What a provider can and can't say in South Carolina
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 81-60(D) via 40-47-110(B)(13); Hedgepath (board reprimand reinstated); McCormick tort |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Unverified (no dental confidentiality ground located) | 81-60(D) via 40-47-110(B)(13); Hedgepath (board reprimand reinstated); McCormick tort |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 81-60(D) via 40-47-110(B)(13); Hedgepath (board reprimand reinstated); McCormick tort |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 81-60(D) via 40-47-110(B)(13); Hedgepath (board reprimand reinstated); McCormick tort |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 81-60(D) via 40-47-110(B)(13); Hedgepath (board reprimand reinstated); McCormick tort |
- Consumer privacy and health data law: South Carolina has no comprehensive consumer privacy law in force as of October 22, 2026.† [SC-007]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: Consumer Affairs if more than 1,000 residents affected; residents also have a private right of action. [SC-005]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (44-115-40) and tort.† [SC-001, SC-004]
- Patient confidentiality duties: The state confidentiality law applies to licensed providers (Board reg 81-60(D)). [SC-002]
- Lawsuits by individuals: Patients may be able to sue in some situations (McCormick; 39-1-90(G)).† [SC-004, SC-005]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: only agency guidance was found (board guidance); the binding rules are the general professional practice acts. [SC-006]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2) (Hedgepath). Not finding enforcement does not mean none exists. [SC-003]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [SC-001] S.C. Code 44-115-40 (https://www.scstatehouse.gov/code/t44c115.php)
- [SC-002] S.C. Code 40-47-110(B)(9), (13), (14); S.C. Code Regs. 81-60(D) (https://www.scstatehouse.gov/code/t40c047.php)
- [SC-003] S.C. State Bd. of Med. Exam'rs v. Hedgepath, 325 S.C. 166, 480 S.E.2d 724 (1997) (https://www.sccourts.org/media/opinions/HTMLFiles/SC/24565.htm)
- [SC-004] McCormick v. England, 328 S.C. 627, 494 S.E.2d 431 (Ct. App. 1997) (https://law.justia.com/cases/south-carolina/court-of-appeals/1997/2751-3.html)
- [SC-005] S.C. Code 39-1-90(D), (G), (H), (K) (https://www.scstatehouse.gov/code/t39c001.php)
- [SC-006] SCBME Guidance on Surgery Using Lasers, Pulsed Light, Radiofrequency Devices, or Other Techniques (https://www.llr.sc.gov/med/Policies/LasersOtherDevices.aspx)
- [SC-007] IAPP US State Privacy Legislation Tracker (secondary); synthesis.csv (https://iapp.org/resources/article/us-state-privacy-legislation-tracker/)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| South Carolina (SC) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Physicians' Patient Records Act 44-115-40 (express written consent); Reg. 81-60(D) ethics; McCormick tort | Yes - applies to licensed providers regardless of HIPAA status | None | 39-1-90: medical info NOT covered; most expedient time; private action; Consumer Affairs + CRAs if >1,000 | 81-60(D) via 40-47-110(B)(13); Hedgepath (board reprimand reinstated); McCormick tort | 44-115-40 express written consent (records); HIPAA if covered; ethics duty | None statutory located (common law not researched) | Yes: McCormick breach-of-confidentiality tort; breach law 39-1-90(G) | Board of Medical Examiners, Board of Dentistry, Board of Nursing (LLR), Dept. of Consumer Affairs | Breach: administrative fine of $1,000 per affected resident for knowing and willful violations (whether the statute says 'up to' was not re-verified); license discipline (fine, reprimand, suspension, revocation) | E2 (Hedgepath 1997: board reprimand for voluntary disclosure, affirmed) | High | 2026-10-22 |
| South Carolina (SC) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Physicians' Patient Records Act 44-115-40 (express written consent); Reg. 81-60(D) ethics; McCormick tort | Unverified (no dental confidentiality ground located) | None | 39-1-90: medical info NOT covered; most expedient time; private action; Consumer Affairs + CRAs if >1,000 | 81-60(D) via 40-47-110(B)(13); Hedgepath (board reprimand reinstated); McCormick tort | 44-115-40 express written consent (records); HIPAA if covered; ethics duty | None statutory located (common law not researched) | Yes: McCormick breach-of-confidentiality tort; breach law 39-1-90(G) | Board of Medical Examiners, Board of Dentistry, Board of Nursing (LLR), Dept. of Consumer Affairs | Breach: administrative fine of $1,000 per affected resident for knowing and willful violations (whether the statute says 'up to' was not re-verified); license discipline (fine, reprimand, suspension, revocation) | E2 (Hedgepath 1997: board reprimand for voluntary disclosure, affirmed) | High | 2026-10-22 |
| South Carolina (SC) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Physicians' Patient Records Act 44-115-40 (express written consent); Reg. 81-60(D) ethics; McCormick tort | Yes - applies to licensed providers regardless of HIPAA status | None | 39-1-90: medical info NOT covered; most expedient time; private action; Consumer Affairs + CRAs if >1,000 | 81-60(D) via 40-47-110(B)(13); Hedgepath (board reprimand reinstated); McCormick tort | 44-115-40 express written consent (records); HIPAA if covered; ethics duty | None statutory located (common law not researched) | Yes: McCormick breach-of-confidentiality tort; breach law 39-1-90(G) | Board of Medical Examiners, Board of Dentistry, Board of Nursing (LLR), Dept. of Consumer Affairs | Breach: administrative fine of $1,000 per affected resident for knowing and willful violations (whether the statute says 'up to' was not re-verified); license discipline (fine, reprimand, suspension, revocation) | E2 (Hedgepath 1997: board reprimand for voluntary disclosure, affirmed) | High | 2026-10-22 |
| South Carolina (SC) | Medical med spa | Depends; cash-only med spas often not covered | Physicians' Patient Records Act 44-115-40 (express written consent); Reg. 81-60(D) ethics; McCormick tort | Yes - applies to licensed providers regardless of HIPAA status | None | 39-1-90: medical info NOT covered; most expedient time; private action; Consumer Affairs + CRAs if >1,000 | 81-60(D) via 40-47-110(B)(13); Hedgepath (board reprimand reinstated); McCormick tort | 44-115-40 express written consent (records); HIPAA if covered; ethics duty | None statutory located (common law not researched) | Yes: McCormick breach-of-confidentiality tort; breach law 39-1-90(G) | Board of Medical Examiners, Board of Dentistry, Board of Nursing (LLR), Dept. of Consumer Affairs | Breach: administrative fine of $1,000 per affected resident for knowing and willful violations (whether the statute says 'up to' was not re-verified); license discipline (fine, reprimand, suspension, revocation) | E2 (Hedgepath 1997: board reprimand for voluntary disclosure, affirmed) | High | 2026-10-22 |
| South Carolina (SC) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Physicians' Patient Records Act 44-115-40 (express written consent); Reg. 81-60(D) ethics; McCormick tort | No | None | 39-1-90: medical info NOT covered; most expedient time; private action; Consumer Affairs + CRAs if >1,000 | 81-60(D) via 40-47-110(B)(13); Hedgepath (board reprimand reinstated); McCormick tort | 44-115-40 express written consent (records); HIPAA if covered; ethics duty | None statutory located (common law not researched) | Yes: McCormick breach-of-confidentiality tort; breach law 39-1-90(G) | Board of Medical Examiners, Board of Dentistry, Board of Nursing (LLR), Dept. of Consumer Affairs | Breach: administrative fine of $1,000 per affected resident for knowing and willful violations (whether the statute says 'up to' was not re-verified); license discipline (fine, reprimand, suspension, revocation) | E2 (Hedgepath 1997: board reprimand for voluntary disclosure, affirmed) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
S.C. State Board of Medical Examiners v. Hedgepath
Supreme Court of South Carolina · SC · 1997-01-27
- Provider type
- Physician (general practice / addictionology)
- Relevant facts
- Physician gave a voluntary affidavit in a divorce, at the husband's lawyer's request, revealing the wife's confidences without consent
- Legal issues
- S.C. Code Regs. 81-60 (ethics: safeguard patient confidences); misconduct statute
- Holding, findings, allegations or settlement terms
- Judicial decision: Board finding of misconduct and public reprimand reinstated; duty of confidence independent of privilege
- Consequences recorded
- Public reprimand
- Procedural status
- Final
- Precedential?
- Yes (state supreme court)
- Why it is in this research
- A voluntary disclosure not compelled by law breaches the ethical duty, even with no evidentiary privilege
McCormick v. England
South Carolina Court of Appeals · SC · 1997-11-17
- Provider type
- Physician (specialty not stated in excerpts)
- Relevant facts
- Physician disclosed a patient's emotional-health information in her divorce proceeding
- Legal issues
- Common-law tort for breach of physician's duty of confidentiality
- Holding, findings, allegations or settlement terms
- Holding: tort recognized (prospective); duty not absolute; reversed dismissal and remanded
- Consequences recorded
- None in opinion (remanded)
- Procedural status
- Remanded; later history not verified
- Precedential?
- Yes (intermediate appellate)
- Why it is in this research
- Private tort exposure in SC for disclosures of patient information
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
SC-007. IAPP US State Privacy Legislation Tracker (secondary); synthesis.csv
South Carolina has no comprehensive consumer privacy law in force as of 2026-10-22 (negative search).
Search result (negative) · Inferred from negative search · Medium · Med spa pass, final phase part 2 (2026-10-22). Negative finding from a secondary tracker and earlier batch research; pending bills not reviewed. Re-check before publication (U-96).
https://iapp.org/resources/article/us-state-privacy-legislation-tracker/
SC-005. S.C. Code 39-1-90(D), (G), (H), (K)
Breach law 'personal identifying information' = SSN, DL/ID, financial account with code, other financial-access numbers, government IDs; medical information NOT covered. Residents have a private action (damages for willful violations, actual damages for negligent ones, injunction, fees); knowing and willful violation: $1,000 per affected resident administrative fine; Consumer Affairs and CRAs if more than 1,000.
Statute · Explicit · High · Maximum, not typical. [Audit D 2026-10-22: '$1,000 per affected resident' fine: whether the statute says 'up to' was not re-verified (official page returned the chapter index only)]
SC-001. S.C. Code 44-115-40
Physicians' Patient Records Act: 'Except as otherwise provided by law, a physician shall not honor a request for the release of copies of medical records without the receipt of express written consent of the patient'.
Statute · Explicit · High · Text addresses releasing copies of records; reach to oral or online disclosures is inferred.
SC-004. McCormick v. England, 328 S.C. 627, 494 S.E.2d 431 (Ct. App. 1997)
Court of Appeals recognized a common-law tort for a physician's breach of the duty of confidentiality, absent a compelling public interest or other justification (prospective from 1997).
Judicial decision · Explicit (opinion excerpts read) · High · Private exposure for review replies that reveal patient information (application inferred).
https://law.justia.com/cases/south-carolina/court-of-appeals/1997/2751-3.html
SC-002. S.C. Code 40-47-110(B)(9), (13), (14); S.C. Code Regs. 81-60(D)
Physician misconduct grounds include dishonorable, unethical or unprofessional conduct likely to deceive, defraud or harm the public; violating the code of medical ethics adopted by the Board; and violating Board regulations. The adopted Principles of Medical Ethics require a physician to 'safeguard patient confidence within the constraints of the law'.
Statute; Regulation · Explicit · High · No confidentiality ground located in the dental chapter (40-15).
SC-006. SCBME Guidance on Surgery Using Lasers, Pulsed Light, Radiofrequency Devices, or Other Techniques
Board of Medical Examiners guidance (adopted 2024-05-07): laser, pulsed-light and RF procedures are the practice of medicine; may be delegated to PAs (under supervision) and NPs (practice agreement); non-ablative treatments may be delegated to others where law permits (RN laser hair removal under direct supervision per the Board of Nursing); the practitioner must examine each patient before initial treatment or before authorizing non-physician treatment.
Guidance · Explicit · High · Guidance, not law. A joint neuromodulator advisory opinion exists (text not read, U-54).
SC-003. S.C. State Bd. of Med. Exam'rs v. Hedgepath, 325 S.C. 166, 480 S.E.2d 724 (1997)
S.C. Supreme Court reinstated a Board public reprimand of a physician who gave a voluntary affidavit in a divorce disclosing a patient's confidences without consent; the duty of confidentiality is independent of evidentiary privilege.
Judicial decision · Explicit (opinion read) · High · Litigation context, not online. Directly rebuts the idea that no privilege means no confidentiality duty.
https://www.sccourts.org/media/opinions/HTMLFiles/SC/24565.htm
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All