HIPAA and negative review replies: what OCR enforcement shows and what to do if a reply went too far

A practice that replies to a one-star review is writing in public, to an audience that includes the patient, their family, their employer and anyone searching for the practice. Under the HIPAA Privacy Rule, a reply that confirms someone is a patient or adds details about their care can be a disclosure of protected health information. The HHS Office for Civil Rights (OCR) has settled at least three cases built on exactly this, and the documents it published show what went wrong in each one and what the practices then had to put in place.

This guide reads those cases closely, explains the rule each one cites, and covers what a practice can do if a reply has already gone out that should not have. For reply wording and a review request process, see our companion guide on patient review replies. If a reviewer takes the complaint to a reporter, see our guide to HIPAA and media inquiries about patients. Replies in forum threads and community sites raise the same issue, covered in our guide to staff posting on Reddit, forums and Wikipedia. Comments under articles on your own blog follow the same logic, and our guide to blog comments on a practice website covers moderation and replies there. For Yelp’s own rules on replies, review requests and Consumer Alerts, see our guide to Yelp for medical practices. Contract terms that try to stop patients from posting reviews are covered in our guide to review gag clauses in patient agreements. Reposting or replying to patient posts that tag the practice is covered in reposting patient posts and tags.

The rule the cases rest on

The HIPAA Privacy Rule starts from a prohibition. Under 45 CFR 164.502(a), a covered entity may not use or disclose protected health information except as the Privacy Rule permits or requires. The permitted list includes disclosures to the individual and disclosures for treatment, payment and health care operations. Replying to a public review is none of these: a reply posted on Yelp or Google is not a private message to the patient, because anyone can read it.

Two points follow from that, and both appear in the cases below.

• The patient going public does not open the door. A patient who writes about their own visit has chosen to share their own information. Nothing in 164.502(a) lets the practice add to it in a public reply.
• Confirming the relationship is itself information. A reply that says “we treated you” or “your appointment” links a named or recognizable person to the practice. For a psychiatric, addiction, fertility or sexual health practice, that alone can reveal a great deal.

Three settlements, side by side

OCR announces only some of its resolutions, so these three are the published examples, not a count of every case. Each was resolved by a resolution agreement and a corrective action plan, and each agreement states that it is not an admission of liability.

1. Elite Dental Associates, Dallas, Texas (announced October 2, 2019). According to the HHS press release, a patient complained in June 2016 that the practice had responded to a review by disclosing the patient’s last name and details of their health condition. OCR found the practice had disclosed the protected health information of multiple patients in replies on its Yelp review page, had no policy on disclosures through social media, and had a Notice of Privacy Practices that did not comply with the rule. The practice agreed to pay $10,000, which OCR described as a substantially reduced amount given the practice’s size, finances and cooperation, and to a corrective action plan with two years of OCR monitoring.
2. New Vision Dental, California (announced December 14, 2022). The resolution agreement says a November 2017 complaint alleged the practice habitually disclosed patient information when replying to Yelp reviews, sometimes giving full names where patients had used only Yelp screen names, and including details about visits and insurance that the original reviews had not mentioned. OCR confirmed this on the Yelp page. The covered conduct lists impermissible disclosure under 164.502(a), a Notice of Privacy Practices missing required content under 164.520(b), and failure to implement policies and procedures, including on releasing information on social media and public platforms, under 164.530(i). The practice paid $23,000 and agreed to a two year corrective action plan.
3. Manasa Health Center, New Jersey (announced June 5, 2023). A provider of adult and child psychiatric services. According to the resolution agreement, the practice disclosed the protected health information of four patients in response to their negative reviews on Google Reviews, and failed to implement policies and procedures required by the Privacy and Breach Notification Rules. The practice paid $30,000 and agreed to a corrective action plan.

The OCR director quoted in the 2022 release put it plainly: providers cannot disclose patients’ protected health information when responding to negative online reviews. The 2019 release quoted the then director: social media is not the place for providers to discuss a patient’s care. The same goes for a reporter who calls about a complaint; our guide to press releases and media interviews covers the OCR cases on that.

What the three cases have in common

• A complaint started each case. In all three, OCR acted on a complaint. In the 2019 case it came from the patient whose last name and condition appeared in the reply. Manasa’s complaint was received in April 2020, New Vision’s in November 2017.
• The reply added something. A full name where the reviewer used a screen name, a diagnosis, treatment details, insurance information. The added detail is the disclosure.
• It was a pattern, not one bad night. Elite and New Vision disclosed information of multiple patients; Manasa disclosed information of four. A practice without a written rule tends to repeat the same reply style.
• Missing paperwork was cited alongside the replies. Two of the three were also cited for a deficient Notice of Privacy Practices, and all three for missing policies and procedures. The investigation looks at the whole privacy program, not just the posts.

What the corrective action plans required

The New Vision Dental corrective action plan is published in full and is a useful picture of what OCR asked a small practice to build. Its terms include the following.

• Written policies and procedures covering permitted and prohibited uses and disclosures, sent to HHS for review and approval within 30 days.
• A policy limiting use and disclosure to the minimum necessary in electronic formats, expressly including email, internet and social media sites.
• Policies on the practice’s HIPAA authorization form and on how it evaluates authorizations.
• A Notice of Privacy Practices that describes the uses and disclosures that need patient authorization, giving as an example posting on the practice’s website, social media pages or other public platforms.
• Training for every workforce member within 30 days, with signed or electronic certification and the date, reviewed at least annually.
• Internal reporting so staff report potential violations promptly, and written reports to HHS within 30 days of finding that a workforce member broke the policies.
• A compliance term of two years under OCR monitoring.

These are terms in one negotiated agreement, not a checklist OCR publishes for everyone. They line up closely with the general Privacy Rule duties, though: 45 CFR 164.530(i) requires policies and procedures designed to comply with the rule, 164.530(b) requires training of the workforce on them, and 164.530(e) requires sanctions for workforce members who do not follow them.

Building a review reply policy before you need it

The cases suggest that the problem is rarely a single person’s judgment in the moment. It is the absence of a rule that tells that person what to do. If you use alerts to catch new reviews and mentions, our guide to social listening for practices covers what an alert should and should not lead to. A short written policy, adopted as part of your privacy policies under 164.530(i), can cover the following.

1. Who may reply. Name the people allowed to post on review sites and social media for the practice. A short list makes it clear who is accountable for what gets posted.
2. What a reply may contain. A general statement of the practice’s standards, an invitation to contact the office directly, and nothing that confirms the reviewer is or was a patient. Our reply templates follow this pattern.
3. What a reply may never contain. Names, dates of visits, diagnoses, procedures, medications, insurance or billing details, or anything that answers the reviewer’s account of their care, even to correct it.
4. When not to reply. Some reviews are better left without a public reply. Reviews that break the platform’s rules can be reported instead of answered.
5. A second look. For a heated or detailed review, a second person reads the draft reply before it is posted.
6. Where it lives. The policy sits with your other privacy policies and your social media policy, and new staff are trained on it as part of HIPAA training.

If a reply has already disclosed too much

Practices find old replies when someone new takes over the review profiles. If a reply names a patient or describes their care, here is what the regulations point to. Each step is a decision for your privacy officer, ideally with a health care attorney.

1. Take the reply down or rewrite it. Google’s help page on managing reviews explains that a business can edit or delete its reply from the Business Profile. Other platforms have similar controls. Under 45 CFR 164.530(f), a covered entity must mitigate, to the extent practicable, any harmful effect it knows of from a use or disclosure that violated its policies or the rule.
2. Keep a record before you remove it. Capture what the reply said, when it was posted and when it was taken down. You will need it for the next step.
3. Assess whether it is a breach. Under 45 CFR 164.402, an impermissible disclosure of protected health information is presumed to be a breach unless the covered entity shows a low probability that the information was compromised, based on a risk assessment of at least four factors: the nature and extent of the information, who received it, whether it was actually acquired or viewed, and how far the risk has been mitigated. A public reply on a review site is, by design, viewable by anyone.
4. Notify if required. If it is a breach of unsecured protected health information, 164.404 requires notice to the affected individual without unreasonable delay and no later than 60 calendar days after discovery. For breaches affecting fewer than 500 individuals, 164.408(c) requires the covered entity to keep a log and report them to HHS no later than 60 days after the end of the calendar year.
5. Fix the cause. Adopt or update the reply policy, train the people who post, and apply your sanctions policy under 164.530(e) where it fits.

Deleting the reply without the assessment does not make the disclosure go away; the rule asks what happened and what risk it created.

Where reviews fit in local search

None of this means avoiding reviews. Reviews and replies are visible on your Google Business Profile, and a steady flow of genuine reviews, answered in a short, careful voice, is part of a healthy local presence. Our Google Business Profile guide for doctors covers the profile itself, and the review replies guide covers how to ask for reviews within FTC and Google rules.

How we approach reviews for practices

In our healthcare SEO work, review replies follow a written policy the practice approves first: replies never confirm someone is a patient, never add details, and invite the reviewer to call the office. We draft and the practice decides what is posted. We do not post replies that answer the specifics of a patient’s care.

Sources

• HHS: Dental practice pays $10,000 to settle social media disclosures of patients’ protected health information (October 2, 2019)
• HHS: Civil Rights Office enters settlement with dental practice over disclosures of patients’ protected health information (December 14, 2022)
• HHS OCR: New Vision Dental resolution agreement and corrective action plan
• HHS OCR: Agreement with Manasa Health Center over disclosures in response to negative online reviews (June 5, 2023)
• HHS OCR: Manasa Health Center resolution agreement and corrective action plan
• 45 CFR 164.502: Uses and disclosures of protected health information, general rules
• 45 CFR 164.530: Administrative requirements (training, sanctions, mitigation, policies and procedures)
• 45 CFR 164.402: Breach definitions
• 45 CFR 164.404: Notification to individuals
• 45 CFR 164.408: Notification to the Secretary
• Google Business Profile Help: Manage customer reviews

More in Local SEO and reviews for practices