45 CFR 164.508
HIPAA stops the one reply that would settle it
A dental practice cannot say "this person has never been in our chair" in public. Confirming or denying treatment is a disclosure. That single restriction is why a pediatric dentistry that gets a review from a non-patient has to use the platform's policy process rather than the reply box.


