Can Doctors Respond to Bad Online Reviews?
Not responding to a bad online review may give other readers the impression the post is legitimate, so a doctor's instinct is to fight false claims being made against their practice. While the HIPAA does not specifically address how doctors can respond to bad online reviews, it is possible to extrapolate what is and isn't permitted.
Patients can disclose their own information as much as they want, but healthcare providers should not actively aid the patient in the disclosure. In the case of an online review, the patient is the one who initiates the public disclosure of protected health information (PHI); therefore, you are not at fault of anything... yet.
Avoid acknowledgement of patient status
At the root of online reviews is the reasonable assumption that the person leaving the review is a patient of the doctor for which the review is intended. Since healthcare providers are precluded from identifying patients in any way, the mere act of acknowledging the reviewer is a patient would be a HIPAA violation. This doesn't mean you can't respond, you just can't aid in the patient's self disclosure.
Here is an example of a possible reply to a bad online review. Notice the absence of patient status being acknowledged.
Clinical information disclosure
The typical review, good or bad, will usually contain some form of clinical information. Confirming clinical information is far more precarious than patient status acknowledgement. Doctors and staff must avoid posting anything related to the symptoms or treatment of an individual online.
Even when a patient posts a raving review of a doctor's masterful skills, it would be advised to never add to the disclosure already made by the patient.
If a happy patient wants to tell everyone about their great experience, it's best to guide the patient to authorizing the use of their post as a testimonial by getting a signature.
Of course, replying online with a simple "thank you" is likely fine. After all, the HIPAA doesn't exist to take away human decency; quite the opposite in fact.
by Dr. Jeff Brown
Jeff Brown, DC, is CEO at HIPAAMATE and dedicated to making HIPAA compliance comfortable for small- and medium-sized healthcare practices and business associates. Dr. Brown’s career spans private practice, compliance consulting, and software product management for three healthcare technology companies.
DISCLAIMER: Because of the generality of this article, the information provided herein may not be applicable in every situation and should not be acted upon without specific legal advice based on particular situations.