Four practices that paid for a reply
| Practice | Year | Paid | What the reply did |
|---|---|---|---|
| Elite Dental Associates, Dallas | 2019 | $10,000 | Gave a patient's last name and health details in a reply on Yelp |
| New Vision Dental, California | 2022 | $23,000 | Named patients who had posted under a nickname on Yelp, and added their visits, treatment and insurance |
| Dr. U. Phillip Igbinadolor, D.M.D. & Associates, North Carolina | 2022 | $50,000 | Disclosed a patient's information in a reply to a negative review, then didn't answer the regulator's data request or subpoena |
| Manasa Health Center, New Jersey | 2023 | $30,000 | Posted a patient's mental health diagnosis and treatment in a reply to a Google review |
- The regulator is the Office for Civil Rights (OCR) at the US Department of Health and Human Services.
- Manasa's case began with one complaint, in April 2020. OCR then found four patients' details in its replies to Google reviews.
“Providers cannot disclose [the] protected health information of their patients when responding to negative online reviews. This is a clear NO.”
on the New Vision Dental settlement, The HIPAA Journal, December 2022
Even a yes can be too much
- The law firm Nixon Peabody warns that "even confirmation of facts posted online by a patient may raise compliance issues under HIPAA."
- So never write "when you came in for your crown". The patient may have said it. Your reply can't.
“Social media is not the place for providers to discuss a patient's care.”
on the Elite Dental Associates settlement, GovInfoSecurity, October 2019
What a reply can say
- Thank them for the feedback, in words that would fit anyone.
- Say how your practice handles a concern like this, for every patient.
- Give a phone number or email and take it private.
- If the review breaks the site's rules, report it. Here's how Google handles a report.
Who may post it
- Nixon Peabody says to train your PR, social media and administrative teams on acceptable online replies, and on what content may result in a HIPAA breach.
- Name the one or two people who can post a reply, and write it into your crisis plan.
- Everyone else sends a review they spot to those people, and never answers it on their own.
- The same rule holds for creators a clinic or telehealth brand pays. Creators share their own experience and point people to you, they never diagnose, recommend, or make a direct health claim.