What a provider can and can't say in Texas
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | Occ. 159.002/258.102 confidentiality; ch. 181; OCR Elite Dental (Dallas) federal case |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | Occ. 159.002/258.102 confidentiality; ch. 181; OCR Elite Dental (Dallas) federal case |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | Occ. 159.002/258.102 confidentiality; ch. 181; OCR Elite Dental (Dallas) federal case |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | Occ. 159.002/258.102 confidentiality; ch. 181; OCR Elite Dental (Dallas) federal case |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Conditional: ch. 181 covers any person who handles PHI for gain or comes into possession of PHI (181.001(b)(2)), but 'PHI' has its 2011 HIPAA meaning. Likely covered if it receives physician/provider records; its own intake data is PHI only if it furnishes 'health care' (unresolved for facials/waxing); a license alone does not decide it | Occ. 159.002/258.102 confidentiality; ch. 181; OCR Elite Dental (Dallas) federal case |
- Consumer privacy and health data law: Texas has a consumer privacy law in force (TDPSA). It exempts HIPAA covered entities and HIPAA-protected health information. [TX-001, TX-008]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general within 30 days if 250 or more residents affected. [TX-007]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (HSC 181; Occ. 159, 258). [TX-001, TX-005]
- Patient confidentiality duties: The state confidentiality law applies to licensed providers. [TX-005, TX-006]
- Lawsuits by individuals: Patients may be able to sue in some situations (159.009). [TX-005]
- Photos, names and likeness: Texas's likeness statute (Property Code chapter 26) was noted but its text was not read in this research, so whether it protects living patients is a research gap. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (IV hydration, HB 3749). [TX-010, TX-014]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4) (federal, not state: OCR's Elite Dental resolution). Not finding enforcement does not mean none exists. [TX-012, U-97]
- Research notes and gaps: Texas's medical records privacy law (Health and Safety Code chapter 181) can reach a salon or esthetics studio, but not automatically: a license neither creates nor excludes coverage. Its key term, protected health information, has its HIPAA meaning, so a business that receives records from a physician or other health care provider likely becomes covered, while whether a studio's own intake answers (medications, allergies, conditions, treatment history) count depends on whether its services are 'health care', which is unresolved for typical esthetic services. For a state-licensed business, attorney general civil penalties require a referral from the licensing agency, and no state enforcement of this law against an aesthetic business was located. [TX-001, TX-014, TX-015, TX-016, U-21]
Sources:
- [TX-001] Tex. Health & Safety Code 181.001(b)(2) (https://statutes.capitol.texas.gov/Docs/HS/htm/HS.181.htm)
- [TX-005] Tex. Occ. Code 159.002, 159.009 (https://statutes.capitol.texas.gov/Docs/OC/htm/OC.159.htm)
- [TX-006] Tex. Occ. Code 258.102, 258.104 (https://statutes.capitol.texas.gov/Docs/OC/htm/OC.258.htm)
- [TX-007] Tex. Bus. & Com. Code 521.002, 521.053, 521.151 (https://statutes.capitol.texas.gov/Docs/BC/htm/BC.521.htm)
- [TX-008] Tex. Bus. & Com. Code 541.002, .003, .107 (https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)
- [TX-010] Tex. Occ. Code ch. 172 (HB 3749, 89th Leg.) (https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB3749)
- [TX-012] HHS OCR (https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/elite/index.html)
- [TX-014] Tex. Health & Safety Code 181.001(a), (b)(2)-(3), 181.005(b); 45 CFR 160.103 (2011 ed.) ('health care', 'health care provider', 'health information', 'individually identifiable health information', 'protected health information') (https://statutes.capitol.texas.gov/Docs/HS/htm/HS.181.htm)
- [TX-015] Tex. Health & Safety Code 181.201(e), 181.202 (https://statutes.capitol.texas.gov/Docs/HS/htm/HS.181.htm)
- [TX-016] Office of the Attorney General, Texas Medical Records Privacy Act Annual Report, FY2025 (Tex. Health & Safety Code 181.104) pp. 1-3 (https://www.texasattorneygeneral.gov/sites/default/files/files/divisions/consumer-protection/HB300-Report-FY25.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Texas (TX) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | HSC ch. 181 (broad covered entity); Occ. 159 (physicians), 258 (dentists) | Yes - applies to licensed providers regardless of HIPAA status | TDPSA ch. 541 (exempts HIPAA CEs and PHI; small-business sale-consent rule) | Bus. & Com. 521.053: health info covered; 60 days; AG within 30 days if 250+ | Occ. 159.002/258.102 confidentiality; ch. 181; OCR Elite Dental (Dallas) federal case | Ch. 181.152 marketing permission; 181.154 electronic disclosure authorization; HIPAA if covered | Prop. Code ch. 26 covers deceased persons only; common-law misappropriation for living (verify) | Yes: Occ. 159.009 (physicians); no private action under ch. 181 or 521/541 | Texas Medical Board, State Board of Dental Examiners, Board of Nursing, AG, HHSC | Ch. 181: $5,000/$25,000/$250,000 per violation; $1.5M/yr pattern; 521: up to $50,000/violation + $250,000 notice failures; ch. 183 (SB 1188) EHR rules: $5,000/$25,000/$250,000 per violation | E1 (federal OCR Elite Dental, TX); E4 (no ch. 181 AG action vs. cosmetic practice located) | High | 2026-10-22 |
| Texas (TX) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | HSC ch. 181 (broad covered entity); Occ. 159 (physicians), 258 (dentists) | Yes - applies to licensed providers regardless of HIPAA status | TDPSA ch. 541 (exempts HIPAA CEs and PHI; small-business sale-consent rule) | Bus. & Com. 521.053: health info covered; 60 days; AG within 30 days if 250+ | Occ. 159.002/258.102 confidentiality; ch. 181; OCR Elite Dental (Dallas) federal case | Ch. 181.152 marketing permission; 181.154 electronic disclosure authorization; HIPAA if covered | Prop. Code ch. 26 covers deceased persons only; common-law misappropriation for living (verify) | Yes: Occ. 159.009 (physicians); no private action under ch. 181 or 521/541 | Texas Medical Board, State Board of Dental Examiners, Board of Nursing, AG, HHSC | Ch. 181: $5,000/$25,000/$250,000 per violation; $1.5M/yr pattern; 521: up to $50,000/violation + $250,000 notice failures; ch. 183 (SB 1188) EHR rules: $5,000/$25,000/$250,000 per violation | E1 (federal OCR Elite Dental, TX); E4 (no ch. 181 AG action vs. cosmetic practice located) | High | 2026-10-22 |
| Texas (TX) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | HSC ch. 181 (broad covered entity); Occ. 159 (physicians), 258 (dentists) | Yes - applies to licensed providers regardless of HIPAA status | TDPSA ch. 541 (exempts HIPAA CEs and PHI; small-business sale-consent rule) | Bus. & Com. 521.053: health info covered; 60 days; AG within 30 days if 250+ | Occ. 159.002/258.102 confidentiality; ch. 181; OCR Elite Dental (Dallas) federal case | Ch. 181.152 marketing permission; 181.154 electronic disclosure authorization; HIPAA if covered | Prop. Code ch. 26 covers deceased persons only; common-law misappropriation for living (verify) | Yes: Occ. 159.009 (physicians); no private action under ch. 181 or 521/541 | Texas Medical Board, State Board of Dental Examiners, Board of Nursing, AG, HHSC | Ch. 181: $5,000/$25,000/$250,000 per violation; $1.5M/yr pattern; 521: up to $50,000/violation + $250,000 notice failures; ch. 183 (SB 1188) EHR rules: $5,000/$25,000/$250,000 per violation | E1 (federal OCR Elite Dental, TX); E4 (no ch. 181 AG action vs. cosmetic practice located) | High | 2026-10-22 |
| Texas (TX) | Medical med spa | Depends; cash-only med spas often not covered | HSC ch. 181 (broad covered entity); Occ. 159 (physicians), 258 (dentists) | Yes - applies to licensed providers regardless of HIPAA status | TDPSA ch. 541 (exempts HIPAA CEs and PHI; small-business sale-consent rule) | Bus. & Com. 521.053: health info covered; 60 days; AG within 30 days if 250+ | Occ. 159.002/258.102 confidentiality; ch. 181; OCR Elite Dental (Dallas) federal case | Ch. 181.152 marketing permission; 181.154 electronic disclosure authorization; HIPAA if covered | Prop. Code ch. 26 covers deceased persons only; common-law misappropriation for living (verify) | Yes: Occ. 159.009 (physicians); no private action under ch. 181 or 521/541 | Texas Medical Board, State Board of Dental Examiners, Board of Nursing, AG, HHSC | Ch. 181: $5,000/$25,000/$250,000 per violation; $1.5M/yr pattern; 521: up to $50,000/violation + $250,000 notice failures; ch. 183 (SB 1188) EHR rules: $5,000/$25,000/$250,000 per violation | E1 (federal OCR Elite Dental, TX); E4 (no ch. 181 AG action vs. cosmetic practice located) | High | 2026-10-22 |
| Texas (TX) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | HSC ch. 181 (broad covered entity); Occ. 159 (physicians), 258 (dentists) | Conditional: ch. 181 covers any person who handles PHI for gain or comes into possession of PHI (181.001(b)(2)), but 'PHI' has its 2011 HIPAA meaning. Likely covered if it receives physician/provider records; its own intake data is PHI only if it furnishes 'health care' (unresolved for facials/waxing); a license alone does not decide it | TDPSA ch. 541 (exempts HIPAA CEs and PHI; small businesses bound only by the sale-of-sensitive-data consent rule, 541.107) | Bus. & Com. 521.053: health info covered; 60 days; AG within 30 days if 250+ | Occ. 159.002/258.102 confidentiality; ch. 181; OCR Elite Dental (Dallas) federal case | Ch. 181.152 marketing permission; 181.154 electronic disclosure authorization; HIPAA if covered | Prop. Code ch. 26 covers deceased persons only; common-law misappropriation for living (verify) | Yes: Occ. 159.009 (physicians); no private action under ch. 181 or 521/541 | TDLR (licensing; must refer before AG ch. 181 civil penalties, 181.201(e)), AG (injunction; TDPSA; ITEPA) | Ch. 181: $5,000/$25,000/$250,000 per violation; $1.5M/yr pattern; 521: up to $50,000/violation + $250,000 notice failures; ch. 183 (SB 1188) EHR rules: $5,000/$25,000/$250,000 per violation | E1 (federal OCR Elite Dental, TX); E4 (no ch. 181 action vs. aesthetic business located; AG FY2025 report: TDLR 0 complaints) | Medium | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Elite Dental Associates
HHS OCR · TX (federal action) · 2019-10-02
- Provider type
- Dental
- Relevant facts
- Yelp replies disclosed patient last name, treatment plan, insurance, cost
- Legal issues
- 45 CFR 164.502(a), 164.530(i), 164.520(b) (potential violations)
- Holding, findings, allegations or settlement terms
- Settlement (no admission); admission of liability: No
- Consequences recorded
- $10,000; 2-year CAP
- Procedural status
- Closed: resolution agreement; CAP monitoring period (status not re-checked)
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Review response
Related pages
Topics
Sources
TX-001. Tex. Health & Safety Code 181.001(b)(2)
Texas Medical Records Privacy Act 'covered entity' is far broader than HIPAA: any person who for commercial, financial, or professional gain (or nonprofit) assembles, collects, analyzes, uses, evaluates, stores, or transmits PHI, including providers and website operators.
Statute · Explicit · High · Whether a business's client data is 'PHI' (HIPAA meaning per 181.001(a), fixed as of 2011 by 181.001(b)(3)) turns on who created or received it; see TX-014. A license alone neither establishes nor excludes coverage.
TX-008. Tex. Bus. & Com. Code 541.002, .003, .107
Texas Data Privacy and Security Act exempts HIPAA covered entities (entity-level) and PHI (data-level), and applies only to non-small businesses except the sale-of-sensitive-data consent rule, which applies to small businesses too.
Statute · Explicit · High · Health data is 'sensitive data' requiring consent for non-exempt businesses.
TX-007. Tex. Bus. & Com. Code 521.002, 521.053, 521.151
Breach law covers health condition, provision of care, and payment information; individual notice within 60 days; AG notice within 30 days if 250+ Texans; penalties $2,000-$50,000 per violation and up to $100/individual/day for failure to notify (max $250,000).
Statute · Explicit · High
TX-005. Tex. Occ. Code 159.002, 159.009
Physician-patient communications and records are confidential and privileged; aggrieved persons may seek injunction and civil damages.
Statute · Explicit · High · Private action exists for physician disclosures.
TX-006. Tex. Occ. Code 258.102, 258.104
Dentist-patient communications and records are privileged; consent to release must be written and signed.
Statute · Explicit · High
TX-010. Tex. Occ. Code ch. 172 (HB 3749, 89th Leg.)
HB 3749 (Jenifer's Law, 2025) regulates elective IV hydration therapy (Occ. Code ch. 172); it is a med spa safety law, not a privacy law.
Statute · Explicit · Medium · Bill history via search.
https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB3749
TX-014. Tex. Health & Safety Code 181.001(a), (b)(2)-(3), 181.005(b); 45 CFR 160.103 (2011 ed.) ('health care', 'health care provider', 'health information', 'individually identifiable health information', 'protected health information')
Ch. 181 reach to nonmedical aesthetic businesses (U-21, LR-01): coverage is conditional, not automatic from a cosmetology or esthetics license. 181.001(a) gives undefined ch. 181 terms their HIPAA meaning, and 181.001(b)(3) ties that meaning to the federal privacy standards as of September 1, 2011 (later federal amendments apply only if adopted under 181.005(b)). Under 45 CFR 160.103 (2011 ed.), 'protected health information' is individually identifiable health information, which must be (1) created or received by a health care provider, health plan, employer or health care clearinghouse and (2) relate to an individual's physical or mental health or condition, the provision of health care, or payment for it, and identify the individual. Applied (interpretation): (a) records a salon or studio receives from a physician or other health care provider are already PHI, so possessing them can make the business a ch. 181 covered entity under 181.001(b)(2)(B) ('comes into possession of protected health information'); (b) a salon's own intake answers about medications, allergies, conditions or treatment history are PHI only if the business is itself a HIPAA-defined 'health care provider', i.e. furnishes 'health care', which includes services or procedures that affect the structure or function of the body; whether facials, waxing or similar esthetic services meet that definition is unresolved, and invasive esthetic procedures are more arguable; (c) an appointment list kept by a business that is not a health care provider is not PHI on its own. No Texas court decision, formal AG opinion or AG enforcement action applying ch. 181 to a nonmedical aesthetic business was located.
Statute + federal regulation (definitions); application is interpretation · Explicit (definitions); inferred (application to aesthetic businesses) · Medium · LR-01 review (2026-10-22). Official ch. 181 text read on statutes.capitol.texas.gov and on the Legislature's tcss.legis.texas.gov mirror (texts match); 2010 and 2011 CFR editions of 160.103 read on govinfo (identical). The earlier caveat that the official statutes site could not be read is withdrawn. The definitions are binding; their application to esthetic services is not settled by any Texas authority located and needs Texas counsel. 'Health care' is not limited to licensed medical practitioners, but no source located decides whether cosmetic esthetic services 'affect the structure or function of the body' in the HIPAA sense.
TX-012. HHS OCR
Elite Dental Associates (Dallas) paid $10,000 to OCR over Yelp replies disclosing patient information.
Enforcement (federal resolution agreement) · Explicit · High · Federal OCR action, not Texas state enforcement.
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/elite/index.html
TX-015. Tex. Health & Safety Code 181.201(e), 181.202
If a ch. 181 covered entity is licensed by a Texas licensing agency, the attorney general may sue it for ch. 181 civil penalties only if the licensing agency refers the violation under 181.202(2); the licensing agency may investigate and discipline (including probation or suspension) and, for egregious violations that constitute a pattern or practice, revoke the license or make that referral.
Statute · Explicit · High · LR-01 review (2026-10-22). Estheticians, cosmetologists and salons are licensed by the Texas Department of Licensing and Regulation (TDLR), so for a licensed salon that is a covered entity, AG civil penalties would require a TDLR referral (application; not tested in any decision located). The AG may still seek injunctive relief under 181.201(a).
TX-016. Office of the Attorney General, Texas Medical Records Privacy Act Annual Report, FY2025 (Tex. Health & Safety Code 181.104)
Attorney General's Texas Medical Records Privacy Act annual report, fiscal year 2025: describes the Act as reaching 'certain persons and entities including health care providers, health plans, and entities that process health insurance claims'; regulating agencies reported 553 medical-privacy complaints (TDLR reported 0) and the OAG received 52; agencies reported 132 enforcement or disciplinary actions, all administrative (74 dismissed for no violation); the OAG's two medical-privacy lawsuits that year (In re 23andMe, Bankr. E.D. Mo. No. 25-40976-357; State v. PowerSchool, Collin County Cause No. 296-06861-2025) relied on other statutes (TDPSA, the Direct-to-Consumer Genetic Testing Act, ITEPA, DTPA), not ch. 181 civil penalties.
Agency report (official) · Explicit · High · LR-01 review (2026-10-22). Shows no reported ch. 181 enforcement against a nonmedical aesthetic business in FY2025; it does not show that none is possible. TDLR is one of the agencies the AG surveys as regulating covered persons, but TDLR also licenses other health-related occupations, so its inclusion does not establish that salons are covered.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All
U-21. U-21 · Open (narrowed again 2026-10-22, LR-01 review)
Whether ch. 181 'PHI' (HIPAA meaning) reaches nonmedical aesthetic client data held by non-HIPAA entities.
Medium priority · TX