What a provider can and can't say in Virginia
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 32.1-127.1:03 + 18VAC85-20-27; (D)(3) 'defend against accusation' wording untested for reviews; Board reprimanded a defensive review reply (Buyse 2020) |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 32.1-127.1:03 + 18VAC85-20-27; (D)(3) 'defend against accusation' wording untested for reviews; Board reprimanded a defensive review reply (Buyse 2020) |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 32.1-127.1:03 + 18VAC85-20-27; (D)(3) 'defend against accusation' wording untested for reviews; Board reprimanded a defensive review reply (Buyse 2020) |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 32.1-127.1:03 + 18VAC85-20-27; (D)(3) 'defend against accusation' wording untested for reviews; Board reprimanded a defensive review reply (Buyse 2020) |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No (estheticians are DPOR-regulated, not DHP; inference) | 32.1-127.1:03 + 18VAC85-20-27; (D)(3) 'defend against accusation' wording untested for reviews; Board reprimanded a defensive review reply (Buyse 2020) |
- Consumer privacy and health data law: Virginia has a consumer privacy law in force (VCDPA). It exempts HIPAA-covered practices as a whole (an entity-level exemption). [VA-001, VA-006]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Regulator notice: attorney general. [VA-008]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (32.1-127.1:03). [VA-001, VA-002]
- Patient confidentiality duties: The licensing board can discipline willful breaches of patient confidentiality (18VAC85-20-27). [VA-003]
- Lawsuits by individuals: Patients may be able to sue in some situations (8.01-40). [VA-009]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (8.01-40). [VA-008, VA-009]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (binding laser rule) plus guidance (Doc 76-1). [VA-003, VA-004]
- Enforcement located: Strongest state enforcement evidence located: official enforcement against comparable conduct (E1) (Board of Medicine, Buyse). Not finding enforcement does not mean none exists. [VA-010]
- Research notes and gaps: Virginia's 2026 legislative changes were not re-read; confirm the current code. [U-57]
Sources:
- [VA-001] Va. Code 32.1-127.1:03 (A), (B) (https://law.lis.virginia.gov/vacode/title32.1/chapter5/section32.1-127.1:03/)
- [VA-002] Va. Code 32.1-127.1:03(D)(1), (D)(3); 8.01-399(F) (https://law.lis.virginia.gov/vacode/title32.1/chapter5/section32.1-127.1:03/)
- [VA-003] 18VAC85-20-26(A), -27(A), -28(A)(1), -29(A)(1) (https://law.lis.virginia.gov/admincode/title18/agency85/chapter20/section27/)
- [VA-004] 18VAC85-20-91 (A)-(E) (https://law.lis.virginia.gov/admincode/title18/agency85/chapter20/section91/)
- [VA-006] Va. Code 59.1-575; 59.1-576(A), (B), (C)(1)-(2); 59.1-578(A)(5) (https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-576/)
- [VA-008] Va. Code 18.2-186.6 (A), (B), (E), (I) (https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/)
- [VA-009] Va. Code 8.01-40 (https://law.lis.virginia.gov/vacode/title8.01/chapter3/section8.01-40/)
- [VA-010] In re Valerie Josephine Buyse, M.D., Case No. 194473 Findings 2(a)-(b), 4; Order (https://www.dhp.virginia.gov/Notices/Medicine/0101037982/0101037982Order02112020.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Virginia (VA) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Health Records Privacy Act 32.1-127.1:03 (all DHP licensees); 18VAC85-20-26/27 (Board of Medicine) | Yes - applies to licensed providers regardless of HIPAA status | VCDPA (59.1-575+): ENTITY-level HIPAA exemption; thresholds 100k / 25k+50%; sensitive data needs consent | 18.2-186.6: medical info NOT covered; without unreasonable delay; AG notice; 32.1-127.1:05 covers public entities only | 32.1-127.1:03 + 18VAC85-20-27; (D)(3) 'defend against accusation' wording untested for reviews; Board reprimanded a defensive review reply (Buyse 2020) | Written authorization (32.1-127.1:03(D)(1)); 8.01-40 written consent for advertising use; HIPAA if covered | Va. Code 8.01-40 (written consent; damages, punitive if knowing) | Yes: 8.01-40; breach 18.2-186.6(I) direct economic damages; none under VCDPA; HRPA private action not located | Board of Medicine, Board of Dentistry, Board of Nursing (DHP), DPOR (estheticians), AG | VCDPA up to $7,500/violation; breach up to $150,000 per breach; license discipline | E1 (Va. Bd. of Medicine, Buyse 2020: review-response disclosure, reprimand; official DHP copy) | High | 2026-10-22 |
| Virginia (VA) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Health Records Privacy Act 32.1-127.1:03 (all DHP licensees); 18VAC85-20-26/27 (Board of Medicine) | Yes - applies to licensed providers regardless of HIPAA status | VCDPA (59.1-575+): ENTITY-level HIPAA exemption; thresholds 100k / 25k+50%; sensitive data needs consent | 18.2-186.6: medical info NOT covered; without unreasonable delay; AG notice; 32.1-127.1:05 covers public entities only | 32.1-127.1:03 + 18VAC85-20-27; (D)(3) 'defend against accusation' wording untested for reviews; Board reprimanded a defensive review reply (Buyse 2020) | Written authorization (32.1-127.1:03(D)(1)); 8.01-40 written consent for advertising use; HIPAA if covered | Va. Code 8.01-40 (written consent; damages, punitive if knowing) | Yes: 8.01-40; breach 18.2-186.6(I) direct economic damages; none under VCDPA; HRPA private action not located | Board of Medicine, Board of Dentistry, Board of Nursing (DHP), DPOR (estheticians), AG | VCDPA up to $7,500/violation; breach up to $150,000 per breach; license discipline | E1 (Va. Bd. of Medicine, Buyse 2020: review-response disclosure, reprimand; official DHP copy) | High | 2026-10-22 |
| Virginia (VA) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Health Records Privacy Act 32.1-127.1:03 (all DHP licensees); 18VAC85-20-26/27 (Board of Medicine) | Yes - applies to licensed providers regardless of HIPAA status | VCDPA (59.1-575+): ENTITY-level HIPAA exemption; thresholds 100k / 25k+50%; sensitive data needs consent | 18.2-186.6: medical info NOT covered; without unreasonable delay; AG notice; 32.1-127.1:05 covers public entities only | 32.1-127.1:03 + 18VAC85-20-27; (D)(3) 'defend against accusation' wording untested for reviews; Board reprimanded a defensive review reply (Buyse 2020) | Written authorization (32.1-127.1:03(D)(1)); 8.01-40 written consent for advertising use; HIPAA if covered | Va. Code 8.01-40 (written consent; damages, punitive if knowing) | Yes: 8.01-40; breach 18.2-186.6(I) direct economic damages; none under VCDPA; HRPA private action not located | Board of Medicine, Board of Dentistry, Board of Nursing (DHP), DPOR (estheticians), AG | VCDPA up to $7,500/violation; breach up to $150,000 per breach; license discipline | E1 (Va. Bd. of Medicine, Buyse 2020: review-response disclosure, reprimand; official DHP copy) | High | 2026-10-22 |
| Virginia (VA) | Medical med spa | Depends; cash-only med spas often not covered | Health Records Privacy Act 32.1-127.1:03 (all DHP licensees); 18VAC85-20-26/27 (Board of Medicine) | Yes - applies to licensed providers regardless of HIPAA status | VCDPA (59.1-575+): ENTITY-level HIPAA exemption; thresholds 100k / 25k+50%; sensitive data needs consent | 18.2-186.6: medical info NOT covered; without unreasonable delay; AG notice; 32.1-127.1:05 covers public entities only | 32.1-127.1:03 + 18VAC85-20-27; (D)(3) 'defend against accusation' wording untested for reviews; Board reprimanded a defensive review reply (Buyse 2020) | Written authorization (32.1-127.1:03(D)(1)); 8.01-40 written consent for advertising use; HIPAA if covered | Va. Code 8.01-40 (written consent; damages, punitive if knowing) | Yes: 8.01-40; breach 18.2-186.6(I) direct economic damages; none under VCDPA; HRPA private action not located | Board of Medicine, Board of Dentistry, Board of Nursing (DHP), DPOR (estheticians), AG | VCDPA up to $7,500/violation; breach up to $150,000 per breach; license discipline | E1 (Va. Bd. of Medicine, Buyse 2020: review-response disclosure, reprimand; official DHP copy) | High | 2026-10-22 |
| Virginia (VA) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Health Records Privacy Act 32.1-127.1:03 (all DHP licensees); 18VAC85-20-26/27 (Board of Medicine) | No (estheticians are DPOR-regulated, not DHP; inference) | VCDPA (59.1-575+): ENTITY-level HIPAA exemption; thresholds 100k / 25k+50%; sensitive data needs consent | 18.2-186.6: medical info NOT covered; without unreasonable delay; AG notice; 32.1-127.1:05 covers public entities only | 32.1-127.1:03 + 18VAC85-20-27; (D)(3) 'defend against accusation' wording untested for reviews; Board reprimanded a defensive review reply (Buyse 2020) | Written authorization (32.1-127.1:03(D)(1)); 8.01-40 written consent for advertising use; HIPAA if covered | Va. Code 8.01-40 (written consent; damages, punitive if knowing) | Yes: 8.01-40; breach 18.2-186.6(I) direct economic damages; none under VCDPA; HRPA private action not located | Board of Medicine, Board of Dentistry, Board of Nursing (DHP), DPOR (estheticians), AG | VCDPA up to $7,500/violation; breach up to $150,000 per breach; license discipline | E1 (Va. Bd. of Medicine, Buyse 2020: review-response disclosure, reprimand; official DHP copy) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Virginia Board of Medicine: Valerie Josephine Buyse, M.D.
Virginia Board of Medicine · VA (state licensing) · 2020-02-11
- Provider type
- Physician (psychiatry)
- Relevant facts
- Patient posted a named negative review; physician's online reply, made to defend her care, disclosed intake-form information, diagnoses, medications and psychotherapy participation; she then texted the patient about 'defamation'
- Legal issues
- Va. Code 54.1-2915(A)(3), (12); 18VAC85-20-26(A) (Health Records Privacy Act); 18VAC85-20-27(A)
- Holding, findings, allegations or settlement terms
- Findings of fact and conclusions of law admitted in consent order
- Consequences recorded
- Reprimand
- Procedural status
- Final (consent order)
- Precedential?
- No
- Why it is in this research
- Direct state-board precedent: a defensive review reply disclosing patient information was sanctioned in VA
Related pages
Topics
Healthcare industry
Sources
VA-001. Va. Code 32.1-127.1:03
Health Records Privacy Act: patients have a right of privacy in their health records; no health care entity, or other person working in a health care setting, may disclose them except as the section permits. 'Health care provider' includes everyone licensed, certified, registered or permitted by a DHP health regulatory board; 'health record' includes information acquired in confidence.
Statute · Explicit · High · Applies regardless of HIPAA status to DHP licensees. Estheticians are DPOR-regulated, so not covered (inference). No private right of action located in the section (not confirmed).
https://law.lis.virginia.gov/vacode/title32.1/chapter5/section32.1-127.1:03/
VA-006. Va. Code 59.1-575; 59.1-576(A), (B), (C)(1)-(2); 59.1-578(A)(5)
VCDPA applies at 100,000 consumers (or 25,000 with 50%+ revenue from data sales) and exempts HIPAA covered entities and business associates at the ENTITY level, plus PHI and Title 32.1 health records at the data level. Sensitive data (mental or physical health diagnosis; biometric data used to identify) requires consent; biometric data excludes photos and videos.
Statute · Explicit · High · Non-HIPAA med spas and aesthetic businesses can be in scope only above the thresholds (inference: most are below).
https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-576/
VA-008. Va. Code 18.2-186.6
General breach law 'personal information' = SSN, driver's license, financial account with code, passport or military ID; medical information is NOT covered. Notice to the AG and residents without unreasonable delay when identity theft or fraud is reasonably believed; AG and consumer reporting agencies if more than 1,000; AG penalty up to $150,000 per breach or series; individuals may recover direct economic damages.
Statute · Explicit · High · The separate medical-information breach law (32.1-127.1:05) covers public bodies and publicly funded organizations and excludes HIPAA CEs/BAs, so it generally does not reach private practices.
https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/
VA-002. Va. Code 32.1-127.1:03(D)(1), (D)(3); 8.01-399(F)
Disclosure generally requires the patient's written authorization; one exception allows disclosure 'in accord with 8.01-399(F)' where reasonably necessary to establish or collect a fee or to defend a health care entity or its employees or staff 'against any accusation of wrongful conduct'.
Statute · Explicit (text); application to reviews inferred · High (text) / Low (application) · No authority applies (D)(3) to online reviews. HIPAA is more stringent for covered entities, and the Board reprimanded a psychiatrist for a defensive review reply (VA-010). Do not treat (D)(3) as a review-response safe harbor.
https://law.lis.virginia.gov/vacode/title32.1/chapter5/section32.1-127.1:03/
VA-003. 18VAC85-20-26(A), -27(A), -28(A)(1), -29(A)(1)
Board of Medicine regulations: practitioners must comply with 32.1-127.1:03 (18VAC85-20-26(A)); 'A practitioner shall not willfully or negligently breach the confidentiality between a practitioner and a patient' (18VAC85-20-27(A)); no false statements about skill or efficacy (-28); delegate only to properly trained and supervised persons (-29).
Regulation · Explicit · High · A disclosure required or permitted by law is not willful or negligent. Reached through 54.1-2915(A)(18) (violating Board regulations).
https://law.lis.virginia.gov/admincode/title18/agency85/chapter20/section27/
VA-009. Va. Code 8.01-40
Statutory likeness right: using a person's name, portrait or picture for advertising or trade without written consent supports injunction and damages, and punitive damages if knowing (amended 2026).
Statute · Explicit · High · Before/after photos used in ads without written consent fall squarely within the text (inference). 2026 amendment details not analyzed.
https://law.lis.virginia.gov/vacode/title8.01/chapter3/section8.01-40/
VA-004. 18VAC85-20-91
Laser hair removal: an MD/DO must complete listed training (six areas including 10 proctored cases); a delegating doctor must ensure a non-PA/NP delegatee completed the training, may delegate to a properly trained person under direction and supervision, must be 'readily available' (physical presence not required), and must see and evaluate the patient after any complication.
Regulation · Explicit · High · Binding med spa / delegation rule for laser hair removal only.
https://law.lis.virginia.gov/admincode/title18/agency85/chapter20/section91/
VA-010. In re Valerie Josephine Buyse, M.D., Case No. 194473
Virginia Board of Medicine consent order: a psychiatrist answered a patient's negative online review 'in order to defend her care and treatment' and disclosed intake-form information, diagnoses, medications and psychotherapy participation; findings (admitted) of violations of 54.1-2915(A)(3) and (12), 18VAC85-20-26(A) and 18VAC85-20-27(A); reprimand.
Enforcement (licensing; consent order with admitted findings) · Explicit (official order read) · High · Official DHP copy retrieved via License Lookup (license 0101037982 > Additional Public Information > Notices and Orders); matches the earlier mirror copy. The order itself cites 'Virginia Code 32.1-127:30' as incorporated by 18VAC85-20-26(A) (apparently meaning 32.1-127.1:03; inference). Psychiatry, not cosmetic. Shows a defensive review reply was sanctioned despite the 32.1-127.1:03(D)(3) wording (the order does not discuss that exception).
https://www.dhp.virginia.gov/Notices/Medicine/0101037982/0101037982Order02112020.pdf
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-57. U-57 · Open (partly resolved)
Buyse official DHP copy now retrieved (batch 5; matches mirror; U-57 partly closed). Still open: no authority on whether 32.1-127.1:03(D)(3) covers review replies; HRPA private action not confirmed; 8.01-40 2026 amendments not analyzed.
High priority · VA