Managing Your Practice

Online patient reviews and HIPAA


In 2013, a California hospital paid $275,000 to settle claims that it violated the HIPAA privacy rule when it disclosed a patient’s health information in response to a negative online review. More recently, a Texas dental practice paid a substantial fine to the Department of Health & Human Services, which enforces HIPAA, after it responded to unfavorable Yelp reviews with patient names and details of their health conditions, treatment plans, and cost information. In addition to the fine, the practice agreed to 2 years of monitoring by HHS for compliance with HIPAA rules.

Dr. Joseph S. Eastern, a dermatologist in Belleville, N.J.

Dr. Joseph S. Eastern

Most physicians have had the unpleasant experience of finding a negative online review from a disgruntled patient or family member. Some are justified, many are not; either way, your first impulse will often be to post a response – but that is almost always a bad idea. “Social media is not the place for providers to discuss a patient’s care,” an HHS official said in a statement issued about the dental practice case in 2016. “Doctors and dentists must think carefully about patient privacy before responding to online reviews.”

Any information that could be used to identify a patient is a HIPAA breach. This is true even if the patient has already disclosed information, because doing so does not nullify their HIPAA rights, and HIPAA provides no exceptions for responses. Even acknowledging that the reviewer was in fact your patient could, in some cases, be considered a violation.

Responding to good reviews can get you in trouble too, for the same reasons. In 2016, a physical therapy practice paid a $25,000 fine after it posted patient testimonials, “including full names and full-face photographic images to its website without obtaining valid, HIPAA-compliant authorizations.”

And by the way, most malpractice policies specifically exclude disciplinary fines and settlements from coverage.

All of that said, there are legal and ethical ways to deal with negative reviews. Here are some options:

  • Ignore them. This is your best choice most of the time. Most negative reviews have minimal impact and simply do not deserve a response; responding may pour fuel on the fire. Besides, an occasional negative review actually lends credibility to a reviewing site and to the positive reviews posted on that site. Polls show that readers are suspicious of sites that contain only rave reviews. They assume such reviews have been “whitewashed” – or just fabricated.
  • Solicit more reviews to that site. The more you can obtain, the less impact any complaints will have, since you know the overwhelming majority of your patients are happy with your care and will post a positive review if asked. Solicit them on your website, on social media, or in your email reminders. To be clear, you must encourage reviews from all patients, whether they have had a positive experience or not. If you invite only the satisfied ones, you are “filtering,” which can be perceived as false or deceptive advertising. (Google calls it “review-gating,” and according to their guidelines, if they catch you doing it they will remove all of your reviews.)
  • Respond politely. In those rare cases where you feel you must respond, do so without acknowledging that the individual was a patient, or disclosing any information that may be linked to the patient. For example, you can say that you provide excellent and appropriate care, or describe your general policies. Be polite, professional, and sensitive to the patient’s position. Readers tend to respect and sympathize with a doctor who responds in a professional, respectful manner and does not trash the complainant in retaliation.
  • Take the discussion offline. Sometimes the person posting the review is just frustrated and wants to be heard. In those cases, consider contacting the patient and offering to discuss their concerns privately. If you cannot resolve your differences, try to get the patient’s written permission to post a response to their review. If they refuse, you can explain that, thereby capturing the moral high ground.

If the review contains false or defamatory content, that’s a different situation entirely; you will probably need to consult your attorney.

Regardless of how you handle negative reviews, be sure to learn from them. Your critics, as the song goes, are not always evil – and not always wrong. Complaints give you a chance to review your office policies and procedures and your own conduct, identify weaknesses, and make changes as necessary. At the very least, the exercise will help you to avoid similar complaints in the future. Don’t let valuable opportunities like that pass you by.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News. Write to him at [email protected]

Next Article: