What a provider can and can't say in Vermont
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | Lawson tort; 1354(a)(27) applied to HIPAA (Brody 2025); no review-reply order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | Lawson tort; 1354(a)(27) applied to HIPAA (Brody 2025); no review-reply order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | Lawson tort; 1354(a)(27) applied to HIPAA (Brody 2025); no review-reply order located |
| Medical med spa | Depends; cash-only med spas often not covered | Partly: Lawson and board grounds reach licensees; 1881 CE/BA only; Act 145 health-data rules from 2028 | Lawson tort; 1354(a)(27) applied to HIPAA (Brody 2025); no review-reply order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Not yet: Act 145 consumer-health-data rules apply from 2028-01-01 regardless of size | Lawson tort; 1354(a)(27) applied to HIPAA (Brody 2025); no review-reply order located |
- Consumer privacy and health data law: Vermont has enacted a consumer privacy law that is not yet in effect (Act 145 (S.71), eff. 2028-01-01 (health-data rules any size)); it binds no one until its effective date. Once effective, it exempts HIPAA-covered practices as a whole (an entity-level exemption). [VT-001, VT-002]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general, with preliminary notice within 14 business days; HIPAA deemed compliant. [VT-004]
- Patient confidentiality duties: Patient confidentiality duties come mainly from statute (1881) and tort (Lawson) and board. [VT-005, VT-006, VT-007]
- Patient confidentiality duties: Board discipline for confidentiality breaches rests on a general professional-conduct ground (1354(a)(27)). [VT-007]
- Lawsuits by individuals: Patients may be able to sue in some situations (Lawson). [VT-006]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (Procedure statute plus guidance). [VT-007, VT-009]
- Enforcement located: Strongest state enforcement evidence located: related official enforcement, or official charges that are allegations only (E2) (Board of Medical Practice, Brody, 2025). Not finding enforcement does not mean none exists. [VT-008]
Sources:
- [VT-001] Governor's veto letter, H.121 (2024) (https://governor.vermont.gov/)
- [VT-002] 2026 Vt. Acts No. 145, Sec. 2 (9 V.S.A. 2415b(a)-(b), 2415c(a)(2)) (https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)
- [VT-004] 9 V.S.A. 2430(10)(A)(vii); 2435(b)(1), (b)(3), (e) (https://legislature.vermont.gov/statutes/section/09/062/02430)
- [VT-005] 18 V.S.A. 1881(a)-(b) (https://legislature.vermont.gov/statutes/section/18/042B/01881)
- [VT-006] Lawson v. Halpern-Reiss, 2019 VT 38, 212 A.3d 1213 (https://www.vtcourts.gov/sites/default/files/documents/op18-157.pdf)
- [VT-007] 26 V.S.A. 1354(a)(7), (a)(27), (a)(29); 3 V.S.A. 129a(a)(3), (6) (https://legislature.vermont.gov/statutes/section/26/023/01354)
- [VT-008] In re David S. Brody, MD, Docket No. MPS 038-0425 Conclusions paras. 16-19; Order paras. 1-2 (https://www.healthvermont.gov/sites/default/files/document/bmp-brody-stipulation-and-consent-order-12.03.2025.pdf)
- [VT-009] 26 V.S.A. 271(4)(B)(ii); Joint Statement Regarding IV Therapy Clinics and Medical Spas (2024-06-05) (https://legislature.vermont.gov/statutes/section/26/006/00271)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Vermont (VT) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | 18 V.S.A. 1881 (HIPAA standard as state law for CE/BA); Lawson common-law action; 26 V.S.A. 1354(a)(27) federal-law ground | Yes - applies to licensed providers regardless of HIPAA status | Act 145 (S.71) enacted, NOT yet effective (2028-01-01): health-data rules regardless of thresholds; ENTITY-level exemption for non-hybrid CEs and BAs; H.121 vetoed 2024 | 9 V.S.A. 2430/2435: medical info COVERED; 45 days; AG prelim 14 business days; HIPAA deemed compliance | Lawson tort; 1354(a)(27) applied to HIPAA (Brody 2025); no review-reply order located | HIPAA if covered; 1881; Act 145 from 2028; likeness common law (not researched) | None statutory located (common law not researched) | Yes: Lawson common-law damages action; none under Act 145 | Board of Medical Practice (Dept. of Health), OPR (osteopathic, nursing, dental, esthetics), AG | BMP administrative penalty (maximum not verified). Example outcome, not a maximum: Brody $500; Act 145 via Consumer Protection Act (from 2028) | E2 (BMP Brody 2025, HIPAA via 1354(a)(27)) | High | 2026-10-22 |
| Vermont (VT) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | 18 V.S.A. 1881 (HIPAA standard as state law for CE/BA); Lawson common-law action; 26 V.S.A. 1354(a)(27) federal-law ground | Yes - applies to licensed providers regardless of HIPAA status | Act 145 (S.71) enacted, NOT yet effective (2028-01-01): health-data rules regardless of thresholds; ENTITY-level exemption for non-hybrid CEs and BAs; H.121 vetoed 2024 | 9 V.S.A. 2430/2435: medical info COVERED; 45 days; AG prelim 14 business days; HIPAA deemed compliance | Lawson tort; 1354(a)(27) applied to HIPAA (Brody 2025); no review-reply order located | HIPAA if covered; 1881; Act 145 from 2028; likeness common law (not researched) | None statutory located (common law not researched) | Yes: Lawson common-law damages action; none under Act 145 | Board of Medical Practice (Dept. of Health), OPR (osteopathic, nursing, dental, esthetics), AG | BMP administrative penalty (maximum not verified). Example outcome, not a maximum: Brody $500; Act 145 via Consumer Protection Act (from 2028) | E2 (BMP Brody 2025, HIPAA via 1354(a)(27)) | High | 2026-10-22 |
| Vermont (VT) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | 18 V.S.A. 1881 (HIPAA standard as state law for CE/BA); Lawson common-law action; 26 V.S.A. 1354(a)(27) federal-law ground | Yes - applies to licensed providers regardless of HIPAA status | Act 145 (S.71) enacted, NOT yet effective (2028-01-01): health-data rules regardless of thresholds; ENTITY-level exemption for non-hybrid CEs and BAs; H.121 vetoed 2024 | 9 V.S.A. 2430/2435: medical info COVERED; 45 days; AG prelim 14 business days; HIPAA deemed compliance | Lawson tort; 1354(a)(27) applied to HIPAA (Brody 2025); no review-reply order located | HIPAA if covered; 1881; Act 145 from 2028; likeness common law (not researched) | None statutory located (common law not researched) | Yes: Lawson common-law damages action; none under Act 145 | Board of Medical Practice (Dept. of Health), OPR (osteopathic, nursing, dental, esthetics), AG | BMP administrative penalty (maximum not verified). Example outcome, not a maximum: Brody $500; Act 145 via Consumer Protection Act (from 2028) | E2 (BMP Brody 2025, HIPAA via 1354(a)(27)) | High | 2026-10-22 |
| Vermont (VT) | Medical med spa | Depends; cash-only med spas often not covered | 18 V.S.A. 1881 (HIPAA standard as state law for CE/BA); Lawson common-law action; 26 V.S.A. 1354(a)(27) federal-law ground | Partly: Lawson and board grounds reach licensees; 1881 CE/BA only; Act 145 health-data rules from 2028 | Act 145 (S.71) enacted, NOT yet effective (2028-01-01): health-data rules regardless of thresholds; ENTITY-level exemption for non-hybrid CEs and BAs; H.121 vetoed 2024 | 9 V.S.A. 2430/2435: medical info COVERED; 45 days; AG prelim 14 business days; HIPAA deemed compliance | Lawson tort; 1354(a)(27) applied to HIPAA (Brody 2025); no review-reply order located | HIPAA if covered; 1881; Act 145 from 2028; likeness common law (not researched) | None statutory located (common law not researched) | Yes: Lawson common-law damages action; none under Act 145 | Board of Medical Practice (Dept. of Health), OPR (osteopathic, nursing, dental, esthetics), AG | BMP administrative penalty (maximum not verified). Example outcome, not a maximum: Brody $500; Act 145 via Consumer Protection Act (from 2028) | E2 (BMP Brody 2025, HIPAA via 1354(a)(27)) | High | 2026-10-22 |
| Vermont (VT) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | 18 V.S.A. 1881 (HIPAA standard as state law for CE/BA); Lawson common-law action; 26 V.S.A. 1354(a)(27) federal-law ground | Not yet: Act 145 consumer-health-data rules apply from 2028-01-01 regardless of size | Act 145 (S.71) enacted, NOT yet effective (2028-01-01): health-data rules regardless of thresholds; ENTITY-level exemption for non-hybrid CEs and BAs; H.121 vetoed 2024 | 9 V.S.A. 2430/2435: medical info COVERED; 45 days; AG prelim 14 business days; HIPAA deemed compliance | Lawson tort; 1354(a)(27) applied to HIPAA (Brody 2025); no review-reply order located | HIPAA if covered; 1881; Act 145 from 2028; likeness common law (not researched) | None statutory located (common law not researched) | Yes: Lawson common-law damages action; none under Act 145 | Board of Medical Practice (Dept. of Health), OPR (osteopathic, nursing, dental, esthetics), AG | BMP administrative penalty (maximum not verified). Example outcome, not a maximum: Brody $500; Act 145 via Consumer Protection Act (from 2028) | E2 (BMP Brody 2025, HIPAA via 1354(a)(27)) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Lawson v. Halpern-Reiss
Vermont Supreme Court · VT · 2019
- Provider type
- Hospital (charge nurse)
- Relevant facts
- Nurse told police that a patient who had been drinking was about to drive
- Legal issues
- Common-law private right of action for unjustified disclosure of treatment information
- Holding, findings, allegations or settlement terms
- Judicial holding: action recognized; summary judgment for hospital affirmed because disclosure was to mitigate an imminent threat
- Consequences recorded
- None (defense judgment)
- Procedural status
- Final (precedent)
- Precedential?
- Yes (state high court)
- Why it is in this research
- Private claims over unjustified disclosures (application inferred); HIPAA informs the standard
Vermont Board of Medical Practice: David S. Brody, MD
Vermont Board of Medical Practice · VT (state licensing) · 2025-12-03 (per file name)
- Provider type
- Physician (internal medicine)
- Relevant facts
- Accessed three relatives' hospital records 40 times without a treatment relationship, against hospital policy
- Legal issues
- 26 V.S.A. 1354(a)(27) (failure to comply with HIPAA: 45 CFR 164.306(a)(1), 42 U.S.C. 1320d-6); 1354(a)(7)
- Holding, findings, allegations or settlement terms
- Stipulated findings and conclusions (consent order)
- Consequences recorded
- Reprimand; two CME courses; $500 administrative penalty
- Procedural status
- Final
- Precedential?
- No
- Why it is in this research
- Board enforces HIPAA through a 'comply with federal law' ground (E2; snooping, not public disclosure)
Related pages
Topics
Healthcare industry
Sources
VT-001. Governor's veto letter, H.121 (2024)
H.121 (2024 comprehensive privacy bill with a private right of action) was VETOED on 2024-06-13; the Senate sustained the veto on 2024-06-17. Not law.
Executive action (veto) · Explicit (veto letter) / Senate vote per search · High (veto) / Medium (vote) · Do not cite H.121 as law.
VT-002. 2026 Vt. Acts No. 145, Sec. 2 (9 V.S.A. 2415b(a)-(b), 2415c(a)(2))
Vermont Data Privacy and Online Surveillance Act (S.71, Act 145 of the 2025 Adj. Sess.), 9 V.S.A. 2415a-2415k, signed 2026-06-16: enacted, NOT YET EFFECTIVE (effective 2028-01-01). Thresholds: 35,000 consumers, or sensitive data of 3,000+, or selling data of 3,000+; consumer-health-data provisions apply regardless of thresholds. ENTITY-level exemption for a HIPAA covered entity that is not a hybrid entity, the health care component of a hybrid entity, and business associates.
Statute (act as enacted) · Explicit · High · Non-HIPAA med spas and aesthetic businesses will be covered by the health-data rules regardless of size from 2028 (inference from 2415b(b)).
https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf
VT-004. 9 V.S.A. 2430(10)(A)(vii); 2435(b)(1), (b)(3), (e)
Breach law: 'personally identifiable information' includes health records or records of a health care professional's diagnosis or treatment, and health insurance policy numbers; notice within 45 days; preliminary AG notice within 14 business days; a HIPAA-covered entity is deemed compliant for a breach limited to health information if it notifies under HIPAA (and copies the AG per the text read).
Statute · Explicit · High · Medical information IS covered. 2025 No. 138 (Adj. Sess.) amendments effective 2027-01-01 not analyzed (U-83).
https://legislature.vermont.gov/statutes/section/09/062/02430
VT-005. 18 V.S.A. 1881(a)-(b)
A HIPAA covered entity or business associate shall not disclose protected health information unless HIPAA permits the disclosure (with further limits for legally protected health care activity), making HIPAA's disclosure standard Vermont law.
Statute · Explicit · High · Covered entities only. Remedy for violation of 1881 not stated in the text read.
https://legislature.vermont.gov/statutes/section/18/042B/01881
VT-006. Lawson v. Halpern-Reiss, 2019 VT 38, 212 A.3d 1213
Vermont Supreme Court recognized a common-law private right of action for damages based on a medical provider's unjustified disclosure to third persons of information obtained during treatment (HIPAA informs the standard of conduct); summary judgment for the hospital was affirmed because the disclosure was made to mitigate an imminent threat.
Judicial decision · Explicit (opinion read) · High · Supports private claims over review replies that disclose patient information (application inferred).
https://www.vtcourts.gov/sites/default/files/documents/op18-157.pdf
VT-007. 26 V.S.A. 1354(a)(7), (a)(27), (a)(29); 3 V.S.A. 129a(a)(3), (6)
Board of Medical Practice grounds: failing to comply with federal or state statutes or rules governing the practice of medicine and conduct evidencing unfitness are unprofessional conduct; the Board has applied 1354(a)(27) to HIPAA violations (see VT-008). Improper delegation is also a ground (1354(a)(29); 3 V.S.A. 129a(a)(6)).
Statute · Explicit · High · No explicit confidentiality item in 1354.
https://legislature.vermont.gov/statutes/section/26/023/01354
VT-009. 26 V.S.A. 271(4)(B)(ii); Joint Statement Regarding IV Therapy Clinics and Medical Spas (2024-06-05)
Esthetics excludes any practice that is the practice of medicine, 'including injections of any substance and the use of lasers'; OPR and four boards' joint statement (2024-06-05) says Vermont has no med spa-specific law, IV therapy is the practice of medicine, and standing orders from a medical director are not valid prescriptions.
Statute + guidance · Explicit · High (statute) / guidance · Joint statement is guidance; PDF at healthvermont.gov.
https://legislature.vermont.gov/statutes/section/26/006/00271
VT-008. In re David S. Brody, MD, Docket No. MPS 038-0425
BMP stipulation and consent order: an internist accessed three relatives' hospital records 40 times without treatment justification; the Board concluded he failed to comply with HIPAA (citing 45 CFR 164.306(a)(1) and 42 U.S.C. 1320d-6) in violation of 26 V.S.A. 1354(a)(27) and engaged in conduct evidencing unfitness (a)(7); reprimand, CME, $500 administrative penalty.
Enforcement (licensing; stipulated consent order) · Explicit · High · E2 (record snooping, not public disclosure) but shows a state board enforcing HIPAA itself through a 'comply with federal law' ground.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All