HIPAA and review replies.In plain English.

The HIPAA Privacy Rule says a covered provider may not use or disclose protected health information except as the rule permits or requires. HHS has cited that rule when practices disclosed patients' information in replies to reviews.

HHS's Office for Civil Rights has settled with practices over this. A New Jersey provider paid $30,000 in 2023 after disclosing four patients' information in replies to their negative Google reviews. A California dental practice paid $23,000 after Yelp replies gave patients' full names where they had posted under nicknames, with details about their visits and insurance.

These were resolution agreements, which HHS describes as settlement agreements, and each came with a corrective action plan, including written policies.

A safe reply thanks the reviewer and invites them to call, without any detail about their care. Don't use a name, a visit detail or insurance information, even if the reviewer mentioned it first, and don't confirm or deny that they are a patient.

A safe reply: 'Thank you for your feedback. Please call our office manager so we can talk privately.'