What a provider can and can't say in Wisconsin
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 146.82 + Med 10.03(2)(i) (negligent divulging suffices); no review order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 146.82 + Med 10.03(2)(i) (negligent divulging suffices); no review order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 146.82 + Med 10.03(2)(i) (negligent divulging suffices); no review order located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 146.82 + Med 10.03(2)(i) (negligent divulging suffices); no review order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No (cosmetology licensees are not 146.81 providers; Cos 2.025 governs delegated procedures) | 146.82 + Med 10.03(2)(i) (negligent divulging suffices); no review order located |
- Consumer privacy and health data law: Wisconsin has no comprehensive consumer privacy law in force as of October 22, 2026. Status of proposals: SB 166 failed 2026-03-23. Bills are not law. [WI-007]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). [WI-005]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (146.82). [WI-001]
- Patient confidentiality duties: Board rules reach intentional or even negligent disclosures (Med 10.03(2)(i): knowingly, recklessly or negligently). [WI-003]
- Lawsuits by individuals: Patients may be able to sue in some situations (146.84; 995.50). [WI-002, WI-004]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (995.50). [WI-004]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (cosmetology board). [WI-003, WI-006]
- Enforcement located: Strongest state enforcement evidence located: allegations or media reports only (E3) (a 2009 board order reported by a secondary source only; official order not located). Not finding enforcement does not mean none exists.† [WI-008]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [WI-001] Wis. Stat. 146.81(1), (4); 146.82(1) (https://docs.legis.wisconsin.gov/statutes/statutes/146/82)
- [WI-002] Wis. Stat. 146.84(1)(b)-(c), (2) (https://docs.legis.wisconsin.gov/statutes/statutes/146/84)
- [WI-003] Wis. Admin. Code Med 10.03(1)(k), (1)(L), (2)(i) (https://docs.legis.wisconsin.gov/code/admin_code/med/10/03)
- [WI-004] Wis. Stat. 995.50(1), (2)(am)2.-3. (https://docs.legis.wisconsin.gov/statutes/statutes/995/50)
- [WI-005] Wis. Stat. 134.98(1)(b), (2)(br), (3)(a) (https://docs.legis.wisconsin.gov/statutes/statutes/134/98)
- [WI-006] Wis. Admin. Code Cos 2.025 (1)-(2r) (https://docs.legis.wisconsin.gov/code/admin_code/cos/2/025)
- [WI-007] n/a (https://docs.legis.wisconsin.gov/2025/proposals/sb166)
- [WI-008] Wis. Med. Examining Bd., In re Victoria Fetter, M.D., LS0808291MED (https://www.psychcrime.org/news/index.php?t=Wisconsin+medical+board+reprimands+psychiatrist+Victoria+Fetter+for+disclosing+patient+information&vd=219)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Wisconsin (WI) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Wis. Stat. 146.82 (records confidential; all listed providers); Med 10.03(2)(i) | Yes - applies to licensed providers regardless of HIPAA status | None in force (SB 166/AB 172 failed) | 134.98: medical info NOT covered (DNA/biometric covered); <=45 days; CRAs if >=1,000 | 146.82 + Med 10.03(2)(i) (negligent divulging suffices); no review order located | 146.82 informed consent (records); 995.50 written consent for advertising use; HIPAA if covered | Wis. Stat. 995.50(2)(am)2 (written consent; damages + fees) | Yes: 146.84 (actual + exemplary up to $25,000 willful / $1,000 negligent + fees); 995.50 | Medical Examining Board, Dentistry Examining Board, Board of Nursing, Cosmetology Examining Board (DSPS), DATCP | 146.84 criminal up to $25,000-$100,000; forfeiture $1,000 per negligent disclosure; license discipline | E3 (Wis. MEB Fetter 2009: records left in public trash; reprimand reported by a secondary source only; official order not located) | High | 2026-10-22 |
| Wisconsin (WI) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Wis. Stat. 146.82 (records confidential; all listed providers); Med 10.03(2)(i) | Yes - applies to licensed providers regardless of HIPAA status | None in force (SB 166/AB 172 failed) | 134.98: medical info NOT covered (DNA/biometric covered); <=45 days; CRAs if >=1,000 | 146.82 + Med 10.03(2)(i) (negligent divulging suffices); no review order located | 146.82 informed consent (records); 995.50 written consent for advertising use; HIPAA if covered | Wis. Stat. 995.50(2)(am)2 (written consent; damages + fees) | Yes: 146.84 (actual + exemplary up to $25,000 willful / $1,000 negligent + fees); 995.50 | Medical Examining Board, Dentistry Examining Board, Board of Nursing, Cosmetology Examining Board (DSPS), DATCP | 146.84 criminal up to $25,000-$100,000; forfeiture $1,000 per negligent disclosure; license discipline | E3 (Wis. MEB Fetter 2009: records left in public trash; reprimand reported by a secondary source only; official order not located) | High | 2026-10-22 |
| Wisconsin (WI) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Wis. Stat. 146.82 (records confidential; all listed providers); Med 10.03(2)(i) | Yes - applies to licensed providers regardless of HIPAA status | None in force (SB 166/AB 172 failed) | 134.98: medical info NOT covered (DNA/biometric covered); <=45 days; CRAs if >=1,000 | 146.82 + Med 10.03(2)(i) (negligent divulging suffices); no review order located | 146.82 informed consent (records); 995.50 written consent for advertising use; HIPAA if covered | Wis. Stat. 995.50(2)(am)2 (written consent; damages + fees) | Yes: 146.84 (actual + exemplary up to $25,000 willful / $1,000 negligent + fees); 995.50 | Medical Examining Board, Dentistry Examining Board, Board of Nursing, Cosmetology Examining Board (DSPS), DATCP | 146.84 criminal up to $25,000-$100,000; forfeiture $1,000 per negligent disclosure; license discipline | E3 (Wis. MEB Fetter 2009: records left in public trash; reprimand reported by a secondary source only; official order not located) | High | 2026-10-22 |
| Wisconsin (WI) | Medical med spa | Depends; cash-only med spas often not covered | Wis. Stat. 146.82 (records confidential; all listed providers); Med 10.03(2)(i) | Yes - applies to licensed providers regardless of HIPAA status | None in force (SB 166/AB 172 failed) | 134.98: medical info NOT covered (DNA/biometric covered); <=45 days; CRAs if >=1,000 | 146.82 + Med 10.03(2)(i) (negligent divulging suffices); no review order located | 146.82 informed consent (records); 995.50 written consent for advertising use; HIPAA if covered | Wis. Stat. 995.50(2)(am)2 (written consent; damages + fees) | Yes: 146.84 (actual + exemplary up to $25,000 willful / $1,000 negligent + fees); 995.50 | Medical Examining Board, Dentistry Examining Board, Board of Nursing, Cosmetology Examining Board (DSPS), DATCP | 146.84 criminal up to $25,000-$100,000; forfeiture $1,000 per negligent disclosure; license discipline | E3 (Wis. MEB Fetter 2009: records left in public trash; reprimand reported by a secondary source only; official order not located) | High | 2026-10-22 |
| Wisconsin (WI) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Wis. Stat. 146.82 (records confidential; all listed providers); Med 10.03(2)(i) | No (cosmetology licensees are not 146.81 providers; Cos 2.025 governs delegated procedures) | None in force (SB 166/AB 172 failed) | 134.98: medical info NOT covered (DNA/biometric covered); <=45 days; CRAs if >=1,000 | 146.82 + Med 10.03(2)(i) (negligent divulging suffices); no review order located | 146.82 informed consent (records); 995.50 written consent for advertising use; HIPAA if covered | Wis. Stat. 995.50(2)(am)2 (written consent; damages + fees) | Yes: 146.84 (actual + exemplary up to $25,000 willful / $1,000 negligent + fees); 995.50 | Medical Examining Board, Dentistry Examining Board, Board of Nursing, Cosmetology Examining Board (DSPS), DATCP | 146.84 criminal up to $25,000-$100,000; forfeiture $1,000 per negligent disclosure; license discipline | E3 (Wis. MEB Fetter 2009: records left in public trash; reprimand reported by a secondary source only; official order not located) | High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Wisconsin Medical Examining Board: Victoria Fetter, M.D.
Wisconsin Medical Examining Board · WI (state licensing) · 2009-05-20
- Provider type
- Physician (psychiatry)
- Relevant facts
- Discarded identifiable patient records in a public restroom trash receptacle; 2000 reprimand for disclosing privileged communications
- Legal issues
- Unprofessional conduct (divulging privileged communications; Med 10 then in force)
- Holding, findings, allegations or settlement terms
- Final decision and order (per secondary summary)
- Consequences recorded
- Reprimand; $2,188 costs
- Procedural status
- Final (per secondary)
- Precedential?
- No
- Why it is in this research
- Negligent exposure of records can support discipline
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
WI-007. n/a
Wisconsin has no comprehensive consumer privacy law in force; SB 166 / AB 172 failed when the 2025-26 session ended.
Search result (negative) · Per secondary tracker · High · Official history read 2026-10-22 (V-030): failed to pass pursuant to Senate Joint Resolution 1 on 2026-03-23.
WI-005. Wis. Stat. 134.98(1)(b), (2)(br), (3)(a)
Breach law: 'personal information' = name plus SSN, driver's license/state ID, financial account with code, DNA profile or unique biometric data; medical information is NOT covered. Notice within a reasonable time not exceeding 45 days; consumer reporting agencies if 1,000 or more.
Statute · Explicit · High · No AG notice requirement located in the text read.
WI-001. Wis. Stat. 146.81(1), (4); 146.82(1)
Patient health care records 'shall remain confidential' and may be released only to persons designated in 146.82 or with the patient's informed consent; 'health care provider' includes nurses, dentists, physicians, PAs and others.
Statute · Explicit · High · Text addresses records; reach to oral disclosures not resolved (U-65). Aestheticians are not listed providers (inference).
WI-003. Wis. Admin. Code Med 10.03(1)(k), (1)(L), (2)(i)
Medical Examining Board unprofessional conduct includes 'knowingly, recklessly, or negligently divulging a privileged communication or other confidential patient health care information except as required or permitted by state or federal law', false or deceptive advertising and failure to adequately supervise delegated medical acts.
Regulation · Explicit · High · Negligent disclosure suffices. No confidentiality item located in dental rule DE 5.02 (U-65).
WI-002. Wis. Stat. 146.84(1)(b)-(c), (2)
Private action: a knowing and willful violation of 146.82 makes the violator liable for actual damages, exemplary damages up to $25,000, costs and reasonable actual attorney fees; a negligent violation, actual damages, exemplary damages up to $1,000, costs and fees; injunctions available. Criminal fines up to $25,000 (knowing unlawful disclosure) or $100,000 (for pecuniary gain); negligent disclosure forfeiture up to $1,000 per violation.
Statute · Explicit · High · Maximums, not typical. Annotation notes class certification is not precluded.
WI-004. Wis. Stat. 995.50(1), (2)(am)2.-3.
Statutory privacy right: invasion of privacy includes using a living person's name, portrait or picture for advertising or trade without written consent, and highly offensive publicity of private-life matters; remedies are equitable relief, compensatory damages and reasonable attorney fees.
Statute · Explicit · High · Before/after photos in ads require written consent (application inferred).
WI-006. Wis. Admin. Code Cos 2.025
Cosmetology Examining Board rule: licensees may provide medical procedures only as directed, supervised and inspected by a physician; 'delegated medical procedures' include laser hair removal, most microdermabrasion, stronger chemical peels, microneedling and any treatment below the stratum corneum; dermaplaning, microblading, tinting and electromagnetic or thermal energy are delegated unless trained and superficial.
Regulation · Explicit · High · Binding on the nonmedical side of med spas. No physician-side med spa rule located.
WI-008. Wis. Med. Examining Bd., In re Victoria Fetter, M.D., LS0808291MED
Wisconsin Medical Examining Board final decision and order (LS0808291MED, 2009-05-20, per secondary summary): reprimand and $2,188 costs for a psychiatrist who discarded identifiable patient records in a public trash receptacle; she had a 2000 reprimand for disclosing privileged communications.
Enforcement (licensing; final order per secondary source) · Explicit (secondary) · Low · Med spa pass, final phase part 2 (2026-10-22). Secondary source only; official DRL order search blocked earlier. Registered from cases.csv; do not cite in publication without the official order (U-95). [Audit D 2026-10-22: evidence label lowered from E2 to E3 because only a secondary summary was read]
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103