Do vets have to follow HIPAA? What state law asks instead

No, vets don’t have to follow HIPAA. The federal privacy rule covers health plans, clearinghouses and providers of health care to people, and an animal’s care is not that. What binds a veterinary practice is the confidentiality section of your state’s practice act, and those differ. Texas, California and Florida, the three states read for this post, each limit what you may say about a patient on your website, your Google profile and in a review reply.

Why HIPAA stops at the exam room

HIPAA’s reach is set by the definitions in 45 CFR §160.103. A “covered entity” is a health plan, a health care clearinghouse, or “a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.” The rest of the chain is built on a human being:

The regulation never mentions animals. Read together, the definitions leave a dog’s chart outside it, and the veterinary literature reads them the same way. A 2019 article in the Journal of the American Veterinary Medical Association says the federal Health Insurance Portability and Accountability Act “does not apply to animals. However, some states strictly regulate the disclosure of veterinary patient and client data without proper consent.”

That second sentence is the one that matters for your marketing. You don’t escape a privacy rule. You trade a single federal one for your state’s, and the article adds that “there is no national standard, and state laws range from strict to limited regulation of disclosures.”

The AVMA’s ethics code also calls records confidential, but the same article notes that, unless a state adopts it, the code does “not have the force of law.”

What three states actually say

Three statutes were read on October 15, 2026: Texas, California and Florida. Other states were not checked. Before you change a form or a policy, read your own state’s practice act or ask your board.

Two things stand out. California’s rule reaches “any information”, about the animal or about the client, not only the medical record. And Florida also makes confidential the “information disclosed to a veterinarian by a client in the course of the care and treatment of the patient”, which covers what an owner tells the vet, not only what the chart says.

Each statute also names its own exceptions: court orders and subpoenas everywhere, rabies verification, public health requests and cruelty reports in Texas, animal control and humane officers in California, other treating vets in California and Florida, and suspected crimes in Florida. None of them is a marketing exception.

Drop the “HIPAA compliant” badge

Some practice websites borrow the phrase from human medicine: a “HIPAA compliant” line under the contact form, or “your pet’s records are protected by HIPAA” on the new-client page. Our advice is to take it down. It names a law that doesn’t apply to you, and it says nothing about the law that does.

Replace it with what your practice actually does, in your own state’s terms.

Fill in the bracket with what your statute says. In Florida, “with your written permission” matches the text. In California, consent can also be witnessed verbal or electronic, so say how you take it.

Pet photos and patient stories need a release

The friendliest way a practice publishes patient information is also the easiest to forget: the “patient of the month” post, the before-and-after of a wound, the recovery story on the blog, the photo of a client’s dog added to your Google profile.

Under the California text, a photo of a named pet with “back on her feet after knee surgery” discloses information “concerning an animal patient” and “the veterinary care provided”. Under Florida’s, the caption discusses the medical condition with everyone who reads it. Both need consent first, and Florida’s must be written.

A media release that covers it, signed at intake or on the day:

1. The pet’s name and the client’s name, and whether either may be shown.
2. What may be shared: photos, video, the condition, the treatment, the outcome.
3. Where: your website, your Google Business Profile, each social account by name, printed material.
4. How the client withdraws it, and what you will take down when they do.
5. A date and a signature. In California, note it if the consent was verbal and witnessed, and by whom.

Keep the signed releases where the person who posts can check them. A photo taken in the exam room with a phone goes to Instagram faster than anyone remembers to look for a form.

Review replies: where Texas is different

For a practice under HIPAA, the safe review reply confirms nothing about the patient; the dental review-reply post covers why. Two of the three states read here look much the same: Florida bars discussing the condition without written authorization, and California bars disclosing any information about the patient without consent. A one-star review is not a release.

Texas added a narrow exception to its statute in 2021, through H.B. 2850. Under §801.353(d-2), the privilege is waived for information about the animal’s care that “the client or owner publishes in a public forum” if all three conditions hold:

1. What the owner posted “is false with respect to the veterinarian”.
2. Your reply “is limited to factual information of which the veterinarian has knowledge that directly refutes the false information”.
3. You share no personally identifiable information of the client “other than the full name of the client or owner”.

So a Texas reviewer who writes “they never ran bloodwork before surgery”, when you did, has opened the door to one fact: the bloodwork was run, and on which date. Not the diagnosis, not the bill, not the client’s phone number or the time they arrived late.

It is still a narrow door. You decide what is “false”, and a board or a court may disagree. Google checks a reply against its own content policies, not your state’s statute. For anything beyond one plain fact, call whoever advises the practice first. The tone of a reply after a pet has died is covered in the veterinary local SEO guide, and it applies in every state.

Website forms and the vendors behind them

Every web form, booking widget and reminder tool sends client and patient data to a company other than yours. With no HIPAA in the picture, your state’s statute is what decides whether that hand-off counts as a disclosure.

The 2019 JAVMA article describes two ends of that range. The AVMA’s Model Veterinary Practice Act lets a vet disclose identifiable information “to a third party so that the third party can use the information to provide services for or perform functions on behalf of the licensed veterinarian,” if the third party gives a written agreement to keep it confidential. California’s code, the authors write, “does not specifically authorize disclosure of records to third parties providing services to a practice.”

What to do with that on your website:

• Ask only for what the first call needs: the owner’s name, phone, the pet’s name and species, and the reason in a few words.
• Say on the form that medical details are better given by phone.
• Ask each vendor that receives form data for a written confidentiality agreement. If you practice in California, ask your counsel whether that is enough.

What to change this week

1. Read your state’s confidentiality section. If you are in Texas, California or Florida, the sources below link to it.
2. Search your website for “HIPAA” and replace each mention with what your state’s law says and what you do.
3. Add a media release to the intake packet, naming the website, the Google profile and each social account.
4. Go through the last year of patient photos on the website, the profile and social media, and take down any without a release.
5. Write down who may reply to reviews, and in Texas, who decides whether a review is false before anyone answers it.
6. Check that the contact form doesn’t invite medical history.

None of this is legal advice for your practice. It is the text of three statutes, read on one day, set beside the places a practice publishes. LocalBiz can build the website and profile that carry your answers once you have them.