Social listening for healthcare brands and practices: the rules

Social listening means tracking what people say in public about your practice, your products, your competitors or a condition you treat: mentions on social platforms, forum threads, review sites, news comments. It is a useful way to find unhappy patients before they leave, spot questions your website does not answer, and hear about product problems early. It also puts health information about named people in front of your team. What you do with that information is where the rules come in.

This guide is for independent practices that watch their own name online and for health companies (drug and device makers, digital health apps, supplement and wellness brands) that run broader listening programs, in house or through a vendor. It covers platform terms, health inferences, state consumer health data laws, HIPAA when a practice recognizes a patient, public replies, adverse event monitoring and the line between monitoring reviews and managing them. For posting in communities rather than listening to them, see staff posting on Reddit, forums and Wikipedia.

The short version

• Listen to topics, not to people. Counting mentions, themes and sentiment is low risk. Building a file on what a named person said about their health is not.
• Public does not mean free to use. X’s developer terms say not to derive or infer a user’s health from its data, and Reddit’s builder policy bars inferring sensitive traits such as health. Your listening vendor gets its data under terms like these.
• Inferred health data can be consumer health data. Washington’s My Health My Data Act counts health status inferred from non-health information, including by algorithms, and requires consent to collect it (RCW 19.373.010, 19.373.030).
• Practices: recognizing a patient is not permission to say so. A public reply that confirms someone is your patient is a disclosure under HIPAA. HHS OCR has settled cases over exactly that.
• Drug and device makers: listening finds adverse events. Information from any source counts once you have it (21 CFR 314.80(b), 803.50(a)). Route it to your safety team.
• Monitoring reviews is fine. Shaping them is not. Fake reviews, threats to get reviews removed and hiding negative reviews are covered by 16 CFR Part 465.

What social listening is, and what it is not

A listening program usually has three layers. Monitoring catches direct mentions of your name, your doctors or your products. Topic listening tracks themes, such as what people ask about a procedure or which complaints come up about a type of device. Competitive listening watches what is said about other practices or brands.

None of that requires knowing who a person is beyond the post itself. The risk starts when the program moves from “what are people saying” to “who is saying it, and what do we know about their health”: tagging individuals by condition, saving profiles, matching handles to your patient list or your customer database, or feeding the results into advertising. Keep the program on the first side of that line unless your counsel has signed off on the second.

Platform terms: public posts come with conditions

Most listening tools get their data through platform APIs or licensed data feeds, and those come with use rules. Two examples, paraphrased:

• X. The developer terms on restricted use cases tell developers not to derive or infer, or store inferences about, a user’s health (pregnancy is named), and to get express opt-in consent before linking an X account to an identifier off X, such as an email address or a customer record.
• Reddit. The Responsible Builder Policy requires approval before accessing Reddit data and bars using it to infer sensitive characteristics, health among them, or to target or profile people on that basis.

Read the current terms of each platform you listen to, and ask your vendor in writing how it gets its data and which uses its licenses allow. Screen scraping a platform whose terms forbid it is not a workaround; it is a separate breach of those terms. If a vendor cannot explain its data sources, do not hand it your brand.

Health inferences and state consumer health data laws

A listening tool that labels a post “user has diabetes” or “considering IVF” is creating health information about a person. Several states now regulate that kind of data outside HIPAA. Washington’s My Health My Data Act is the broadest example:

• Inferences count. Consumer health data includes information a business processes to associate a consumer with a health condition when it is “derived or extrapolated from nonhealth information”, including inferred data produced by algorithms or machine learning (RCW 19.373.010).
• Collecting includes inferring. The Act defines “collect” to include accessing, retaining, inferring and deriving consumer health data (RCW 19.373.010).
• Consent comes first. A regulated entity may not collect consumer health data except with the consumer’s consent for a specified purpose, or as necessary to provide a product or service the consumer asked for (RCW 19.373.030(1)(a)).
• The public-information exclusion is narrow. Personal information excludes publicly available information, but that is defined as information from government records or widely distributed media that the business has a reasonable basis to believe the consumer lawfully made public (RCW 19.373.010). Whether a given post, and an inference drawn from it, fits that definition is a question for counsel, not an assumption to build on.

Our guide to consumer health data privacy laws compares Washington, Nevada and Connecticut. The simplest way to stay clear of all three is to report themes in aggregate and not attach health labels to identifiable people.

Practices: when you recognize a patient online

A practice watching its own name will sometimes see a post from someone it knows is a patient. That knowledge comes from your records, so it is protected health information. Under 45 CFR 164.502(a), a covered entity may not use or disclose it except as the Privacy Rule permits, and a public reply confirming that the person is a patient, or adding details about their care, is a disclosure.

• Do not reply with what you know from the chart. Reply in general terms and invite the person to contact the office. Our guide to HIPAA and negative review replies walks through three HHS OCR settlements (Elite Dental Associates, New Vision Dental and Manasa Health Center) that all began with a public reply.
• Do not add posts to the record or to a marketing list. Matching social handles to patient records for outreach is a use of patient information for a new purpose. Review it with your privacy officer first, and see our guide to HIPAA marketing rules.
• A vendor that gets patient data is a business associate. If you upload your patient list to a listening tool so it can flag patients, the vendor is receiving protected health information on your behalf, which fits the business associate definition in 45 CFR 160.103 and needs a contract under 164.504(e). Most practices do not need that: monitoring your practice name does not require any patient data.
• Take it offline. If a post describes a problem with care, the useful reply is a phone number and a named contact. The follow-up happens in private, where you can verify who you are talking to.

For reply wording, see our patient review reply templates, and for the staff side, our healthcare social media policy guide.

Drug and device makers: listening will find adverse events

If your company holds an approved drug application, 21 CFR 314.80(b) requires prompt review of adverse drug experience information obtained or otherwise received from any source, foreign or domestic. Device manufacturers must submit a report within 30 calendar days of receiving or otherwise becoming aware of information, from any source, that reasonably suggests a marketed device may have caused or contributed to a death or serious injury, or malfunctioned in a way that would be likely to cause one if it recurred (21 CFR 803.50(a)).

A listening program is a source. Once your team or your vendor has seen a post describing a side effect or a device failure, assume your company has received it. Before launch:

• Agree with your pharmacovigilance or complaint handling team which mentions count as potential reports and how fast they are forwarded.
• Write the routing into the vendor contract: what the vendor flags, to whom, within what time, and what it keeps.
• Train the marketing team that “interesting customer feedback” about a side effect is not theirs to sit on.
• Keep the listening scope deliberate. Listening to broad condition keywords pulls in far more posts that your safety team then has to assess.

Our guide to brand-run patient communities covers the same duties for communities you host yourself.

Monitoring reviews versus managing them

Watching review sites so you can reply quickly is ordinary practice. Where listening turns into review management, the FTC rule on consumer reviews and testimonials applies:

• No fake reviews. A business may not write, create or sell a review that misrepresents that the reviewer exists, used the product or service, or had the experience described, and may not buy such reviews or spread testimonials it knew or should have known were fake (16 CFR 465.2).
• No paying for a sentiment. Offering anything of value for a review that expresses a particular sentiment, positive or negative, is prohibited (16 CFR 465.4).
• No threats to get a review removed. 16 CFR 465.7(a) applies to anyone who uses an unfounded legal threat, a physical threat, intimidation or a knowingly false public accusation to stop a review or have it taken down. Listening that finds a harsh review should lead to a reply or a report under the platform’s rules, not a threatening message.
• No hiding negative reviews on your own site. If you show reviews on your website, withholding them because they are negative while implying the page shows most or all of them is suppression under 465.7(b).
• Platform rules add more. Google’s Maps content policy bars businesses from selectively asking only happy customers for reviews and from discouraging negative ones. Our Google Business Profile guide covers how to report reviews that break Google’s rules.

A listening setup that stays inside the rules

1. Write down the purpose. For example: find and answer public questions about our practice within one business day; track themes in what people ask about our services. A written purpose keeps scope from creeping.
2. Choose keywords that match the purpose. Your practice name, doctors’ names, product names and common misspellings. Add condition keywords only if there is a clear reason and, for drug and device makers, the safety team agrees.
3. Vet the vendor. Ask how it sources data, which platform terms it operates under, whether it labels individuals by health condition, how long it keeps posts, and whether it offers aggregate-only reports. Get the answers in the contract.
4. Turn off what you do not need. Disable individual profiling, demographic inference and audience export features unless counsel has approved a specific use.
5. Set a reply playbook. Who may reply, from which account, with what standard wording, and when to move a conversation to a phone call. Nothing from the chart goes into a public reply.
6. Route safety and privacy issues. Adverse events to the safety team; a post that reveals another patient’s information to the privacy officer.
7. Report in aggregate. Themes, volumes and examples with handles removed are enough for most marketing decisions.
8. Review once a year. Platform terms, state laws and your own use all change. Check the program against them on a set date.

An illustration

This is a made-up example, not a client. A dermatology practice sets up alerts for its name and its three physicians. One alert shows a post on a local forum: a person writes that their biopsy result took three weeks and nobody called. The front desk recognizes the name from the schedule. The reply that goes up says: “We are sorry to read this and would like to look into it. Please call our practice manager, [name], at [number].” It does not mention a biopsy, a result or any visit. The practice manager calls the patient from the chart, finds that a result notification was missed, and fixes the step in the workflow. The post, the reply and the follow-up are logged by the privacy officer. Nobody adds the forum handle to the patient record, and no marketing list is built from the alert.

Checklist

• Written purpose and keyword list.
• Vendor answers on data sources, platform terms, retention and profiling, in the contract.
• Individual health labeling and audience export switched off.
• Consent and public-information questions under Washington’s My Health My Data Act and other state laws reviewed with counsel, if you infer anything about individuals.
• No patient data sent to the vendor, or a business associate agreement in place if it is.
• Public reply wording that never confirms someone is a patient.
• Adverse event routing agreed with the safety team, if you make a drug or device.
• No fake, paid-for-sentiment or suppressed reviews; no threats to remove reviews.
• Annual review date set.

How we help

We help practices and health companies set up local search, review monitoring and reply workflows that keep patient information out of public replies. See how we approach healthcare SEO and local search, or browse more guides in health company marketing.

Sources

• 16 CFR Part 465: Use of Consumer Reviews and Testimonials (sections 465.2, 465.4, 465.7)
• 45 CFR 160.103: Definitions (business associate, protected health information)
• 45 CFR 164.502: Uses and disclosures of protected health information: general rules
• 45 CFR 164.504: Uses and disclosures: organizational requirements (business associate contracts)
• 21 CFR 314.80: Postmarketing reporting of adverse drug experiences
• 21 CFR 803.50: Manufacturer reporting requirements (Medical Device Reporting)
• RCW 19.373.010: Definitions (Washington My Health My Data Act)
• RCW 19.373.030: Consent to collect and share consumer health data
• X developer terms: More on restricted use cases
• Reddit: Responsible Builder Policy
• HHS: Dental practice pays $10,000 to settle social media disclosures of patients’ protected health information (Elite Dental Associates, 2019)
• HHS: Settlement with dental practice over disclosures of patients’ protected health information (New Vision Dental, 2022)
• HHS: Manasa Health Center resolution agreement (2023)
• Google: Prohibited and restricted content (Maps user contributed content policy)

More in Health companies, vendors and employers