licensed providers regardless of HIPAA status | SB 546 (2026): enacted, NOT yet effective (2027-01-01); ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50% | 24 O.S. 161+ (SB 626, eff. 2026-01-01): medical info NOT covered; AG within 60 days unless fewer than 500 residents (1,000 for breaches of credit-bureau systems); HIPAA-compliant entities deemed compliant only if they also notify the AG | 59 O.S. 509(3) (detriment element); no board order located | HIPAA if covered; 509(3); publicity statute 12 O.S. 1449 not read | 12 O.S. 1449 (living persons; not read) | None located under breach law (AG/DA exclusive) | OSBMLS, Board of Osteopathic Examiners, Board of Dentistry, Board of Nursing, AG | Breach: up to $150,000 per breach; SB 546 up to $7,500/violation (from 2027) | E2 med spa delegation (OSBMLS v. Larson 2024, allegations) | Medium-High | 2026-10-22 |
| Oklahoma (OK) | Medical med spa | Depends; cash-only med spas often not covered | 59 O.S. 509(3) willfully betraying a professional secret to the patient's detriment | Yes - applies to licensed providers regardless of HIPAA status | SB 546 (2026): enacted, NOT yet effective (2027-01-01); ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50% | 24 O.S. 161+ (SB 626, eff. 2026-01-01): medical info NOT covered; AG within 60 days unless fewer than 500 residents (1,000 for breaches of credit-bureau systems); HIPAA-compliant entities deemed compliant only if they also notify the AG | 59 O.S. 509(3) (detriment element); no board order located | HIPAA if covered; 509(3); publicity statute 12 O.S. 1449 not read | 12 O.S. 1449 (living persons; not read) | None located under breach law (AG/DA exclusive) | OSBMLS, Board of Osteopathic Examiners, Board of Dentistry, Board of Nursing, AG | Breach: up to $150,000 per breach; SB 546 up to $7,500/violation (from 2027) | E2 med spa delegation (OSBMLS v. Larson 2024, allegations) | Medium-High | 2026-10-22 |
| Oklahoma (OK) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | 59 O.S. 509(3) willfully betraying a professional secret to the patient's detriment | No | SB 546 (2026): enacted, NOT yet effective (2027-01-01); ENTITY-level HIPAA CE/BA exemption; 100k / 25k+50% | 24 O.S. 161+ (SB 626, eff. 2026-01-01): medical info NOT covered; AG within 60 days unless fewer than 500 residents (1,000 for breaches of credit-bureau systems); HIPAA-compliant entities deemed compliant only if they also notify the AG | 59 O.S. 509(3) (detriment element); no board order located | HIPAA if covered; 509(3); publicity statute 12 O.S. 1449 not read | 12 O.S. 1449 (living persons; not read) | None located under breach law (AG/DA exclusive) | OSBMLS, Board of Osteopathic Examiners, Board of Dentistry, Board of Nursing, AG | Breach: up to $150,000 per breach; SB 546 up to $7,500/violation (from 2027) | E2 med spa delegation (OSBMLS v. Larson 2024, allegations) | Medium-High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
State ex rel. Oklahoma State Board of Medical Licensure and Supervision v. Adam Lyman Larson, M.D.
Oklahoma State Board of Medical Licensure and Supervision · OK (state licensing) · 2024-07-30
- Provider type
- Physician (med spa medical director)
- Relevant facts
- ALLEGED (reciprocal, based on Utah stipulation): let RNs perform non-ablative cosmetic procedures without required supervision; missing standing orders for Botox, fillers, IV drips and ketamine
- Legal issues
- Unprofessional conduct; reciprocal discipline
- Holding, findings, allegations or settlement terms
- Allegations only (complaint)
- Consequences recorded
- None located
- Procedural status
- Pending/unknown
- Precedential?
- No
- Why it is in this research
- Med spa delegation and supervision failures pursued by a second state board
Related pages
Topics
Healthcare industry
Sources
OK-001. Okla. SB 546 (2026), secs. 13-16, 22
Oklahoma SB 546 (2026), consumer data privacy act at 75A O.S. 300 et seq., approved 2026-03-20; enacted, NOT YET EFFECTIVE (effective January 1, 2027). Applies at 100,000 consumers, or 25,000 with over 50% of revenue from selling personal data. Exempts at ENTITY level HIPAA covered entities and business associates; PHI exempt data. Sensitive data (mental or physical health diagnosis; biometric) requires consent. AG must give 30 days' notice and cannot sue if cured with a written statement; civil penalty up to $7,500 per violation plus fees; no private right of action.
Statute (enrolled act) · Explicit · High · Cure right has no stated sunset in the text read.
https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF
OK-002. 24 O.S. 162-165 as amended by SB 626 (2025)
Security Breach Notification Act as amended by SB 626 (applies to breaches determined on or after January 1, 2026): medical information is still NOT covered (biometric data is). Entities must notify the AG without unreasonable delay and no later than 60 days after notifying residents, unless fewer than 500 residents are affected (or, for a credit bureau's system, fewer than 1,000). An entity that complies with HIPAA notification requirements is deemed compliant with resident-notice duties if it also gives the AG notice. The AG or a district attorney has exclusive enforcement: actual damages and a civil penalty up to $150,000 per breach; no civil penalty for an entity that used reasonable safeguards and gave notice; actual damages plus a $75,000 penalty for one that gave notice without reasonable safeguards.
Statute (enrolled act) · Explicit · High · CORRECTED 2026-10-22 against the enrolled bill (V-043): the earlier text described a credit-bureau notice threshold at 1,000 (the 1,000 figure applies to breaches of credit-bureau systems) and omitted the AG-notice condition on HIPAA deeming. Maximums, not typical.
https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF
OK-003. 59 O.S. 509(3)
Allopathic unprofessional conduct includes 'willfully betraying a professional secret to the detriment of the patient'.
Statute · Explicit · High · 'To the detriment of the patient' element narrows the ground.
https://www.oscn.net/applications/oscn/DeliverDocument.asp?CiteID=439941
OK-004. OSBOE-P004 Policy for Osteopathic Medical Spas
State Board of Osteopathic Examiners Policy OSBOE-P004 (adopted 2025-09-18): DOs supervising a med spa must hold a full unrestricted license, actively supervise, establish a physician-patient relationship with an initial evaluation (by the DO or a supervised PA/APRN), require treatment plans; RNs may treat under general supervision, but LPNs, estheticians, micropigmentologists, medical assistants and unlicensed assistants require direct supervision with the physician physically available before, during and after treatment.
Guidance (board policy) · Explicit · High · Policy, not a rule; MD board (OSBMLS) counterpart not located (U-77).
OK-005. State ex rel. OSBMLS v. Adam Lyman Larson, M.D., No. 24-03-6301
OSBMLS verified complaint (2024-07-30) ALLEGES reciprocal grounds based on a Utah surrender: as med spa medical director the physician allegedly let RNs perform non-ablative cosmetic procedures without required supervision and failed to keep standing orders for Botox, fillers and IV drips.
Enforcement (licensing; complaint = allegations) · Explicit (complaint read) · High · Allegations; outcome not located. Delegation, not privacy.
https://secure.okmedicalboard.org/subscriber/disc_pdfs/39461_2024_07_30_Adam_Larson_MD.pdf
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All