What a provider can and can't say in South Dakota
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 36-4-30(4) (physicians) |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Unverified (dental ground not located) | 36-4-30(4) (physicians) |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 36-4-30(4) (physicians) |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 36-4-30(4) (physicians) |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 36-4-30(4) (physicians) |
- Consumer privacy and health data law: South Dakota has no comprehensive consumer privacy law in force as of October 22, 2026.† [SD-004]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general for no-harm findings and more than 250 residents affected. [SD-001]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules and the patient privilege. [SD-003]
- Patient confidentiality duties: Board discipline for confidentiality breaches rests on a general professional-conduct ground (36-4-30(4)). [SD-003]
- Lawsuits by individuals: No private right of action was located in the statutes reviewed; other claims, such as privacy torts, may still exist. [U-98]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (SDCL 36-4-8.2 laser tissue alteration is surgery). [SD-005]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [SD-003, U-97]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [SD-001] SDCL 22-40-19(4)(d); 22-40-20 (https://sdlegislature.gov/api/Statutes/22-40-19.html)
- [SD-003] SDCL 36-4-30(4) (https://sdlegislature.gov/api/Statutes/36-4-30.html)
- [SD-004] 2026 S.D. Sess. (https://sdlegislature.gov/)
- [SD-005] SDCL 36-4-8.2 (https://sdlegislature.gov/Statutes/36-4-8.2)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| South Dakota (SD) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | SDCL 36-4-30(4) (physicians: willfully betraying a professional confidence); privilege 19-19-503 | Yes - applies to licensed providers regardless of HIPAA status | None (2026 genetic-data and social-media laws not read) | 22-40-19/20: 'health information' (45 CFR 160.103) covered; 60 days; AG if >250; HIPAA-compliant deemed compliant | 36-4-30(4) (physicians) | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located | Board of Medical and Osteopathic Examiners, Board of Dentistry, Board of Nursing, AG | Breach: up to $10,000 per day per violation (22-40-25); license discipline | E4 | High | 2026-10-22 |
| South Dakota (SD) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | SDCL 36-4-30(4) (physicians: willfully betraying a professional confidence); privilege 19-19-503 | Unverified (dental ground not located) | None (2026 genetic-data and social-media laws not read) | 22-40-19/20: 'health information' (45 CFR 160.103) covered; 60 days; AG if >250; HIPAA-compliant deemed compliant | 36-4-30(4) (physicians) | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located | Board of Medical and Osteopathic Examiners, Board of Dentistry, Board of Nursing, AG | Breach: up to $10,000 per day per violation (22-40-25); license discipline | E4 | High | 2026-10-22 |
| South Dakota (SD) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | SDCL 36-4-30(4) (physicians: willfully betraying a professional confidence); privilege 19-19-503 | Yes - applies to licensed providers regardless of HIPAA status | None (2026 genetic-data and social-media laws not read) | 22-40-19/20: 'health information' (45 CFR 160.103) covered; 60 days; AG if >250; HIPAA-compliant deemed compliant | 36-4-30(4) (physicians) | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located | Board of Medical and Osteopathic Examiners, Board of Dentistry, Board of Nursing, AG | Breach: up to $10,000 per day per violation (22-40-25); license discipline | E4 | High | 2026-10-22 |
| South Dakota (SD) | Medical med spa | Depends; cash-only med spas often not covered | SDCL 36-4-30(4) (physicians: willfully betraying a professional confidence); privilege 19-19-503 | Yes - applies to licensed providers regardless of HIPAA status | None (2026 genetic-data and social-media laws not read) | 22-40-19/20: 'health information' (45 CFR 160.103) covered; 60 days; AG if >250; HIPAA-compliant deemed compliant | 36-4-30(4) (physicians) | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located | Board of Medical and Osteopathic Examiners, Board of Dentistry, Board of Nursing, AG | Breach: up to $10,000 per day per violation (22-40-25); license discipline | E4 | High | 2026-10-22 |
| South Dakota (SD) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | SDCL 36-4-30(4) (physicians: willfully betraying a professional confidence); privilege 19-19-503 | No | None (2026 genetic-data and social-media laws not read) | 22-40-19/20: 'health information' (45 CFR 160.103) covered; 60 days; AG if >250; HIPAA-compliant deemed compliant | 36-4-30(4) (physicians) | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located | Board of Medical and Osteopathic Examiners, Board of Dentistry, Board of Nursing, AG | Breach: up to $10,000 per day per violation (22-40-25); license discipline | E4 | High | 2026-10-22 |
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
SD-004. 2026 S.D. Sess.
No comprehensive consumer privacy law. 2026 SB 49 (genetic data) and SB 111 (large social-media platforms) are narrow and were not read.
Legislative history · Status per secondary sources · Low-Medium · U-51.
SD-001. SDCL 22-40-19(4)(d); 22-40-20
Breach law personal information includes name plus 'health information as defined in 45 CFR 160.103' - a broad federal definition covering any health information created by a provider; notice within 60 days; no-harm exception only after investigation AND notice to the AG, documented for 3 years; AG notice if more than 250.
Statute · Explicit · High · Likely reaches before/after photos linked to a named client (inference).
SD-003. SDCL 36-4-30(4)
Physician unprofessional conduct includes 'willfully betraying a professional confidence'.
Statute · Explicit · High · Dental-practice confidentiality ground not located in 36-6A-59 (U-51).
SD-005. SDCL 36-4-8.2
Med spa: no med-spa-specific statute located. SDCL 36-4-8.2: surgery constituting the practice of medicine includes using a laser or ionizing radiation to cut or otherwise alter human tissue for diagnostic, palliative or therapeutic purposes.
Statute · Explicit · High · Med spa pass, final phase part 2 (2026-10-22). Official text read (V-067). Statute does not mention cosmetic purposes; its application to purely cosmetic laser use is inferred. Board's reported 2011 laser position not read.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All