Responding to online patient reviews just cost a dental practice $10,000 after it was accused of disclosing patients' health information in social media posts.
A privately owned dental practice in Dallas agreed to pay the money to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) to settle potential violations of the HIPAA privacy rule, according to an HHS announcement Wednesday.
Elite Dental Associates ran into trouble after a patient filed a complaint with the OCR in June 2016 alleging the practice responded to a social media review posted on Yelp, an online business review forum, by disclosing the patient’s last name and details of her treatment plan, insurance and cost information.
OCR’s investigation found that the dental practice had impermissibly disclosed the protected health information, or PHI, of multiple patients in response to reviews on the Elite page on Yelp.
“Social media is not the place for providers to discuss a patient’s care,” said OCR Director Roger Severino. “Doctors and dentists must think carefully about patient privacy before responding to online reviews.”
In addition to paying the $10,000, the dental practice—which provides general, implant and cosmetic dentistry—agreed to adopt a correction action plan that includes two years of monitoring by OCR for compliance with HIPAA rules.
The OCR investigation found Elite did not have a policy and procedure regarding disclosures of PHI to ensure its social media interactions protect patient information or a Notice of Privacy Practices that complied with the HIPAA privacy rule. OCR accepted a substantially reduced settlement amount in consideration of Elite’s size, financial circumstances and cooperation with OCR’s investigation, HHS said.
HHS posted the resolution agreement (PDF) and corrective action plan on its website.
Experts on social media say whenever doctors or healthcare professionals post on social media sites they need to be aware of HIPAA regulations and protect the confidentiality of patients.
Kevin Pho, M.D., who is also known as “KevinMD” and is the founder and editor of the website that bills itself as “social media’s leading physician voice,” advises doctors to listen to patient criticism. But, he advises, doctors should take conversations that start on social media offline.
Thank the person for his or her comment, he suggests. Don’t respond with anger and don’t violate any HIPAA privacy rules in responding to a review. Instead, try to resolve the issue in person or over the phone. Sometimes patients will take down a negative comment, he says.