Pending bills to recheck
- PA HB 78. As of Oct 22, 2026: HB 78 passed the House on 2025-10-01 and was in the Senate (tabled/removed 2026-10-06). It is not law.
What a provider can and can't say in Pennsylvania
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 16.61(a)(1) prior consent; no review exception |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Unverified (dental rule 33.211 has no confidentiality item) | 16.61(a)(1) prior consent; no review exception |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 16.61(a)(1) prior consent; no review exception |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 16.61(a)(1) prior consent; no review exception |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 16.61(a)(1) prior consent; no review exception |
- Consumer privacy and health data law: Pennsylvania has no comprehensive consumer privacy law in force as of October 22, 2026. Status of proposals: HB 78 passed House 2025-10-01; in Senate (tabled/removed 2026-10-06). Bills are not law. [PA-005]
- Data breach notification: Its data breach law covers only some health-related information (Partial (health insurance info only, except state agencies)). [PA-003]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board rules. [PA-001]
- Patient confidentiality duties: Board rules treat disclosure without the patient's consent as misconduct (49 Pa. Code 16.61(a)(1)). [PA-001]
- Lawsuits by individuals: Patients may be able to sue in some situations (8316). [PA-004]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (42 Pa.C.S. 8316). [PA-004]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (binding delegation rule). [PA-001, PA-002]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [PA-001, U-97]
- Research notes and gaps: Pennsylvania's consumer privacy bill (HB 78) is pending and is not law. [PA-005]
Sources:
- [PA-001] 49 Pa. Code 16.61(a)(1), (5), (14), (15) (https://www.pacodeandbulletin.gov/Display/pacode?file=/secure/pacode/data/049/chapter16/s16.61.html)
- [PA-002] 49 Pa. Code 18.402 (https://www.pacodeandbulletin.gov/Display/pacode?file=/secure/pacode/data/049/chapter18/s18.402.html)
- [PA-003] 73 P.S. 2302, 2303 (BPINA, as amended by Act 33 of 2024) (https://www.attorneygeneral.gov/protect-yourself/identity-theft/data-breaches/)
- [PA-004] 42 Pa.C.S. 8316 (https://www.legis.state.pa.us/WU01/LI/LI/CT/HTM/42/00.083.016.000..HTM)
- [PA-005] n/a (https://www.palegis.us/legislation/bills/2025/hb78)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Pennsylvania (PA) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | 49 Pa. Code 16.61(a)(1) (Board of Medicine: no revealing identifiable facts without prior consent) | Yes - applies to licensed providers regardless of HIPAA status | None in force (pending bills are not law) | BPINA: medical info only for state agencies/contractors; health insurance info covered for all; AG + CRAs if >500 | 16.61(a)(1) prior consent; no review exception | Prior consent (16.61(a)(1)); 42 Pa.C.S. 8316 written consent if likeness has commercial value; HIPAA if covered | 42 Pa.C.S. 8316 (commercial-value requirement) | Yes: 8316 (injunction, damages); none located for confidentiality statute | State Board of Medicine, State Board of Dentistry, State Board of Nursing, State Board of Cosmetology (DOS), AG | Breach via UTPCPL (not verified); license discipline | E4 | Medium-High (legislature site unavailable) | 2026-10-22 |
| Pennsylvania (PA) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | 49 Pa. Code 16.61(a)(1) (Board of Medicine: no revealing identifiable facts without prior consent) | Unverified (dental rule 33.211 has no confidentiality item) | None in force (pending bills are not law) | BPINA: medical info only for state agencies/contractors; health insurance info covered for all; AG + CRAs if >500 | 16.61(a)(1) prior consent; no review exception | Prior consent (16.61(a)(1)); 42 Pa.C.S. 8316 written consent if likeness has commercial value; HIPAA if covered | 42 Pa.C.S. 8316 (commercial-value requirement) | Yes: 8316 (injunction, damages); none located for confidentiality statute | State Board of Medicine, State Board of Dentistry, State Board of Nursing, State Board of Cosmetology (DOS), AG | Breach via UTPCPL (not verified); license discipline | E4 | Medium-High (legislature site unavailable) | 2026-10-22 |
| Pennsylvania (PA) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | 49 Pa. Code 16.61(a)(1) (Board of Medicine: no revealing identifiable facts without prior consent) | Yes - applies to licensed providers regardless of HIPAA status | None in force (pending bills are not law) | BPINA: medical info only for state agencies/contractors; health insurance info covered for all; AG + CRAs if >500 | 16.61(a)(1) prior consent; no review exception | Prior consent (16.61(a)(1)); 42 Pa.C.S. 8316 written consent if likeness has commercial value; HIPAA if covered | 42 Pa.C.S. 8316 (commercial-value requirement) | Yes: 8316 (injunction, damages); none located for confidentiality statute | State Board of Medicine, State Board of Dentistry, State Board of Nursing, State Board of Cosmetology (DOS), AG | Breach via UTPCPL (not verified); license discipline | E4 | Medium-High (legislature site unavailable) | 2026-10-22 |
| Pennsylvania (PA) | Medical med spa | Depends; cash-only med spas often not covered | 49 Pa. Code 16.61(a)(1) (Board of Medicine: no revealing identifiable facts without prior consent) | Yes - applies to licensed providers regardless of HIPAA status | None in force (pending bills are not law) | BPINA: medical info only for state agencies/contractors; health insurance info covered for all; AG + CRAs if >500 | 16.61(a)(1) prior consent; no review exception | Prior consent (16.61(a)(1)); 42 Pa.C.S. 8316 written consent if likeness has commercial value; HIPAA if covered | 42 Pa.C.S. 8316 (commercial-value requirement) | Yes: 8316 (injunction, damages); none located for confidentiality statute | State Board of Medicine, State Board of Dentistry, State Board of Nursing, State Board of Cosmetology (DOS), AG | Breach via UTPCPL (not verified); license discipline | E4 | Medium-High (legislature site unavailable) | 2026-10-22 |
| Pennsylvania (PA) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | 49 Pa. Code 16.61(a)(1) (Board of Medicine: no revealing identifiable facts without prior consent) | No | None in force (pending bills are not law) | BPINA: medical info only for state agencies/contractors; health insurance info covered for all; AG + CRAs if >500 | 16.61(a)(1) prior consent; no review exception | Prior consent (16.61(a)(1)); 42 Pa.C.S. 8316 written consent if likeness has commercial value; HIPAA if covered | 42 Pa.C.S. 8316 (commercial-value requirement) | Yes: 8316 (injunction, damages); none located for confidentiality statute | State Board of Medicine, State Board of Dentistry, State Board of Nursing, State Board of Cosmetology (DOS), AG | Breach via UTPCPL (not verified); license discipline | E4 | Medium-High (legislature site unavailable) | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Shen Smiles (Dr. Linda L. Shen)
HHS OCR · PA (federal action) · 2026-08-11 (press 2026-10-08)
- Provider type
- Dental
- Relevant facts
- Right of access, safeguards, policies
- Legal issues
- Privacy Rule access/safeguards (per OCR press release)
- Holding, findings, allegations or settlement terms
- Settlement after Notice of Proposed Determination; admission of liability: Not reviewed
- Consequences recorded
- $140,000; CAP
- Procedural status
- Closed: resolution agreement; CAP monitoring period (status not re-checked)
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Covered-entity status via electronic claims; access
Related pages
Topics
Sources
PA-005. n/a
Pennsylvania has no comprehensive consumer privacy law in force as of 2026-10-22. HB 78 (Consumer Data Privacy Act) passed the House on 2025-10-01 and, in the Senate, was re-reported as amended on 2026-06-24, given second consideration on 2026-06-25, and laid on and removed from the table on 2026-10-06; it has not passed the Senate or reached the Governor. Pending bills are not law.
Search result (negative) · Inferred from search · High · Official bill history read 2026-10-22 (V-028). Live bill late in session: re-check before publication.
PA-003. 73 P.S. 2302, 2303 (BPINA, as amended by Act 33 of 2024)
BPINA (amended by Act 33 of 2024, effective 2024-09-26): medical information counts as personal information only when held by a state agency or state agency contractor; health insurance information counts for all entities; AG notice concurrently if more than 500 residents, and consumer reporting agencies if more than 500.
Statute · Explicit (OAG page + search extract of act text) · Medium-High · Official legislature site unavailable (U-58). Penalties through UTPCPL (not verified).
https://www.attorneygeneral.gov/protect-yourself/identity-theft/data-breaches/
PA-001. 49 Pa. Code 16.61(a)(1), (5), (14), (15)
Board of Medicine unprofessional conduct includes 'revealing personally identifiable facts, obtained as the result of a practitioner-patient relationship, without the prior consent of the patient, except as authorized or required by statute'; also deceptive advertising, delegating to an unqualified person, and failing to supervise.
Regulation · Explicit · High · Prior consent required; no review exception. Dental 33.211 has no confidentiality item.
https://www.pacodeandbulletin.gov/Display/pacode?file=/secure/pacode/data/049/chapter16/s16.61.html
PA-004. 42 Pa.C.S. 8316
Statutory likeness right: a natural person whose name or likeness has commercial value may sue over unauthorized commercial or advertising use without written consent; injunction and damages.
Statute · Explicit (per search extract; site unavailable to fetch) · Medium · The 'commercial value' element may limit claims by ordinary patients (inference). Common-law appropriation also available (not researched).
https://www.legis.state.pa.us/WU01/LI/LI/CT/HTM/42/00.083.016.000..HTM
PA-002. 49 Pa. Code 18.402
Physician delegation: a physician may delegate a medical service only if the delegatee is competent, the patient is informed and does not object, and the physician remains responsible; no Pennsylvania med spa statute was located.
Regulation · Explicit · High · General rule; cosmetic-specific guidance not located (U-58).
https://www.pacodeandbulletin.gov/Display/pacode?file=/secure/pacode/data/049/chapter18/s18.402.html
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All