Unhappy consumers, including patients, are free to express dissatisfaction with services they receive from providers on popular social media or online review platforms, such as Yelp and Google. At least in the healthcare industry, providers must be very careful when responding, if they respond at all.

“OCR continues to receive complaints about health care providers disclosing their patients’ protected health information on social media or on the internet in response to negative reviews. Simply put, this is not allowed,” said OCR Director Melanie Fontes Rainer. “The HIPAA Privacy Rule expressly protects patients from this type of activity, which is a clear violation of both patient trust and the law. OCR will investigate and take action when we learn of such impermissible disclosures, no matter how large or small the organization.”

Yesterday, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with a New Jersey provider of adult and child psychiatric services. According to the settlement, the provider “impermissibly disclosed the PHI of four (4) patients in response to their negative reviews posted on Google Reviews.” The OCR claimed that the provider included the complaining patient’s diagnosis and treatment of their mental health condition in the online response. The investigation that followed the complaint also revealed, according to the settlement materials, (i) responses by the provider to three other patients including protected health information and (ii) that the practice’s written policies and procedures were not HIPAA compliant.

While not admitting any wrongdoing, the practice agreed to pay $30,000 to OCR and to implement a corrective action plan (CAP) to resolve the potential violations. As a practical matter, the monetary settlement may be less of a burden than the CAP. According to the settlement materials, the CAP requires that the practice:

• be monitored for two years by OCR to ensure compliance with the HIPAA Privacy Rule, 
• develop, maintain, and revise written policies and procedures to comply with the HIPAA Privacy Rule,
• train all members of it workforce, including owners and managers, on the organization’s policies and procedures,

• issue breach notices to all individuals, or their personal representatives, whose protected health information is disclosed on any internet platform without a valid authorization, and

• submit a breach report to HHS concerning individuals whose protected health information is disclosed on any internet platform without a valid authorization.

So, what should a small healthcare practice be doing to avoid a similar penalty and CAP:

• Get complaint with HIPAA and Maintain Policies on Disclosures in Social Media! HIPAA covered healthcare providers should have policies and procedures related to the disclosures of PHI and more specifically with regard to disclosures of PHI on social media.
• Train staff (including healthcare providers and owners) concerning these policies. Policies alone may not be enough. The OCR also may ask for sign-in sheets showing staff attended the training, along with the materials that the training was based on.
• Maintain a HIPAA Notice of Privacy Practice. At a minimum, this should be posted in the office and on the practice’s website, as applicable.
• Monitor social media activity by staff. Understand the social media channels that the practice engages in and consider periodically monitoring public social media activity by staff.
• Cooperate with the OCR. Covered entities should absolutely make their case to the OCR in defense of a compliance review or investigation. At the same time, being responsive to the agency’s requests can go a long way toward resolving the matter quickly and with minimal impact. Having experienced legal counsel versed in the HIPAA Privacy and Security Rules to guide the practice can be tremendously helpful.