HHS Warns About Violating Confidentiality in Response to Online Reviews

In June, the U.S. Department of Health and Human Services (HHS) released information about a settlement agreement with a psychiatric practice that resulted from the practice’s violating the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule by posting protected health information in response to negative online reviews about the practice.

The HHS investigation found that the psychiatric practice posted responses to four negative online reviews that included specific information regarding the patients’ diagnoses and treatment. Under the settlement, the practice paid $30,000 and agreed to implement a corrective action plan to resolve these violations.

Given that the $30,000 fine is on the relatively low side for HIPAA violations, the choice by HHS to publicize this incident may be seen as a warning from HHS about how seriously it takes providers violating patient confidentiality when responding to negative online reviews. HHS has explicitly warned that it will continue to investigate and take action against disclosures of protected health information on social media or on the internet in response to online reviews, “no matter how large or small the organization.”

The APA Ethics Committee has provided guidance about how to approach such negative reviews in its Resource Document on Responding to Negative Online Reviews, including specific language that can be used to respond to reviews while maintaining compliance with HIPAA and APA ethics. ■