What a provider can and can't say in Utah
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | Common-law duty (Sorensen); licensing rules (R156-1-502 not verified) |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | Common-law duty (Sorensen); licensing rules (R156-1-502 not verified) |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | Common-law duty (Sorensen); licensing rules (R156-1-502 not verified) |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | Common-law duty (Sorensen); licensing rules (R156-1-502 not verified) |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Sorensen duty runs to physicians; UCPA applies only at $25M revenue | Common-law duty (Sorensen); licensing rules (R156-1-502 not verified) |
- Consumer privacy and health data law: Utah has a consumer privacy law in force (UCPA ($25M)). It exempts HIPAA-covered practices as a whole (an entity-level exemption). [UT-001, UT-002]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: attorney general/Cyber Center if 500 or more residents affected. [UT-005]
- Patient confidentiality duties: Patient confidentiality duties come mainly from court-recognized privacy claims (Sorensen). [UT-007]
- Research notes and gaps: A specific board confidentiality ground was not read or not located; this is a research gap, not a finding that none exists. [U-98]
- Lawsuits by individuals: Patients may be able to sue in some situations (45-3; Sorensen). [UT-006, UT-007]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (45-3). [UT-006]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (Utah Code 58-67-102(11) cosmetic medical procedure plus supervision rules). [UT-009]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [UT-007, U-97]
Sources:
- [UT-001] Utah Code 13-61-102(1) (https://le.utah.gov/xcode/Title13/Chapter61/13-61-S102.html)
- [UT-002] Utah Code 13-61-102(2)(e)-(g) (2)(e),(f),(g) (https://le.utah.gov/xcode/Title13/Chapter61/13-61-S102.html)
- [UT-005] Utah Code 13-44-102, -202, -301 (https://le.utah.gov/xcode/Title13/Chapter44/13-44-S202.html)
- [UT-006] Utah Code 45-3-3, 45-3-4, 45-3-6 (https://le.utah.gov/xcode/Title45/Chapter3/45-3-S4.html)
- [UT-007] 2008 UT 8, 177 P.3d 614 pinpoint not verified (https://www.courtlistener.com/opinion/2561848/sorensen-v-barbuto/)
- [UT-009] Utah Code 58-67-102(11) (https://le.utah.gov/xcode/Title58/Chapter67/C58-67-S102_2026010120250507.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Utah (UT) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Sorensen v. Barbuto (2008 UT 8) duty of confidentiality; Title 58 has no explicit confidentiality ground located | Yes - applies to licensed providers regardless of HIPAA status | UCPA 13-61: $25M revenue threshold; entity-level HIPAA exemption; sensitive data opt-out; licensed providers' health data excluded | 13-44: medical info NOT covered; AG/Cyber Center if 500+ | Common-law duty (Sorensen); licensing rules (R156-1-502 not verified) | 45-3 Abuse of Personal Identity Act consent for advertising; HIPAA if covered | Utah Code 45-3-3 to -6 (injunction, damages, exemplary damages, fees) | Yes: 45-3-6; common-law tort; no UCPA or 13-44 private action | DOPL (Physicians Licensing Board, Dentist Board, Nursing Board), AG, Division of Consumer Protection | UCPA up to $7,500/violation; 13-44 up to $2,500/consumer, $100,000 aggregate | E4 (no UT AG UCPA or 13-44 action vs. aesthetic practice located) | High | 2026-10-22 |
| Utah (UT) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Sorensen v. Barbuto (2008 UT 8) duty of confidentiality; Title 58 has no explicit confidentiality ground located | Yes - applies to licensed providers regardless of HIPAA status | UCPA 13-61: $25M revenue threshold; entity-level HIPAA exemption; sensitive data opt-out; licensed providers' health data excluded | 13-44: medical info NOT covered; AG/Cyber Center if 500+ | Common-law duty (Sorensen); licensing rules (R156-1-502 not verified) | 45-3 Abuse of Personal Identity Act consent for advertising; HIPAA if covered | Utah Code 45-3-3 to -6 (injunction, damages, exemplary damages, fees) | Yes: 45-3-6; common-law tort; no UCPA or 13-44 private action | DOPL (Physicians Licensing Board, Dentist Board, Nursing Board), AG, Division of Consumer Protection | UCPA up to $7,500/violation; 13-44 up to $2,500/consumer, $100,000 aggregate | E4 (no UT AG UCPA or 13-44 action vs. aesthetic practice located) | High | 2026-10-22 |
| Utah (UT) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Sorensen v. Barbuto (2008 UT 8) duty of confidentiality; Title 58 has no explicit confidentiality ground located | Yes - applies to licensed providers regardless of HIPAA status | UCPA 13-61: $25M revenue threshold; entity-level HIPAA exemption; sensitive data opt-out; licensed providers' health data excluded | 13-44: medical info NOT covered; AG/Cyber Center if 500+ | Common-law duty (Sorensen); licensing rules (R156-1-502 not verified) | 45-3 Abuse of Personal Identity Act consent for advertising; HIPAA if covered | Utah Code 45-3-3 to -6 (injunction, damages, exemplary damages, fees) | Yes: 45-3-6; common-law tort; no UCPA or 13-44 private action | DOPL (Physicians Licensing Board, Dentist Board, Nursing Board), AG, Division of Consumer Protection | UCPA up to $7,500/violation; 13-44 up to $2,500/consumer, $100,000 aggregate | E4 (no UT AG UCPA or 13-44 action vs. aesthetic practice located) | High | 2026-10-22 |
| Utah (UT) | Medical med spa | Depends; cash-only med spas often not covered | Sorensen v. Barbuto (2008 UT 8) duty of confidentiality; Title 58 has no explicit confidentiality ground located | Yes - applies to licensed providers regardless of HIPAA status | UCPA 13-61: $25M revenue threshold; entity-level HIPAA exemption; sensitive data opt-out; licensed providers' health data excluded | 13-44: medical info NOT covered; AG/Cyber Center if 500+ | Common-law duty (Sorensen); licensing rules (R156-1-502 not verified) | 45-3 Abuse of Personal Identity Act consent for advertising; HIPAA if covered | Utah Code 45-3-3 to -6 (injunction, damages, exemplary damages, fees) | Yes: 45-3-6; common-law tort; no UCPA or 13-44 private action | DOPL (Physicians Licensing Board, Dentist Board, Nursing Board), AG, Division of Consumer Protection | UCPA up to $7,500/violation; 13-44 up to $2,500/consumer, $100,000 aggregate | E4 (no UT AG UCPA or 13-44 action vs. aesthetic practice located) | High | 2026-10-22 |
| Utah (UT) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Sorensen v. Barbuto (2008 UT 8) duty of confidentiality; Title 58 has no explicit confidentiality ground located | Sorensen duty runs to physicians; UCPA applies only at $25M revenue | UCPA 13-61: $25M revenue threshold; entity-level HIPAA exemption; sensitive data opt-out; licensed providers' health data excluded | 13-44: medical info NOT covered; AG/Cyber Center if 500+ | Common-law duty (Sorensen); licensing rules (R156-1-502 not verified) | 45-3 Abuse of Personal Identity Act consent for advertising; HIPAA if covered | Utah Code 45-3-3 to -6 (injunction, damages, exemplary damages, fees) | Yes: 45-3-6; common-law tort; no UCPA or 13-44 private action | DOPL (Physicians Licensing Board, Dentist Board, Nursing Board), AG, Division of Consumer Protection | UCPA up to $7,500/violation; 13-44 up to $2,500/consumer, $100,000 aggregate | E4 (no UT AG UCPA or 13-44 action vs. aesthetic practice located) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Sorensen v. Barbuto
Utah Supreme Court · UT · 2008-02-01
- Provider type
- Physician
- Relevant facts
- Treating physician had ex parte communications with defense counsel in patient's lawsuit
- Legal issues
- Physician duty of confidentiality; waiver by litigation
- Holding, findings, allegations or settlement terms
- Duty of confidentiality recognized; filing suit did not waive it for ex parte communications (pinpoints unverified)
- Consequences recorded
- n/a
- Procedural status
- Final
- Precedential?
- Yes (Utah Supreme Court)
- Why it is in this research
- Putting one's health at issue does not broadly waive confidentiality (analog to the review 'waiver' myth)
Related pages
Topics
Healthcare industry
Sources
UT-001. Utah Code 13-61-102(1)
UCPA applies only to controllers with annual revenue of at least $25 million that also process data of 100,000+ Utah consumers or derive >50% revenue from data sales and process 25,000+ consumers.
Statute · Explicit · High · Nearly all aesthetic practices fall below the $25M revenue threshold (inference).
UT-002. Utah Code 13-61-102(2)(e)-(g)
UCPA exempts covered entities and business associates at the entity level and PHI at the data level.
Statute · Explicit · High
UT-005. Utah Code 13-44-102, -202, -301
Breach law 'personal information' is limited to SSN, financial account with code, and driver's license/state ID; medical information is not covered; notice if misuse is likely; AG and Utah Cyber Center notice if 500+; AG enforcement up to $2,500 per consumer and $100,000 aggregate (exceptions); no private action.
Statute · Explicit · High
UT-007. 2008 UT 8, 177 P.3d 614
Utah Supreme Court recognized a physician's duty of confidentiality and held a patient's lawsuit did not waive confidentiality as to ex parte communications with opposing counsel (Sorensen v. Barbuto).
Judicial decision · Explicit (case located; holding per CourtListener snippet) · Medium · Supports the point that putting one's health at issue does not broadly waive confidentiality; not a review case.
https://www.courtlistener.com/opinion/2561848/sorensen-v-barbuto/
UT-006. Utah Code 45-3-3, 45-3-4, 45-3-6
Abuse of Personal Identity Act (amended 2026): use of a person's personal identity (including a simulation/replication) for advertising without consent is actionable; remedies include injunction, damages, exemplary damages and attorney fees.
Statute · Explicit · High · Exact statutory elements (e.g., implied endorsement) should be read in full before relying.
UT-009. Utah Code 58-67-102(11)
Med spa: the Utah Medical Practice Act defines 'cosmetic medical procedure' to include using cosmetic medical devices for ablative or nonablative procedures and injecting a medication or substance, including a neurotoxin or filler, for cosmetic purposes (Utah Code 58-67-102(11)); supervision and delegation rules for these procedures appear elsewhere in the Act.
Statute · Explicit (definition); supervision rules not read on the official host · Medium · Med spa pass, final phase part 2 (2026-10-22). Definition read on the official host (V-068); supervision provisions (e.g., 58-1-506) read only on FindLaw (U-99). A 2026 interim committee review of med spas exists (le.utah.gov interim doc 00003470), not read.
https://le.utah.gov/xcode/Title58/Chapter67/C58-67-S102_2026010120250507.pdf
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All