Unhappy consumers, including patients, are free to express dissatisfaction with services they receive from providers on popular social media or online review platforms, such as Yelp and Google. At least in the healthcare industry, providers must be very careful when responding, if they respond at all.

“OCR continues to receive complaints about health care providers disclosing their patients’ protected health information on social media or on the internet in response to negative reviews. Simply put, this is not allowed,” said OCR Director Melanie Fontes Rainer. “The HIPAA Privacy Rule expressly protects patients from this type of activity, which is a clear violation of both patient trust and the law. OCR will investigate and take action when we learn of such impermissible disclosures, no matter how large or small the organization.”

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with a New Jersey provider of adult and child psychiatric services. According to the settlement, the provider “impermissibly disclosed the PHI of four (4) patients in response to their negative reviews posted on Google Reviews.” The OCR claimed that the provider included the complaining patient’s diagnosis and treatment of their mental health condition in the online response. The investigation that followed the complaint also revealed, according to the settlement materials, (i) responses by the provider to three other patients including protected health information and (ii) that the practice’s written policies and procedures were not HIPAA compliant.

Read more at National Law Review >>