Think Before You Yelp: Responding to Online Reviews May Result in a HIPAA Violation
Many patients turn to crowdsourced online review websites such as Healthgrades, Yelp, and Vitals to research and choose their dentists. While such websites can positively boost a dental practice’s online presence, they also pose a serious public relations risk as these sites allow users to instantly circulate their opinions—whether good or bad—to the general public. Poor reviews can be used as constructive feedback to improve the practice; however, inflammatory public statements can also turn off potential patients and send new business elsewhere.
In light of the potentially damaging impact associated with negative reviews, many dentists understandably feel the need to respond to such reviews in order to voice their side of the story. Posting a respectful response to disgruntled online reviews may be generally advisable from a purely marketing standpoint and may often times seem like the appropriate course of action in a service-based industry; however, dentists must be aware that their response could violate the privacy regulations set forth in the Health Insurance Portability and Accountability Act (“HIPAA”).
As every dentist is probably aware, HIPAA generally prohibits a dentist from disclosing any personal information about his or her patients to third parties. In addition to restricting a dentist’s ability to disclose any treatment-related information, HIPAA also generally precludes dentists from even acknowledging that a certain individual is a patient of their practice in most situations. These privacy rules apply, aside from a few specific exceptions, unless the patient expressly consents to the disclosure of their personal information. This is the case even if the patient has chosen to disclose private information in their review, as the patient’s decision to post such information does not in any way constitute a waiver of their privacy rights or otherwise grant a dentist the right to disclose, comment on, or reference their personal information, regardless of whether the patient has already done so. Responding to patient reviews or comments may very well be illegal under HIPAA (and other applicable state privacy laws) and, as such, dentists should contact their attorney should they have any questions regarding responses to patient reviews. In addition, dentists should consider the following strategies in connection with the management of their online reputation:
1) Respond to the patient privately. Assuming the identity of the patient is obvious (see #4 below), consider privately contacting the patient directly to acknowledge the negative review and ask what can be done to rectify the situation. As upsetting as a bad review may be, dentists should discuss the review calmly and civilly with the patient. You will never appease every person but addressing the issue may encourage the patient to adjust their original comment to reflect any resolution the dentist and patient are able to reach.
2) If you choose to reply, respond in a general way without acknowledging that the reviewer was a patient and without mentioning specific information about the patient. For example, if a reviewer writes, “I had to wait two hours to be seen by the dentist,” the safest response may be, “When scheduling patients, our policy is to adjust the time with the dentist as necessary for that patient’s particular needs. As a result of emergency situations, it is possible that we fall behind schedule from time to time.”
3) Keep responses short and polite. A lengthy response may appear defensive to potential patients and could lead them to take their business elsewhere. Always err on the side of saying too little rather than too much.
4) Be wary of anonymous reviews. The ability for reviewers to post anonymously can make it difficult, if not impossible, to respond. If the identity of the reviewer cannot be determined with absolute certainty, it is best not to respond at all because you risk responding to the wrong patient. Not only would this be potentially embarrassing but doing so opens the door to the disclosure of information about another patient.