Responding to online reviews under HIPAA: what three OCR settlements show a practice

The basic principle in the HHS summary of the Privacy Rule is that a covered entity may not use or disclose protected health information except as the rule permits or requires, or as the individual authorizes in writing. Replying to a review is absent from the list of permitted purposes.

Protected health information is wider than most people expect. HHS defines individually identifiable health information as information, including demographic data, that relates to a person's physical or mental health, the care provided to them, or payment for that care, and that identifies the person or could reasonably be used to identify them. When a reviewer posts under their own name, a reply that says "we reviewed your chart" or "your insurance denied the claim" links that name to care and payment. For a therapy practice, confirming that someone was a client at all says something about their mental health.

Elite Dental Associates, Dallas, 2019. According to the resolution agreement, a patient complained that the practice replied to her Yelp review with her last name, details of her treatment plan, and insurance and cost information. OCR then found replies to other patients' reviews that also disclosed their information. The practice paid $10,000 and adopted a corrective action plan; the agreement also cites missing policies on releasing information on social media.

New Vision Dental, California, 2022. OCR settled with B. Brandon Au, DDS, Inc., doing business as New Vision Dental, over disclosure of patient information in response to online reviews. HHS describes the conduct as the provider's inappropriate use of social media to respond to patient reviews. The practice paid $23,000 and agreed to a corrective action plan.

Manasa Health Center, New Jersey, 2023. A provider of adult and child psychiatric services, the practice was the subject of a complaint in April 2020 that it disclosed a patient's information while replying to a negative online review. The potential violations listed by OCR include impermissible disclosures in response to negative online reviews and failure to implement policies and procedures for protected health information. It paid $30,000 and agreed to a corrective action plan.

Resolution agreements settle potential violations; the Elite agreement states that it is no admission of liability. The pattern across all three is still plain: a practice owner defended the practice in public, and the defence used patient details.

A review reply is written for the next reader, the prospective client deciding whether to book. A calm, short, consistent reply tells that reader more about the practice than any rebuttal could. The reader cannot check who was right; they can see how the practice behaves under criticism.

A workable template: "Thank you for taking the time to share this. Our privacy obligations mean we never discuss anyone's care in public. Please call our practice manager at the main number so we can talk it through." It thanks the writer, confirms nothing, and moves the conversation offline. The same wording works for five star reviews, which also must avoid confirming that the reviewer is a patient.

Two federal limits on review handling come from outside HIPAA. The FTC's 2024 rule on reviews prohibits using groundless legal threats, intimidation or certain false public accusations to remove a negative review, and prohibits paying for reviews on condition of positive or negative sentiment.