What enforcement actually looks like
Statutes list maximum penalties, which are ceilings, not typical outcomes. For example, the 2026 inflation-adjusted HIPAA penalty cap is $2,190,294 per calendar year for identical violations, while the four OCR review-response matters this research located ranged from $10,000 to $50,000. [F-014, F-024]
State attorneys general can also enforce HIPAA in federal court and use state law. Indiana's attorney general alleged that a dental group disclosed patient information in replies to online reviews; the case ended in a consent judgment without an admission. New York's attorney general has settled data-security cases with physician practices. Settlements and consent orders resolve allegations; they are not court findings that the law was broken. [F-016, IN-006, NY-012]
Licensing boards discipline privacy lapses too. For example, the North Carolina Medical Board reprimanded and conditionally suspended a physician who showed a stranger a photo of an unconscious patient (consent order with findings and admissions). [NC-004]
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Elite Dental Associates
HHS OCR · TX (federal action) · 2019-10-02
- Provider type
- Dental
- Relevant facts
- Yelp replies disclosed patient last name, treatment plan, insurance, cost
- Legal issues
- 45 CFR 164.502(a), 164.530(i), 164.520(b) (potential violations)
- Holding, findings, allegations or settlement terms
- Settlement (no admission); admission of liability: No
- Consequences recorded
- $10,000; 2-year CAP
- Procedural status
- Closed: resolution agreement; CAP monitoring period (status not re-checked)
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Review response
Dr. U. Phillip Igbinadolor, DMD & Associates (UPI)
HHS OCR · NC (federal action) · 2022-03-28 (announced)
- Provider type
- Dental
- Relevant facts
- Webpage reply to negative review disclosed PHI; no response to OCR subpoena
- Legal issues
- Impermissible disclosure (see OCR notice; section list not re-verified)
- Holding, findings, allegations or settlement terms
- CMP imposed; hearing waived (not judicial finding)
- Consequences recorded
- $50,000
- Procedural status
- Final CMP (hearing waived)
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Review response
New Vision Dental (B. Brandon Au DDS Inc.)
HHS OCR · CA (federal action) · 2022-12-14
- Provider type
- Dental
- Relevant facts
- Yelp replies disclosed names, treatment, insurance
- Legal issues
- 45 CFR 164.502(a), 164.520(b), 164.530(i)
- Holding, findings, allegations or settlement terms
- Settlement (no admission); admission of liability: No
- Consequences recorded
- $23,000; Remove posts; breach notices; 2-year monitoring
- Procedural status
- Closed: resolution agreement; CAP monitoring period (status not re-checked)
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Review response
Manasa Health Center
HHS OCR · NJ (federal action) · 2023-06-05
- Provider type
- Psychiatric
- Relevant facts
- Google review replies disclosed PHI of four patients
- Legal issues
- 45 CFR 164.502(a), 164.530(i)
- Holding, findings, allegations or settlement terms
- Settlement (no admission); admission of liability: No
- Consequences recorded
- $30,000; 2-year CAP
- Procedural status
- Closed: resolution agreement; CAP monitoring period (status not re-checked)
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Review response
Arizona dental board review of Gus Khalifa, DDS (media report)
AZ State Board of Dental Examiners · AZ · 2019-08-26 (report)
- Provider type
- Endodontics
- Relevant facts
- Yelp reply disclosed patient's last name and dental history; dentist claimed patient 'forfeited' confidentiality
- Legal issues
- A.R.S. 32-1201.01 (inferred)
- Holding, findings, allegations or settlement terms
- Investigation reported; outcome unverified
- Consequences recorded
- None / unknown
- Procedural status
- Unknown
- Precedential?
- No (settlement/administrative/allegation)
- Why it is in this research
- Review response; waiver myth
NYSED consent order: Michelle Ann Linderman, RN
NYS Board of Regents / NYSED Office of the Professions · NY (state licensing) · 2025-10-07
- Provider type
- Registered nurse
- Relevant facts
- Admitted accessing and revealing PHI of numerous patients without authority or consent (2024)
- Legal issues
- 8 NYCRR 29.1(b)(8); Educ. Law 6509
- Holding, findings, allegations or settlement terms
- Consent order (admission)
- Consequences recorded
- 3-month actual suspension, 21 months stayed, 2 years probation, $500 fine
- Procedural status
- Final (consent order)
- Precedential?
- No
- Why it is in this research
- Licensee discipline for revealing patient information (review/social-media analog)
Doe v. Community Health Plan-Kaiser Corp.
N.Y. Appellate Division, Third Department · NY · 2000-05-11
- Provider type
- Health plan/provider
- Relevant facts
- Employee disclosure of patient's confidential medical information
- Legal issues
- Breach of confidentiality tort; CPLR 4504
- Holding, findings, allegations or settlement terms
- Judicial decision recognizing breach-of-confidentiality claim (holding details not fully reviewed)
- Consequences recorded
- n/a
- Procedural status
- Final (historic)
- Precedential?
- Yes (intermediate appellate; binding on NY trial courts absent contrary authority)
- Why it is in this research
- Private liability for disclosures (e.g., review replies) outside HIPAA
Sorensen v. Barbuto
Utah Supreme Court · UT · 2008-02-01
- Provider type
- Physician
- Relevant facts
- Treating physician had ex parte communications with defense counsel in patient's lawsuit
- Legal issues
- Physician duty of confidentiality; waiver by litigation
- Holding, findings, allegations or settlement terms
- Duty of confidentiality recognized; filing suit did not waive it for ex parte communications (pinpoints unverified)
- Consequences recorded
- n/a
- Procedural status
- Final
- Precedential?
- Yes (Utah Supreme Court)
- Why it is in this research
- Putting one's health at issue does not broadly waive confidentiality (analog to the review 'waiver' myth)
Humphers v. First Interstate Bank of Oregon
Supreme Court of Oregon · OR · 1985-03-06
- Provider type
- Physician (obstetrics)
- Relevant facts
- Physician gave an adoptee a false letter that let her obtain the birth mother's sealed hospital records
- Legal issues
- Breach of confidence vs. invasion of privacy; source of physician's duty (ORS 677.190(5))
- Holding, findings, allegations or settlement terms
- Holding: breach-of-confidence claim may proceed; duty and defenses come from the external legal source; intrusion-type privacy claim rejected
- Consequences recorded
- None in opinion (remanded for trial)
- Procedural status
- Remanded 1985; later history not verified
- Precedential?
- Yes (Oregon Supreme Court)
- Why it is in this research
- Private tort exposure in OR for any disclosure of patient information, including review replies (application inferred)
Virginia Board of Medicine: Valerie Josephine Buyse, M.D.
Virginia Board of Medicine · VA (state licensing) · 2020-02-11
- Provider type
- Physician (psychiatry)
- Relevant facts
- Patient posted a named negative review; physician's online reply, made to defend her care, disclosed intake-form information, diagnoses, medications and psychotherapy participation; she then texted the patient about 'defamation'
- Legal issues
- Va. Code 54.1-2915(A)(3), (12); 18VAC85-20-26(A) (Health Records Privacy Act); 18VAC85-20-27(A)
- Holding, findings, allegations or settlement terms
- Findings of fact and conclusions of law admitted in consent order
- Consequences recorded
- Reprimand
- Procedural status
- Final (consent order)
- Precedential?
- No
- Why it is in this research
- Direct state-board precedent: a defensive review reply disclosing patient information was sanctioned in VA
State Medical Board of Ohio: Sonia Praful Desai, M.D.
State Medical Board of Ohio · OH (state licensing) · 2026-09-09
- Provider type
- Physician (specialty not stated)
- Relevant facts
- After a patient posted a negative review of the doctor, the doctor publicly posted a negative review of the patient without permission (per Board summary)
- Legal issues
- Ohio Rev. Code 4731.22(B)(4) willfully betraying a professional confidence; code-of-ethics violation
- Holding, findings, allegations or settlement terms
- Consent agreement based on the doctor's admission
- Consequences recorded
- Reprimand; probation; ethics and boundaries courses; $4,000 fine
- Procedural status
- Final (consent agreement; terms per Board summary)
- Precedential?
- No
- Why it is in this research
- Direct: a retaliatory reply to a reviewer was sanctioned as a confidentiality breach
Biddle v. Warren General Hospital
Supreme Court of Ohio · OH · 1999-09-15
- Provider type
- Hospital and its law firm
- Relevant facts
- Hospital released patient registration records to a law firm to screen for SSI eligibility without consent
- Legal issues
- Independent tort of unauthorized, unprivileged disclosure of nonpublic medical information; third-party inducement
- Holding, findings, allegations or settlement terms
- Judicial holding (syllabus paras. 1-3): tort recognized; privilege only for statutory/common-law duty or overriding interest
- Consequences recorded
- n/a (remanded on liability issues)
- Procedural status
- Final (precedent)
- Precedential?
- Yes (state supreme court)
- Why it is in this research
- Private tort exposure in Ohio for disclosing patient information in a review reply (application inferred)
State of Indiana ex rel. Rokita v. Westend Dental LLC
U.S. District Court, S.D. Indiana (Indiana AG plaintiff) · IN (state AG; HIPAA via 42 U.S.C. 1320d-5(d)) · Complaint 2024-12-23; consent judgment 2025-01-02
- Provider type
- Dental group (seven offices)
- Relevant facts
- ALLEGED: Oct 2020 ransomware breach and late/misleading notice; HIPAA program failures; public replies to online patient reviews and Facebook posts disclosing PHI (including minors and x-rays) without authorization
- Legal issues
- HIPAA Privacy/Security/Breach rules; Indiana breach law IC 24-4.9; Deceptive Consumer Sales Act
- Holding, findings, allegations or settlement terms
- Consent judgment (no admission): bar on PHI in review replies, social media and ads without authorization; policies; security program; third-party assessments
- Consequences recorded
- $350,000 payment to the State (per proposed judgment para. 75; installments per secondary)
- Procedural status
- Final. Consent Judgment and Order signed by Judge Matthew P. Brookman 2025-01-02 (S.D. Ind. docket; V-013).
- Precedential?
- No
- Why it is in this research
- Direct: state AG enforcement treating review-reply PHI disclosure as a HIPAA and consumer-protection violation by a dental practice
Iowa Dental Board: Trung Phan, D.D.S.
Iowa Dental Board (DIAL) · IA (state licensing) · 2026-08-19
- Provider type
- Dentist
- Relevant facts
- ALLEGED (per media): posted unprofessional responses to negative online reviews that included patient information
- Legal issues
- Unprofessional conduct; failure to preserve confidentiality of patient information (rule cites not verified)
- Holding, findings, allegations or settlement terms
- Charges (allegations) resolved by settlement (per media)
- Consequences recorded
- Warning; ethics program; $1,000 civil penalty (per media)
- Procedural status
- Final (settlement per media); order not read
- Precedential?
- No
- Why it is in this research
- Direct: dental board action over review replies containing patient information
Horne v. Patton
Supreme Court of Alabama · AL · 1973
- Provider type
- Physician
- Relevant facts
- Physician disclosed a patient's medical information to the patient's employer without consent
- Legal issues
- Breach of confidence (tort and implied contract); invasion of privacy
- Holding, findings, allegations or settlement terms
- Judicial holding (per summaries): complaint stated claims; physician has a duty not to make extra-judicial disclosures
- Consequences recorded
- n/a (reversal of dismissal)
- Procedural status
- Final (precedent)
- Precedential?
- Yes (state supreme court)
- Why it is in this research
- Private claims for unauthorized disclosure, e.g., in review replies (application inferred)
Morris v. Consolidation Coal Co.
Supreme Court of Appeals of West Virginia · WV · 1994
- Provider type
- Treating physician; employer
- Relevant facts
- Employer's agents obtained ex parte disclosures from a workers' compensation claimant's treating physician
- Legal issues
- Breach of physician's duty of confidentiality; inducement by third party
- Holding, findings, allegations or settlement terms
- Judicial holding (syllabus): patient has a cause of action against a physician who breaches confidentiality and against a third party who induces it
- Consequences recorded
- n/a
- Procedural status
- Final (precedent)
- Precedential?
- Yes (state high court)
- Why it is in this research
- Private claims over review replies that disclose patient information (application inferred)
Shepherd v. Costco Wholesale Corp.
Arizona Supreme Court · AZ · 2021-03-08
- Provider type
- Pharmacy (licensed health care provider)
- Relevant facts
- Pharmacy staff disclosed a patient's E.D. prescription to his ex-wife, who told his children and friends
- Legal issues
- Negligent disclosure of medical information; HIPAA as standard of care; A.R.S. 12-2296 good-faith immunity
- Holding, findings, allegations or settlement terms
- Judicial holding: negligence claim may proceed; HIPAA may inform the standard of care; immunity is an affirmative defense; plaintiff must rebut the good-faith presumption by clear and convincing evidence
- Consequences recorded
- Dismissal reversed in part; remanded (no damages determined in the opinion)
- Procedural status
- Final appellate decision; later trial-court history not located
- Precedential?
- Yes (Arizona Supreme Court)
- Why it is in this research
- Private damages exposure for a practice whose staff or review replies disclose patient information (inference)
Frequently asked questions
Related pages
States
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
Topics
Healthcare industry
Sources
F-014. 45 CFR 102.3; 91 FR 3665
2026 inflation-adjusted HIPAA CMP amounts: Tier 1 $145-$73,011; Tier 2 $1,461-$73,011; Tier 3 $14,602-$73,011; Tier 4 $73,011-$2,190,294; CY cap $2,190,294.
Regulation · Explicit · High · These are statutory/regulatory maxima. OCR resolution amounts in review-response cases ranged $10,000-$50,000 (see cases.csv); maxima are not typical outcomes. Inflation-adjusted values of the enforcement-discretion caps were not verified from a primary source.
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-016. 42 U.S.C. 1320d-5(d)
State attorneys general may sue in federal court for HIPAA violations: injunction or damages up to $100 per violation, capped at $25,000 per identical requirement per calendar year, plus fees.
Statute · Explicit · High · HIPAA itself has no private right of action (well established; individual courts not separately cited here). [Audit D 2026-10-22: URL changed from LII (unofficial) to govinfo; subsection (d) text re-read]
https://www.govinfo.gov/link/uscode/42/1320d-5?type=usc&year=mostrecent&link-type=html
IN-006. State of Indiana ex rel. Rokita v. Westend Dental LLC, No. 1:24-cv-02255 (S.D. Ind.)
Indiana AG suit against a dental group ALLEGED, among other things, that public replies to online patient reviews on Google and Facebook posts disclosed patients' PHI (including minors and x-rays) without authorization, pleaded under HIPAA (42 U.S.C. 1320d-5(d)), the breach law and the Deceptive Consumer Sales Act. A consent judgment entered 2025-01-02 (no admission) bars disclosing PHI 'in response to online reviews' or in ads without patient authorization, requires social-media and review policies, and requires a $350,000 payment.
Enforcement (state AG; federal-court consent judgment) · Explicit (complaint and proposed judgment read; entered version not read) · High · Settlement, not a finding. Dental practice (cosmetic status not stated). State AG HIPAA enforcement against review replies; the payment also resolves breach claims.
https://storage.courtlistener.com/recap/gov.uscourts.insd.218861/gov.uscourts.insd.218861.1.0.pdf
NY-012. NY AG press releases
NY AG data-security settlements with physician practices: Albany ENT & Allergy ($500,000 penalties + $2.25M security investment, 2024-10-29) and OrthopedicsNY ($500,000, 2025-12-26).
Enforcement (state AG settlements) · Explicit · High · Specialty physician practices (not cosmetic). Settlements, not findings.
NC-004. In re Sean Michael Lynch, M.D. (NCMB Consent Order)
NC Medical Board consent order (findings and admissions): an OB/GYN showed a bar patron a graphic photo of an unconscious patient (no face or identifiers) taken without her knowledge, not in her record, shown without consent and with no medical purpose; unprofessional conduct under 90-14(a)(6); reprimand and indefinite suspension, stayed on conditions (NCPHP contract, 16-hour CME).
Enforcement (licensing; consent order with findings) · Explicit (order read) · High · Not cosmetic, not online. Notable: a de-identified photo still supported discipline.
https://portal.ncmedboard.org/file/fileDisplay.aspx?FileID=hBB4qrGkpiI%3D&TYPE=DISCLIC
V-013. V-013
This reference id is cited in the publication and is not a row in the claim register supplied with it.