Can Doctors Respond to Bad Online Reviews?

Not responding to a bad online review may give other readers the impression the post is legitimate, so a doctor's instinct is to fight false claims being made against their practice. While the HIPAA does not specifically address how doctors can respond to bad online reviews, it is possible to extrapolate what is and isn't permitted.

Patient self-disclosure

Patients can disclose their own information as much as they want, but healthcare providers should not actively aid the patient in the disclosure. In the case of an online review, the patient is the one who initiates the public disclosure of protected health information (PHI); therefore, you are not at fault of anything... yet.

Avoid acknowledgement of patient status

At the root of online reviews is the reasonable assumption that the person leaving the review is a patient of the doctor for which the review is intended. Since healthcare providers are precluded from identifying patients in any way, the mere act of acknowledging the reviewer is a patient would be a HIPAA violation. This doesn't mean you can't respond, you just can't aid in the patient's self disclosure.

Here is an example of a possible reply to a bad online review. Notice the absence of patient status being acknowledged.

Our privacy policy prevents us from responding directly to this post; therefore, we are unable to legally refute this person’s opinion. For people interested in our office, please make an informed decision by seeking information from a variety of sources.

Clinical information disclosure

The typical review, good or bad, will usually contain some form of clinical information. Confirming clinical information is far more precarious than patient status acknowledgement. Doctors and staff must avoid posting anything related to the symptoms or treatment of an individual online.

Even when a patient posts a raving review of a doctor's masterful skills, it would be advised to never add to the disclosure already made by the patient.

If a happy patient wants to tell everyone about their great experience, it's best to guide the patient to authorizing the use of their post as a testimonial by getting a signature.

Of course, replying online with a simple "thank you" is likely fine. After all, the HIPAA doesn't exist to take away human decency; quite the opposite in fact.

by Dr. Jeff Brown

Jeff Brown, DC, is CEO at HIPAAMATE and dedicated to making HIPAA compliance comfortable for small- and medium-sized healthcare practices and business associates. Dr. Brown’s career spans private practice, compliance consulting, and software product management for three healthcare technology companies.

DISCLAIMER: Because of the generality of this article, the information provided herein may not be applicable in every situation and should not be acted upon without specific legal advice based on particular situations.

See More HIPAA Articles

Free Software Demo

No time to watch now? Don't worry. We'll send it to your email inbox. Unsubscribe at any time.