Reputation MedicsReputation Medics™TRUST RESTORED

Last updated Oct 22, 2026

Oregon

This guide is general educational information, not legal advice, and it does not create a lawyer-client relationship. Laws change and their application depends on specific facts. It does not promise any outcome, including removal of any review, any settlement, fine or successful claim. Consult a qualified lawyer licensed in your state before acting.

What a provider can and can't say in Oregon

The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.

Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]

Review-response rule by practice type

Practice categoryHIPAA statusApplies without HIPAA?Review-response rule source
Cosmetic/plastic surgeryDepends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are notYes - applies to licensed providers regardless of HIPAA status677.190(5)/679.140(2)(b) bar disclosure without written consent; Humphers breach-of-confidence tort; no review exception
Cosmetic dentistryUsually yes if it files any electronic dental claims; cash-only dental is notYes - applies to licensed providers regardless of HIPAA status677.190(5)/679.140(2)(b) bar disclosure without written consent; Humphers breach-of-confidence tort; no review exception
General medical/dermatology (elective cosmetic)Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patientsYes - applies to licensed providers regardless of HIPAA status677.190(5)/679.140(2)(b) bar disclosure without written consent; Humphers breach-of-confidence tort; no review exception
Medical med spaDepends; cash-only med spas often not coveredYes - applies to licensed providers regardless of HIPAA status677.190(5)/679.140(2)(b) bar disclosure without written consent; Humphers breach-of-confidence tort; no review exception
Nonmedical aesthetic businessGenerally no (not a health care provider billing electronically)No (unless a licensed health care provider; ORS 192.556(5)(y) 'furnishes, bills for or is paid for health care' - reach to estheticians unresolved)677.190(5)/679.140(2)(b) bar disclosure without written consent; Humphers breach-of-confidence tort; no review exception
  • Consumer privacy and health data law: Oregon has a consumer privacy law in force (OCPA (sensitive data opt-in)). It exempts only HIPAA-protected health information (a data-level exemption), so a covered practice's other data, such as website or marketing data, can still fall under it. [OR-001, OR-002]
  • Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general if more than 250 residents affected (HIPAA entities send copy). [OR-005]
  • Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules and tort (Humphers) and ORS 192. [OR-007, OR-008, OR-010]
  • Patient confidentiality duties: Board rules treat disclosure without the patient's consent as misconduct (677.190(5)). [OR-008]
  • Lawsuits by individuals: Court decisions recognize patient privacy or confidentiality lawsuits in some situations (Humphers). [OR-010]
  • Photos, names and likeness: No likeness statute protecting living persons in advertising was located. [OR-002, U-98]
  • Med spa rules: Med spas: only agency guidance was found (OMB statements of philosophy; HLO injectables clarification); the binding rules are the general professional practice acts. [OR-012]
  • Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2) (Oregon Medical Board order). Not finding enforcement does not mean none exists. [OR-011]

Sources:

*Educational information, not legal advice. Last reviewed October 22, 2026.*

State comparison

All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.

Cosmetic and aesthetic privacy comparison for 50 states and the District of Columbia, current as of Oct 22, 2026
Oregon (OR)Cosmetic/plastic surgeryDepends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are notORS 677.190(5) (physicians: no divulging professional secret without written consent); ORS 679.140(2)(b) (dentists); ORS 192.553-.581 (PHI tied to Oregon 'covered entity'); Humphers tortYes - applies to licensed providers regardless of HIPAA statusOCPA (ORS 646A.570-.589): DATA-level PHI exemption only; sensitive data (health condition, biometric) needs consent; thresholds 100k / 25k+25%ORS 646A.604: medical info covered; 45 days; AG if >250; HIPAA-compliant exempt but must send AG copy if >250677.190(5)/679.140(2)(b) bar disclosure without written consent; Humphers breach-of-confidence tort; no review exceptionWritten consent (677.190(5)); ORS 192.556 authorization if Oregon covered entity; OCPA consent for sensitive data; HIPAA if coveredNone located (common-law appropriation recognized, Hinish v. Meier & Frank, 1941)Yes: Humphers breach-of-confidence tort; none under OCPA (646A.589(7)) or ORS 192.571Oregon Medical Board, Board of Dentistry, Board of Nursing, Health Licensing Office (estheticians), DOJ (AG), DCBSOCPA up to $7,500/violation; breach: DCBS up to $1,000/violation, $500,000/occurrence; license disciplineE2 (OMB 2010 stipulated order after alleged divulging of professional secret; OR DOJ OCPA cure letters); E1 federal OCR cases elsewhereHigh2026-10-22
Oregon (OR)Cosmetic dentistryUsually yes if it files any electronic dental claims; cash-only dental is notORS 677.190(5) (physicians: no divulging professional secret without written consent); ORS 679.140(2)(b) (dentists); ORS 192.553-.581 (PHI tied to Oregon 'covered entity'); Humphers tortYes - applies to licensed providers regardless of HIPAA statusOCPA (ORS 646A.570-.589): DATA-level PHI exemption only; sensitive data (health condition, biometric) needs consent; thresholds 100k / 25k+25%ORS 646A.604: medical info covered; 45 days; AG if >250; HIPAA-compliant exempt but must send AG copy if >250677.190(5)/679.140(2)(b) bar disclosure without written consent; Humphers breach-of-confidence tort; no review exceptionWritten consent (677.190(5)); ORS 192.556 authorization if Oregon covered entity; OCPA consent for sensitive data; HIPAA if coveredNone located (common-law appropriation recognized, Hinish v. Meier & Frank, 1941)Yes: Humphers breach-of-confidence tort; none under OCPA (646A.589(7)) or ORS 192.571Oregon Medical Board, Board of Dentistry, Board of Nursing, Health Licensing Office (estheticians), DOJ (AG), DCBSOCPA up to $7,500/violation; breach: DCBS up to $1,000/violation, $500,000/occurrence; license disciplineE2 (OMB 2010 stipulated order after alleged divulging of professional secret; OR DOJ OCPA cure letters); E1 federal OCR cases elsewhereHigh2026-10-22
Oregon (OR)General medical/dermatology (elective cosmetic)Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patientsORS 677.190(5) (physicians: no divulging professional secret without written consent); ORS 679.140(2)(b) (dentists); ORS 192.553-.581 (PHI tied to Oregon 'covered entity'); Humphers tortYes - applies to licensed providers regardless of HIPAA statusOCPA (ORS 646A.570-.589): DATA-level PHI exemption only; sensitive data (health condition, biometric) needs consent; thresholds 100k / 25k+25%ORS 646A.604: medical info covered; 45 days; AG if >250; HIPAA-compliant exempt but must send AG copy if >250677.190(5)/679.140(2)(b) bar disclosure without written consent; Humphers breach-of-confidence tort; no review exceptionWritten consent (677.190(5)); ORS 192.556 authorization if Oregon covered entity; OCPA consent for sensitive data; HIPAA if coveredNone located (common-law appropriation recognized, Hinish v. Meier & Frank, 1941)Yes: Humphers breach-of-confidence tort; none under OCPA (646A.589(7)) or ORS 192.571Oregon Medical Board, Board of Dentistry, Board of Nursing, Health Licensing Office (estheticians), DOJ (AG), DCBSOCPA up to $7,500/violation; breach: DCBS up to $1,000/violation, $500,000/occurrence; license disciplineE2 (OMB 2010 stipulated order after alleged divulging of professional secret; OR DOJ OCPA cure letters); E1 federal OCR cases elsewhereHigh2026-10-22
Oregon (OR)Medical med spaDepends; cash-only med spas often not coveredORS 677.190(5) (physicians: no divulging professional secret without written consent); ORS 679.140(2)(b) (dentists); ORS 192.553-.581 (PHI tied to Oregon 'covered entity'); Humphers tortYes - applies to licensed providers regardless of HIPAA statusOCPA (ORS 646A.570-.589): DATA-level PHI exemption only; sensitive data (health condition, biometric) needs consent; thresholds 100k / 25k+25%ORS 646A.604: medical info covered; 45 days; AG if >250; HIPAA-compliant exempt but must send AG copy if >250677.190(5)/679.140(2)(b) bar disclosure without written consent; Humphers breach-of-confidence tort; no review exceptionWritten consent (677.190(5)); ORS 192.556 authorization if Oregon covered entity; OCPA consent for sensitive data; HIPAA if coveredNone located (common-law appropriation recognized, Hinish v. Meier & Frank, 1941)Yes: Humphers breach-of-confidence tort; none under OCPA (646A.589(7)) or ORS 192.571Oregon Medical Board, Board of Dentistry, Board of Nursing, Health Licensing Office (estheticians), DOJ (AG), DCBSOCPA up to $7,500/violation; breach: DCBS up to $1,000/violation, $500,000/occurrence; license disciplineE2 (OMB 2010 stipulated order after alleged divulging of professional secret; OR DOJ OCPA cure letters); E1 federal OCR cases elsewhereHigh2026-10-22
Oregon (OR)Nonmedical aesthetic businessGenerally no (not a health care provider billing electronically)ORS 677.190(5) (physicians: no divulging professional secret without written consent); ORS 679.140(2)(b) (dentists); ORS 192.553-.581 (PHI tied to Oregon 'covered entity'); Humphers tortNo (unless a licensed health care provider; ORS 192.556(5)(y) 'furnishes, bills for or is paid for health care' - reach to estheticians unresolved)OCPA (ORS 646A.570-.589): DATA-level PHI exemption only; sensitive data (health condition, biometric) needs consent; thresholds 100k / 25k+25%ORS 646A.604: medical info covered; 45 days; AG if >250; HIPAA-compliant exempt but must send AG copy if >250677.190(5)/679.140(2)(b) bar disclosure without written consent; Humphers breach-of-confidence tort; no review exceptionWritten consent (677.190(5)); ORS 192.556 authorization if Oregon covered entity; OCPA consent for sensitive data; HIPAA if coveredNone located (common-law appropriation recognized, Hinish v. Meier & Frank, 1941)Yes: Humphers breach-of-confidence tort; none under OCPA (646A.589(7)) or ORS 192.571Oregon Medical Board, Board of Dentistry, Board of Nursing, Health Licensing Office (estheticians), DOJ (AG), DCBSOCPA up to $7,500/violation; breach: DCBS up to $1,000/violation, $500,000/occurrence; license disciplineE2 (OMB 2010 stipulated order after alleged divulging of professional secret; OR DOJ OCPA cure letters); E1 federal OCR cases elsewhereHigh2026-10-22

Cases this research tied to this jurisdiction

Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.

Humphers v. First Interstate Bank of Oregon

Supreme Court of Oregon · OR · 1985-03-06

Provider type
Physician (obstetrics)
Relevant facts
Physician gave an adoptee a false letter that let her obtain the birth mother's sealed hospital records
Legal issues
Breach of confidence vs. invasion of privacy; source of physician's duty (ORS 677.190(5))
Holding, findings, allegations or settlement terms
Holding: breach-of-confidence claim may proceed; duty and defenses come from the external legal source; intrusion-type privacy claim rejected
Consequences recorded
None in opinion (remanded for trial)
Procedural status
Remanded 1985; later history not verified
Precedential?
Yes (Oregon Supreme Court)
Why it is in this research
Private tort exposure in OR for any disclosure of patient information, including review replies (application inferred)

Primary source

Oregon Medical Board: Peter S. Morey, MD (MD24236)

Oregon Medical Board · OR (state licensing) · 2010-07-08

Provider type
Physician (psychiatry)
Relevant facts
Notice alleged unprofessional conduct, divulging a professional secret without written consent, and gross or repeated negligence
Legal issues
ORS 677.190(1), (5), (13)
Holding, findings, allegations or settlement terms
Allegations (Notice); stipulated order: surrender while under investigation; no findings stated in board summary
Consequences recorded
License surrendered; reprimand; fine (amount not stated); 2-year bar on reapplying
Procedural status
Final (stipulated order)
Precedential?
No
Why it is in this research
Board discipline for confidentiality breaches exists in OR; not an aesthetics or review case

Primary source

Oregon DOJ OCPA cure-notice program (first year)

Oregon Department of Justice (Privacy Unit) · OR (state AG) · 2025-08

Provider type
Various (mostly data brokers, social media)
Relevant facts
214 complaints; 39 not pursued because data or entities were exempt (e.g., HIPAA data); 38 cure matters opened and closed
Legal issues
OCPA notice, rights-request and exemption issues
Holding, findings, allegations or settlement terms
Cure letters (no findings, no penalties)
Consequences recorded
None reported
Procedural status
Ongoing program; cure period ended 2026-01-01
Precedential?
No
Why it is in this research
Shows HIPAA-covered data is screened out of OCPA; non-HIPAA aesthetic businesses are not

Primary source

Oregon Health & Science University (right of access CMP)

HHS OCR · OR (federal action) · 2025-03-06

Provider type
Academic medical center
Relevant facts
Personal representative did not receive complete records until Aug. 2021 after a 2019 request
Legal issues
HIPAA right of access (45 CFR 164.524)
Holding, findings, allegations or settlement terms
Civil money penalty (not a judicial finding)
Consequences recorded
$200,000
Procedural status
Final CMP (per HHS release)
Precedential?
No
Why it is in this research
Federal penalties do reach Oregon providers; not a disclosure or review case

Primary source

Related pages

Topics

Reference

Healthcare industry

Sources

  1. OR-001. ORS 646A.572

    OCPA applies to persons controlling/processing personal data of 100,000+ Oregon consumers (or 25,000+ with 25%+ revenue from sales). It exempts protected health information processed by a HIPAA covered entity or business associate under HIPAA, and intermingled HIPAA-regulated information, but has NO entity-level exemption for covered entities.

    Statute · Explicit · High · Data-level design: a covered cosmetic practice's non-PHI marketing or website data can be in scope if thresholds are met (inference). Most single-site practices likely fall below thresholds (inference).

    https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html

  2. OR-002. ORS 646A.570(3), (18); 646A.578

    OCPA 'sensitive data' includes data revealing a mental or physical condition or diagnosis, and genetic or biometric data; a controller may not process sensitive data without consent. Biometric data excludes photographs and facial mapping unless generated or used to identify a specific consumer.

    Statute · Explicit · High · Before/after photos are not 'biometric data' unless used to identify; they may still be personal or sensitive data if they reveal a condition (inference).

    https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html

  3. OR-005. ORS 646A.602(12)(a)(A)(vi)-(vii); 646A.604(1)-(3), (9)(d), (10)

    Breach law covers 'any information about a consumer's medical history or mental or physical condition or about a health care professional's medical diagnosis or treatment' and health insurance IDs; notice within 45 days; AG notice if more than 250 consumers; vendors notify within 10 days. HIPAA-compliant entities are exempt from the notice rules but must still send the AG a copy if more than 250 consumers are affected.

    Statute · Explicit · High

    https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html

  4. OR-007. ORS 192.556(1), (2), (5), (11); 192.558; 192.571

    ORS 192.553-.581: health care providers may use or disclose protected health information with an authorization (plain-language, with listed elements) or for treatment, payment and operations; 'protected health information' is defined as information maintained by an Oregon 'covered entity' (a provider that transmits health information electronically in covered transactions). ORS 192.571: no new private right of action.

    Statute · Explicit (text); reach to cash-only providers inferred · Medium-High · Because PHI is tied to the covered-entity test, this statute may add little for cash-only practices (inference, U-43).

    https://www.oregonlegislature.gov/bills_laws/ors/ors192.html

  5. OR-008. ORS 677.190(5)

    Physician discipline ground: 'Willfully or negligently divulging a professional secret without the written consent of the patient.'

    Statute · Explicit · High · Applies to licensees regardless of HIPAA status. Written consent required.

    https://www.oregonlegislature.gov/bills_laws/ors/ors677.html

  6. OR-010. Humphers v. First Interstate Bank, 298 Or. 706, 696 P.2d 527 (1985)

    Oregon Supreme Court: a physician may be liable in tort for breach of confidence; the duty is sourced in ORS 677.190(5), and defenses follow the same source. An invasion-of-privacy (intrusion) theory did not fit.

    Judicial decision · Explicit (opinion read in full) · High · Precedential. Supports private liability for review replies that disclose patient information, independent of HIPAA (application inferred).

    https://www.courtlistener.com/opinion/1177141/humphers-v-first-interstate-bank/

  7. OR-012. OMB Statements of Philosophy (Medical Spas; Medical Use of Lasers); HLO injectables clarification (2018-03-14)

    Med spa: no med-spa-specific statute located. Oregon Medical Board statements of philosophy (guidance) set out the responsibilities of medical spa medical directors and treat medical laser use as medicine; Health Licensing Office guidance says cosmetic injectables are outside esthetics licenses.

    Agency guidance · Explicit (guidance) · Medium · Med spa pass, final phase part 2 (2026-10-22). Guidance only; advanced esthetician rules (OAR 817) read only on a secondary host (V-066).

    https://www.oregon.gov/omb/board/Philosophy/Pages/Responsibilities-of-Medical-Directors-of-Medical-Spas.aspx

  8. OR-011. OMB license verification, MD24236 (Morey)

    Oregon Medical Board: physician license surrendered under a 2010 stipulated order (reprimand, fine) after a Notice alleging, among other things, divulging a professional secret without written consent.

    Enforcement (licensing; allegations + stipulated order) · Explicit (board summary) · Medium · Psychiatry, not aesthetics. The Notice states allegations; the stipulated order summary does not state findings.

    https://omb.oregon.gov/Clients/ORMB/Public/VerificationDetails.aspx?EntityID=1453573

  9. F-007. 45 CFR 164.502(a)

    Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.

    Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502

  10. F-024. HHS OCR resolution agreements

    OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).

    Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).

    https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html

  11. F-003. 45 CFR 160.103

    PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.

    Regulation · Explicit · High

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103

  12. U-98. U-98 · Open

    Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)

    High priority · All