What a provider can and can't say in Wyoming
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 33-26-402 confidentiality ground (physicians) |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Unverified (dental grounds not located) | 33-26-402 confidentiality ground (physicians) |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 33-26-402 confidentiality ground (physicians) |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 33-26-402 confidentiality ground (physicians) |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 33-26-402 confidentiality ground (physicians) |
- Consumer privacy and health data law: Wyoming has no comprehensive consumer privacy law in force as of October 22, 2026. A 2026 enacted law (SF0020, 2026 Wyo. Sess. Laws ch. 48) applies only to government entities, not to private practices. [WY-003]
- Data breach notification: Its data breach notification law covers medical information. No attorney general notice requirement was located in this research. [WY-002]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules (physicians). [WY-001]
- Patient confidentiality duties: Board discipline for confidentiality breaches rests on a general professional-conduct ground (33-26-402). [WY-001]
- Lawsuits by individuals: No private right of action was located in the statutes reviewed; other claims, such as privacy torts, may still exist. [U-98]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (Board of Medicine rules (2011 text) laser/IPL = medicine unless supervised).† [WY-004]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [WY-001, U-97]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [WY-001] Wyo. Stat. 33-26-402(a)(xxvii)(P) paragraph number read from PDF layout (https://wyoleg.gov/statutes/compress/title33.pdf)
- [WY-002] Wyo. Stat. 40-12-501(a)(i), (vii); 40-12-502(a), (f), (h); 6-3-901(b)(xi)-(xiii) (https://wyoleg.gov/statutes/compress/title40.pdf)
- [WY-003] 2026 Wyo. Sess. Laws ch. 48 (SF0020) (https://www.wyoleg.gov/Legislation/2026/SF0020)
- [WY-004] Wyoming Board of Medicine Rules (as adopted, 2011) (https://wyoleg.gov/ARULES/2011/AR11-018medicine.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Wyoming (WY) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Wyo. Stat. 33-26-402(a)(xxvii)(P) (physicians: releasing confidential patient information) | Yes - applies to licensed providers regardless of HIPAA status | None (2026 SF0020 is government-only) | 40-12-502: medical + health insurance info covered (via 6-3-901); misuse-likely; most expedient time; no AG notice located; HIPAA-compliant deemed compliant | 33-26-402 confidentiality ground (physicians) | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located | Board of Medicine, Board of Dental Examiners, Board of Nursing, AG | Breach: AG action for damages/relief (no amount); license discipline | E4 | Medium-High | 2026-10-22 |
| Wyoming (WY) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Wyo. Stat. 33-26-402(a)(xxvii)(P) (physicians: releasing confidential patient information) | Unverified (dental grounds not located) | None (2026 SF0020 is government-only) | 40-12-502: medical + health insurance info covered (via 6-3-901); misuse-likely; most expedient time; no AG notice located; HIPAA-compliant deemed compliant | 33-26-402 confidentiality ground (physicians) | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located | Board of Medicine, Board of Dental Examiners, Board of Nursing, AG | Breach: AG action for damages/relief (no amount); license discipline | E4 | Medium-High | 2026-10-22 |
| Wyoming (WY) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Wyo. Stat. 33-26-402(a)(xxvii)(P) (physicians: releasing confidential patient information) | Yes - applies to licensed providers regardless of HIPAA status | None (2026 SF0020 is government-only) | 40-12-502: medical + health insurance info covered (via 6-3-901); misuse-likely; most expedient time; no AG notice located; HIPAA-compliant deemed compliant | 33-26-402 confidentiality ground (physicians) | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located | Board of Medicine, Board of Dental Examiners, Board of Nursing, AG | Breach: AG action for damages/relief (no amount); license discipline | E4 | Medium-High | 2026-10-22 |
| Wyoming (WY) | Medical med spa | Depends; cash-only med spas often not covered | Wyo. Stat. 33-26-402(a)(xxvii)(P) (physicians: releasing confidential patient information) | Yes - applies to licensed providers regardless of HIPAA status | None (2026 SF0020 is government-only) | 40-12-502: medical + health insurance info covered (via 6-3-901); misuse-likely; most expedient time; no AG notice located; HIPAA-compliant deemed compliant | 33-26-402 confidentiality ground (physicians) | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located | Board of Medicine, Board of Dental Examiners, Board of Nursing, AG | Breach: AG action for damages/relief (no amount); license discipline | E4 | Medium-High | 2026-10-22 |
| Wyoming (WY) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Wyo. Stat. 33-26-402(a)(xxvii)(P) (physicians: releasing confidential patient information) | No | None (2026 SF0020 is government-only) | 40-12-502: medical + health insurance info covered (via 6-3-901); misuse-likely; most expedient time; no AG notice located; HIPAA-compliant deemed compliant | 33-26-402 confidentiality ground (physicians) | HIPAA if covered; otherwise licensee confidentiality ground | None located | None statutory located | Board of Medicine, Board of Dental Examiners, Board of Nursing, AG | Breach: AG action for damages/relief (no amount); license discipline | E4 | Medium-High | 2026-10-22 |
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
WY-003. 2026 Wyo. Sess. Laws ch. 48 (SF0020)
Wyoming has no comprehensive consumer privacy law; 2026 SF0020 (ch. 48) applies only to government entities.
Statute / legislative history · Explicit (bill page) · Medium-High
WY-002. Wyo. Stat. 40-12-501(a)(i), (vii); 40-12-502(a), (f), (h); 6-3-901(b)(xi)-(xiii)
Breach law covers name plus medical information (medical history, condition, treatment or diagnosis by a health care professional), health insurance information and biometric data; requires a misuse-likelihood investigation; notice in the most expedient time possible; AG may sue; HIPAA covered entities and business associates that notify under HIPAA are deemed compliant.
Statute · Explicit · High · No AG-notice requirement and no fixed day count located.
WY-001. Wyo. Stat. 33-26-402(a)(xxvii)(P)
Physician unprofessional conduct includes 'intentionally or negligently releasing or disclosing confidential patient information', except disclosures permitted or required by state or federal law or necessary to prevent imminent harm.
Statute · Explicit · Medium-High · Paragraph number should be confirmed (U-49).
WY-004. Wyoming Board of Medicine Rules (as adopted, 2011)
Med spa: no med-spa-specific statute or rule located. Board of Medicine rules (as adopted 2011) treat operating laser, IPL or similar devices as the practice of medicine unless done under the supervision of a person licensed under the Medical Practice Act.
Regulation · Explicit (as-adopted text); current text not read · Low · Med spa pass, final phase part 2 (2026-10-22). Paraphrase from search synthesis of the 2011 as-adopted rule; current rule text not read (V-069, U-99).
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All