Health care providers should take heed of the $10,000 settlement announced on October 2, 2019 between the U.S. Department of Health and Human Service (HHS) Office for Civil Rights (OCR) and a small dental practice based on impermissible disclosures on Yelp, a popular business directory service and crowd-sourced review forum. Although this settlement pertains to a dental practice, it is important to recognize that the underlying lesson – do not publicly post patient information on Internet sites, such as Yelp, without a valid authorization – applies equally to all HIPAA covered entities. Physician practices and other health care providers should be extremely cautious in responding to patient posts and reviews on the Internet.
In June 2016, OCR received a patient complaint alleging that the dental practice's response to a Yelp review had disclosed the patient's protected health information (PHI), including last name, details of treatment plan, insurance, and cost information. OCR's investigation of the complaint, which included a review of the dental practice's Yelp page, revealed that the dental practice had similarly disclosed PHI of other patients without valid authorization in responding to patient reviews. OCR concluded that the practice's Yelp posts constituted impermissible disclosures of PHI in violation of HIPAA.
In the HHS press release discussing the settlement, OCR Director Roger Severino states, "Social media is not the place for providers to discuss a patient's care. Doctors and dentists must think carefully about patient privacy before responding to online reviews." Severino's statement reinforces two important points: (1) responding to online reviews is not outright prohibited by HIPAA, but must be done cautiously and in a way that does not discuss patient care or other PHI; and (2) this lesson is not limited to dental practices, but also applies to physicians and other HIPAA covered entities.
Although $10,000 may not seem like a strong admonition to some larger practices, the press release confirms that OCR accepted a "substantially reduced settlement amount" as a result of the dental practice's size, financial situation, and cooperation with OCR during its investigation. Thus, a larger practice who impermissibly discloses PHI on social media could find itself facing significantly more onerous financial consequences.