HIPAA compliance for dermatology practices in Massachusetts

Massachusetts keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Massachusetts has one recorded rule that applies to dermatology practices differently from other businesses in the state — set out below with their conditions and sources.

Massachusetts jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Massachusetts's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Dermatology practices that electronically bill, check eligibility, request authorization, or conduct other adopted transactions are HIPAA covered entities. Once covered, the duties below apply to records, photographs, pathology, teledermatology, devices, people, and vendors — not just the EHR.

State — how Massachusetts law interacts with HIPAA

Massachusetts substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Dermatology practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Massachusetts requires notice content that HIPAA does not require, including the name of the person responsible for the breach if known and whether the entity maintains a written information security program. HIPAA notice alone does not satisfy Massachusetts content requirements.

What Massachusetts adds for dermatology practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Massachusetts's general breach law, which applies the same way to every business in the state.

Provider disclosure to a parent

Provider must disclose

Where the physician or dentist attending a minor reasonably believes the minor's condition to be so serious that life or limb is endangered, the physician or dentist shall notify the parents, legal guardian or foster parents of that condition.

Provider class: the physician or dentist attending the minor
Patient population: minors treated on their own consent under § 12F

What this means operationally

This is an obligation, not a permission — the opposite of Texas § 32.004, and it fires on a clinical threshold rather than on a request. A practice treating minors on their own consent needs the escalation path defined in advance, because the moment the threshold is met the notification is required and there is no discretion left to exercise.

Applies when

The minor was treated on their own consent under § 12F
The attending physician or dentist reasonably believes life or limb is endangered

State statuteMass. Gen. Laws ch. 112, § 12F, life-or-limb clauseMinors treated on their own consent under § 12FVerified 2026-08-29

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Massachusetts breach obligations

These apply to businesses generally rather than to dermatology practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Massachusettsbreach data →

Individual notice deadline

As soon as practicable and without unreasonable delay after knowing or having reason to know of the breach or unauthorized use. The statute does not fix a numeric outer bound, but delay past what is reasonable is itself a violation.

The statute does not fix a numeric outer bound. Unreasonable delay is itself a violation and may result in state enforcement action, so treat the operative timeframe as the shortest window your incident circumstances reasonably support.

State regulator notice

Required

Notice must be provided to (1) the Massachusetts Attorney General and (2) the Director of the Office of Consumer Affairs and Business Regulation, in addition to affected residents.

Source: Mass. Gen. Laws ch. 93H, § 3

Statewide rules that also reach dermatology practices

Minor may consent

A minor may consent to medical or dental care without parental permission where the minor is married, widowed or divorced; is the parent of a child; is a member of any of the armed forces; is pregnant or believes themselves pregnant; is living separately from parents and managing their own financial affairs; or reasonably believes themselves to be suffering from or to have come into contact with a disease defined as dangerous to the public health, OR SEEKS CARE FOR THE PREVENTION OF HIV IF THE MINOR IS SEXUALLY ACTIVE.

What this means operationally

Consent turns on the minor's circumstances rather than age, so intake has to capture status — marital, parental, service, residential, financial — and not merely date of birth. The public-health limb is the one most likely to arise unplanned in a general practice, and it is scoped to the disease rather than to the visit.

Applies when

One or more of the enumerated circumstances applies
For the HIV-prevention limb, the trigger is that the minor is sexually active — not exposure to or belief in a disease

Exceptions

Consent may not be given under the second through sixth circumstances for abortion or sterilization

StatewideMass. Gen. Laws ch. 112, § 12F, consent clauseAll minors under 18Verified 2026-08-29

Parental right of access

A health care provider who maintains records for a patient treated or examined by such provider SHALL PERMIT INSPECTION of such records by the patient or an AUTHORIZED REPRESENTATIVE of the patient, and UPON REQUEST A COPY of the patient's record SHALL BE FURNISHED UPON PAYMENT OF A REASONABLE FEE, AS DEFINED IN SECTION 70 OF CHAPTER 111.

What this means operationally

The operative detail is the cross-reference. Massachusetts does not write a separate fee rule for practices — § 12CC imports the schedule that chapter 111 § 70 writes for HOSPITALS AND CLINICS, so a private dental, optometric or chiropractic office charges on a hospital's schedule. A practice looking only in the professions chapter will not find a figure at all. Note the section states no deadline for an ordinary request; the only stated clock in Massachusetts is the thirty days for benefit-claim requests.

Applies when

A patient or authorized representative asks to inspect, or requests a copy of, records held by a health care provider

StatewideMass. Gen. Laws ch. 112, § 12CCPatients and authorized representativesVerified 2026-08-30

Parental right of access

NO HEALTH CARE PROVIDER SHALL CHARGE A FEE to any applicant, beneficiary or individual representing an applicant or beneficiary for furnishing a health record IF THE RECORD IS REQUESTED FOR THE PURPOSE OF SUPPORTING A CLAIM OR APPEAL UNDER ANY PROVISION OF THE SOCIAL SECURITY ACT OR ANY FEDERAL OR STATE FINANCIAL NEEDS-BASED BENEFIT PROGRAM. A health care provider SHALL FURNISH a health record requested pursuant to such a claim or appeal WITHIN THIRTY DAYS of the request. Any person for whom no fee shall be charged SHALL PRESENT REASONABLE DOCUMENTATION at the time of the records request that the purpose of the request is to support such a claim or appeal.

What this means operationally

This is the only stated response deadline for a Massachusetts practice, and it attaches to the free route rather than the paid one — thirty days for a benefit-claim request, nothing specified for an ordinary request. The documentation condition sits on the requester and must be presented AT THE TIME of the request, so a practice may properly ask what the records are for before waiving the fee, and a later assertion does not retroactively make the copy free. The program list is broad: any provision of the Social Security Act and any federal or state needs-based benefit program, which reaches disability, SSI and state assistance appeals alike.

Applies when

A record is requested to support a claim or appeal under the Social Security Act or a federal or state needs-based benefit program, with documentation presented at the time of request

StatewideMass. Gen. Laws ch. 112, § 12CC; ch. 111, § 70Patients and authorized representativesVerified 2026-08-30

Limit on copy fees, format or delivery

A REASONABLE FEE for these purposes MEANS a BASE CHARGE OF NOT MORE THAN $15 for each request for a medical record; a PER PAGE CHARGE OF NOT MORE THAN $0.50 for each of the FIRST 100 PAGES copied per request; and NOT MORE THAN $0.25 PER PAGE for each page IN EXCESS OF 100 PAGES copied per request. The reasonable fee MAY BE ADJUSTED to reflect the CONSUMER PRICE INDEX FOR MEDICAL CARE SERVICES, such that the base amount and the per page charge shall be increased by the proportional consumer price index in effect AS OF OCTOBER OF THE CALENDAR YEAR IN WHICH THE REQUEST IS MADE, rounded to the nearest dollar. An ADDITIONAL FEE may be charged to cover the cost of POSTAGE, other priority mailing, and PREPARATION OF AN EXPLANATION OR SUMMARY of the record if so requested.

This changes on 2027-10-01

The $15 base and the $0.50 and $0.25 per-page figures in this proposition are the statutory base amounts, not necessarily the lawful charge in any given year. The adjustment recurs annually, so a synthesis quoting these numbers must date them or state that they are subject to CPI adjustment.

What this means operationally

The schedule is degressive — the per-page rate halves after a hundred pages — so a large chart is proportionally cheaper than a small one, which is the opposite of most states. Two practical points. The CPI adjustment is keyed to OCTOBER of the year the request is made, so the lawful figure changes annually and any published number needs a date beside it; rounding to the nearest dollar also means the base charge moves in whole dollars. And the summary-preparation charge is only available where the patient asked for a summary — it is not a general handling fee.

Applies when

A copy of a medical record is furnished under § 12CC or § 70

Exceptions

No fee at all where the record supports a Social Security Act or needs-based benefit claim or appeal

StatewideMass. Gen. Laws ch. 111, § 70Patients and authorized representativesVerified 2026-08-30

What applies to dermatology practices everywhere

Clinical photography makes dermatology unusually exposed. Images can contain a face, tattoo, body location, embedded metadata, patient identifier, or clinical context. The SRA must follow those images from capture through storage, treatment use, disclosure, marketing, retention, and deletion.

Every device used to capture clinical photographs, dermoscopy images, wound documentation, and treatment-progress images

Camera rolls, automatic cloud synchronization, local storage, image upload, EHR attachment, backup, and deletion

The EHR, practice-management system, portal, teledermatology platform, imaging tools, and photo-management systems

Dermatopathology, laboratory, biopsy, Mohs, referral, and specialist data flows

Email, text, e-fax, patient forms, scheduling, and delivery of images or results

Before-and-after photography used for treatment documentation, education, websites, advertising, or social media

Full dermatologycompliance guide →

Knowing the Massachusetts rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Massachusetts rules on this page.

Start the risk assessment