What a provider can and can't say in West Virginia
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | Board rule 12.1.f; Morris tort; no board order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Partly: Morris addresses physicians; dental grounds not read | Board rule 12.1.f; Morris tort; no board order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | Board rule 12.1.f; Morris tort; no board order located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | Board rule 12.1.f; Morris tort; no board order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | Board rule 12.1.f; Morris tort; no board order located |
- Consumer privacy and health data law: West Virginia has no comprehensive consumer privacy law in force as of October 22, 2026. Status of proposals: HB 5123 not passed (secondary). Bills are not law. [WV-001]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Enforcement rests with the attorney general; civil penalties are capped at $150,000 per breach or series of breaches (a ceiling, not a typical amount). [WV-002]
- Patient confidentiality duties: Patient confidentiality duties come mainly from court-recognized privacy claims (Morris) and board rule.† [WV-004, WV-003]
- Patient confidentiality duties: A board rule ground was read only on a secondary host (Rule 12.1.f (secondary host)).† [WV-003]
- Lawsuits by individuals: Patients may be able to sue in some situations (Morris). [WV-004]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (Procedure statute plus policy). [WV-005, WV-006]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists.† [WV-003, U-97]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [WV-001] n/a (https://www.wvlegislature.gov/bill_status/Bills_history.cfm?btype=bill&input=5123&sessiontype=RS&year=2026)
- [WV-002] W. Va. Code 46A-2A-101(6), 46A-2A-102, 46A-2A-103, 46A-2A-104 (https://code.wvlegislature.gov/46A-2A-101/)
- [WV-003] W. Va. Code R. 11-1A-12.1.f, 12.1.j, 12.2.d, 12.3.g (https://www.law.cornell.edu/regulations/west-virginia/W-Va-Code-R-SS-11-1A-12)
- [WV-004] Morris v. Consolidation Coal Co., 191 W. Va. 426, 446 S.E.2d 648 (1994), Syl. pts. 4-5 Syllabus (https://www.courtswv.gov/sites/default/pubfilesmnt/2023-11/22034.pdf)
- [WV-005] W. Va. Code 30-3-4 (https://code.wvlegislature.gov/30-3-4/)
- [WV-006] WVBOM laser policy (July 2007 newsletter) (https://wvbom.wv.gov/www/download_resource.aspx?ID=100)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| West Virginia (WV) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | W. Va. Code R. 11-1A-12.1.f willfully violating a confidential communication; Morris duty of confidentiality | Yes - applies to licensed providers regardless of HIPAA status | None enacted (HB 5123 of 2026 not passed, secondary) | 46A-2A: medical info NOT covered; AG exclusive; $150,000 cap (repeated, willful) | Board rule 12.1.f; Morris tort; no board order located | HIPAA if covered; Morris; likeness common law (not researched) | None statutory located (common law not researched) | Yes: Morris breach-of-confidentiality action (physician and inducing third party) | Board of Medicine, Board of Osteopathic Medicine, Board of Dentistry, Board of Registered Professional Nurses, AG | Board fines (rule range $1,000-$10,000, secondary); breach $150,000 cap | E4 | Medium | 2026-10-22 |
| West Virginia (WV) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | W. Va. Code R. 11-1A-12.1.f willfully violating a confidential communication; Morris duty of confidentiality | Partly: Morris addresses physicians; dental grounds not read | None enacted (HB 5123 of 2026 not passed, secondary) | 46A-2A: medical info NOT covered; AG exclusive; $150,000 cap (repeated, willful) | Board rule 12.1.f; Morris tort; no board order located | HIPAA if covered; Morris; likeness common law (not researched) | None statutory located (common law not researched) | Yes: Morris breach-of-confidentiality action (physician and inducing third party) | Board of Medicine, Board of Osteopathic Medicine, Board of Dentistry, Board of Registered Professional Nurses, AG | Board fines (rule range $1,000-$10,000, secondary); breach $150,000 cap | E4 | Medium | 2026-10-22 |
| West Virginia (WV) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | W. Va. Code R. 11-1A-12.1.f willfully violating a confidential communication; Morris duty of confidentiality | Yes - applies to licensed providers regardless of HIPAA status | None enacted (HB 5123 of 2026 not passed, secondary) | 46A-2A: medical info NOT covered; AG exclusive; $150,000 cap (repeated, willful) | Board rule 12.1.f; Morris tort; no board order located | HIPAA if covered; Morris; likeness common law (not researched) | None statutory located (common law not researched) | Yes: Morris breach-of-confidentiality action (physician and inducing third party) | Board of Medicine, Board of Osteopathic Medicine, Board of Dentistry, Board of Registered Professional Nurses, AG | Board fines (rule range $1,000-$10,000, secondary); breach $150,000 cap | E4 | Medium | 2026-10-22 |
| West Virginia (WV) | Medical med spa | Depends; cash-only med spas often not covered | W. Va. Code R. 11-1A-12.1.f willfully violating a confidential communication; Morris duty of confidentiality | Yes - applies to licensed providers regardless of HIPAA status | None enacted (HB 5123 of 2026 not passed, secondary) | 46A-2A: medical info NOT covered; AG exclusive; $150,000 cap (repeated, willful) | Board rule 12.1.f; Morris tort; no board order located | HIPAA if covered; Morris; likeness common law (not researched) | None statutory located (common law not researched) | Yes: Morris breach-of-confidentiality action (physician and inducing third party) | Board of Medicine, Board of Osteopathic Medicine, Board of Dentistry, Board of Registered Professional Nurses, AG | Board fines (rule range $1,000-$10,000, secondary); breach $150,000 cap | E4 | Medium | 2026-10-22 |
| West Virginia (WV) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | W. Va. Code R. 11-1A-12.1.f willfully violating a confidential communication; Morris duty of confidentiality | No | None enacted (HB 5123 of 2026 not passed, secondary) | 46A-2A: medical info NOT covered; AG exclusive; $150,000 cap (repeated, willful) | Board rule 12.1.f; Morris tort; no board order located | HIPAA if covered; Morris; likeness common law (not researched) | None statutory located (common law not researched) | Yes: Morris breach-of-confidentiality action (physician and inducing third party) | Board of Medicine, Board of Osteopathic Medicine, Board of Dentistry, Board of Registered Professional Nurses, AG | Board fines (rule range $1,000-$10,000, secondary); breach $150,000 cap | E4 | Medium | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Morris v. Consolidation Coal Co.
Supreme Court of Appeals of West Virginia · WV · 1994
- Provider type
- Treating physician; employer
- Relevant facts
- Employer's agents obtained ex parte disclosures from a workers' compensation claimant's treating physician
- Legal issues
- Breach of physician's duty of confidentiality; inducement by third party
- Holding, findings, allegations or settlement terms
- Judicial holding (syllabus): patient has a cause of action against a physician who breaches confidentiality and against a third party who induces it
- Consequences recorded
- n/a
- Procedural status
- Final (precedent)
- Precedential?
- Yes (state high court)
- Why it is in this research
- Private claims over review replies that disclose patient information (application inferred)
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
WV-001. n/a
No comprehensive consumer data privacy law enacted; HB 5123 (2026) did not pass (remained in committee).
Search result (negative) · Per secondary search (official bill-history fetch failed) · Medium · Flag: official status not read.
WV-002. W. Va. Code 46A-2A-101(6), 46A-2A-102, 46A-2A-103, 46A-2A-104
Breach law: personal information = name plus SSN, driver's license/state ID, or financial account/card with code; medical information NOT covered; notice without unreasonable delay where misuse is reasonably likely; AG has exclusive enforcement; civil penalties only for repeated and willful violations, capped at $150,000 per breach or series of related breaches. Entities following their own consistent procedures or a federal regulator's are deemed compliant.
Statute · Explicit · High · Maximum, not typical.
WV-004. Morris v. Consolidation Coal Co., 191 W. Va. 426, 446 S.E.2d 648 (1994), Syl. pts. 4-5
Supreme Court of Appeals: a patient has a cause of action against a treating physician who breaches the duty of confidentiality (e.g., ex parte disclosure), and against a third party who induces the breach.
Judicial decision · Explicit (syllabus read) · High · Supports private claims over review replies that disclose patient information (application inferred).
https://www.courtswv.gov/sites/default/pubfilesmnt/2023-11/22034.pdf
WV-003. W. Va. Code R. 11-1A-12.1.f, 12.1.j, 12.2.d, 12.3.g
Board of Medicine rule: grounds include willfully violating a confidential communication, unprofessional or unethical conduct, and failing to follow AMA ethics principles; board sanctions include fines (per rule text on LII, $1,000-$10,000 range).
Regulation · Explicit · Medium · Grounds from LII (secondary; official CSR fetch failed, U-82). Fine range confirmed in W. Va. Code 30-3-14(j)(8): $1,000 to $10,000 (official, V-044).
https://www.law.cornell.edu/regulations/west-virginia/W-Va-Code-R-SS-11-1A-12
WV-005. W. Va. Code 30-3-4
Medical Practice Act: 'surgery' includes the use on humans of lasers, ionizing radiation, pulsed light and radiofrequency devices, so these are the practice of medicine.
Statute · Explicit · High · Delegation terms are in board policy (WV-006), not statute.
WV-006. WVBOM laser policy (July 2007 newsletter)
Board of Medicine public policy statement on lasers: ablative treatments may be delegated by written protocol to advanced practitioners under direct supervision; non-ablative treatments to licensed non-physician personnel under direct supervision.
Guidance (board policy statement) · Explicit · Medium · Guidance; whether still current not confirmed (U-82).
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All