Privacy and media law: United States
As of 2026-10-05.
Medical confidentiality
HIPAA binds most clinics, doctors and health plans, plus contractors handling their patient data [1]. Breaches bring federal civil fines that rise with fault [2] and, for knowing disclosure, criminal penalties of up to $250,000 and 10 years in prison [3]. Addiction-treatment records from federally assisted programs get extra protection under 42 U.S.C. 290dd-2 and 42 CFR Part 2: without consent or a court order showing good cause, they cannot be used as evidence against the patient in criminal, civil or administrative proceedings [4]. Violations carry the HIPAA penalties [4][5].
Health data
HIPAA does not reach every holder of health data. The FTC covers health apps and similar services outside HIPAA, but only with a breach-notification duty [6]. Some states go further: Washington requires consent to collect consumer health data [7].
Photographs
Photographing people in public is generally lawful, including activity on private property visible from a public place [8]. Using telephoto lenses or other equipment to capture what could not otherwise be seen may be an intrusion [8]. California adds liability, with up to triple damages and fines, for capturing "private, personal, or familial activity" by trespass or with an enhancing device [9]. Using a likeness in advertising needs consent, but news use is exempt [10].
Press and remedies
Courts almost never stop publication in advance [11]; the usual remedy is damages afterwards. Publishing private facts can be actionable, and medical information is a classic example, but newsworthiness is a strong defence, especially for prominent people [12].
What this means in practice
US law punishes staff leaks heavily but does little against a photographer on a public road. The clinic's setup (one client per residence, screened grounds, private arrival) matters as much as the law. No clinic guarantees privacy.
Sources
- 45 CFR 160.103, Definitions (covered entity, business associate). Legal Information Institute, Cornell Law School (secondary reproduction of the regulation). https://www.law.cornell.edu/cfr/text/45/160.103, accessed 2026-10-05.
- 42 U.S.C. 1320d-5, General penalty for failure to comply. Legal Information Institute, Cornell Law School (reproduction of statute). https://www.law.cornell.edu/uscode/text/42/1320d-5, accessed 2026-10-05.
- 42 U.S.C. 1320d-6, Wrongful disclosure of individually identifiable health information. Legal Information Institute, Cornell Law School (reproduction of statute). https://www.law.cornell.edu/uscode/text/42/1320d-6, accessed 2026-10-05.
- 42 U.S.C. 290dd-2, Confidentiality of records. Legal Information Institute, Cornell Law School (reproduction of statute). https://www.law.cornell.edu/uscode/text/42/290dd-2, accessed 2026-10-05.
- 42 CFR 2.3, Civil and criminal penalties for violations (as amended 89 FR 12618, 2024). Legal Information Institute, Cornell Law School (reproduction of regulation). https://www.law.cornell.edu/cfr/text/42/2.3, accessed 2026-10-05.
- Health Breach Notification Rule. Federal Trade Commission. https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule, accessed 2026-10-05.
- Chapter 19.373 RCW, Washington My Health My Data Act (see 19.373.030, 19.373.090). Washington State Legislature. https://app.leg.wa.gov/RCW/default.aspx?cite=19.373, accessed 2026-10-05.
- Gathering Private Information (Legal Guide). Digital Media Law Project, Berkman Klein Center, Harvard University (university secondary source, guide written 2007 to 2014). https://www.dmlp.org/book/export/html/1245, accessed 2026-10-05.
- California Civil Code 1708.8. California Legislative Information. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1708.8, accessed 2026-10-05.
- California Civil Code 3344 (news exemption in subdivision (d)). California Legislative Information. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=3344, accessed 2026-10-05.
- Near v. Minnesota, 283 U.S. 697 (1931). Legal Information Institute, Cornell Law School (reproduction of the opinion). https://www.law.cornell.edu/supremecourt/text/283/697, accessed 2026-10-05.
- Publication of Private Facts (Legal Guide). Digital Media Law Project, Berkman Klein Center, Harvard University (university secondary source). https://www.dmlp.org/legal-guide/publication-private-facts, accessed 2026-10-05.
