A patient’s Google review and HIPAA: where the risk sits and what you can do

HIPAA’s privacy rules bind covered entities: health care providers, health plans and the businesses that handle records for them. A patient is free to post their own diagnosis, their own visit and their own opinion of you. So a harsh patient review is not, by itself, a HIPAA violation by anyone.

The same rules do apply to you the moment you reply. A reply is a public disclosure. If it confirms the writer was a patient, mentions a date, a procedure, a diagnosis or a bill, it discloses health information about an identifiable person.

HHS’s Office for Civil Rights has resolved several complaints against dental, psychiatric and other practices that disclosed patient information while answering negative online reviews. Its director has said plainly that providers disclosing patient information in reply to negative reviews is not allowed. The patient having posted the details first does not open the door for you to discuss them.

Note. Never confirm in a reply that the writer was your patient, even to correct a false detail. “We reviewed your chart” is a disclosure.

• It does not say whether the writer was a patient
• It names no date, visit, treatment, condition, test, insurer or bill
• It speaks about the practice’s general standards, not about this person
• It offers a phone number or a contact route, so the conversation moves off the page
• It is short, and it is the only reply

A reply in that shape: “Our practice takes every concern seriously. Privacy law keeps us from discussing anyone’s care in public. If you would like to talk, please call our office manager at the main number.” The same words work whether the review is fair, unfair or written by someone who was never seen.

A review from a real patient about a long wait, a cold manner or a bill breaks no Google policy. These are the reviews at a practice that can:

• Fake engagement: the writer says they were never seen, or writes on a friend’s behalf
• Conflict of interest: a former employee or a competing practice writing as a patient
• Personal information: the review names another patient, a relative’s condition, or a staff member’s full name
• Misinformation: a checkable health claim, such as a false statement about vaccines or sterilization, set against your records
• Harassment: a threat aimed at a named doctor or staff member
• Off topic: a complaint about something the practice does not run, such as a hospital car park

A doctor’s own name in a review is allowed. Google’s policy lets reviews name professionals who practice under their own name. The case has to rest on something else in the text.

Most clauses can be shown from the review’s own words. A writer who says they never came in, a review that names a third person’s condition, a threat against a named nurse: the words on the page are the record. A case sheet quotes those words, cites the clause and explains the reasoning, so nothing from a patient file is needed to make the point.

Where a case needs a record, it is a record about the writer’s link to the practice, such as a staff list for a former employee. The sheet shows the fee class before anything is filed, the fee is per removed review, and a declined case is filed a second time at the same fee.

1. 01

   Do not reply in anger

   Draft the short reply above, or leave the review unanswered for now. Silence discloses nothing.

2. 02

   Read the review against the policies

   Look for the clauses listed above. Mark the exact words that meet one.

3. 03

   Report it if a clause fits

   From your Business Profile, select Read reviews, then the Report icon next to the review, and choose the closest reason.

4. 04

   Check every review at once

   Run the free audit on this site. It labels each low review with a clause, or No rule broken.