The Health Insurance Portability and Accountability Act (HIPAA) is designed to protect the privacy and security of patients' personal health information (PHI), and violating this regulation, intentionally or unintentionally, can lead to severe penalties.

When replying to online reviews, you must remain compliant with HIPAA.

In reality, a patient can leave you a scathing negative online review on your doctor or location Google Business Profile, disclose all of their own PHI in that negative review, and what you can do in response is limited by HIPAA. It might sound unfair, however, until HIPAA is updated, it's important you remain compliant and follow the best practices.

We are not attorneys, so please do not take this as legal advice. These are some of our best practices when responding to online reviews.

Best Practices to Remain HIPAA Compliant When Responding to Online Reviews

Never acknowledge a reviewer as a patient: One of the most common ways healthcare practices inadvertently violate HIPAA is by acknowledging that a reviewer is, in fact, a patient. Even if a patient publicly leaves a review discussing their medical treatment, the healthcare provider is still prohibited from confirming that individual's status as a patient.

Avoid discussing any medical information: Even if a patient leaves a detailed review about their medical history, treatment, or recovery, healthcare providers are not permitted to include any specific medical information in their responses. This includes treatment dates, medical conditions, prescriptions, or procedures.

Move the conversation offline: While you want to share your side of the patient's encounter, particularly when the patient has left a negative online review, it's important you invite patients to contact your office directly via phone or email if they have concerns or complaints. This keeps sensitive information out of public forums and makes it private. Our online review reply templates make this easy for you to handle and manage while staying compliant with HIPAA in your online review replies.

Train staff responsible for online reviews: Ensure that your staff is trained on how to manage online reviews in a HIPAA-compliant manner. Make sure everyone understands the importance of not disclosing patient information.

Use HIPAA-compliant reply templates: Download our Online Review Response Framework found on the Free Tools page for a quick and easy guide when responding to online reviews.

Examples of HIPAA Compliance in Online Review Responses

Below are examples demonstrating how a well-meaning response can easily breach HIPAA if it discloses certain patient information:

"I had a terrible experience with this office! I waited for over an hour, and no one updated me on what was going on. When I finally saw the doctor, the visit felt rushed and impersonal."

Non-HIPAA-compliant response: “We apologize for the long wait time. Please give us a chance to improve and let us know how we can help.”

Rewritten HIPAA-compliant response: “We sincerely appreciate your feedback and understand how frustrating delays can be. We always aim to provide timely and attentive care, but sometimes emergencies cause unexpected delays. Due to privacy regulations, we can't discuss specific details in an online review. Please feel free to reach out to our office manager, Sarah, at [email address], so we can further address your concerns and help.”

---

"I had a great visit with Dr. Sam! She took the time to explain everything and made me feel comfortable during my check-up."

Non-HIPAA-compliant response: “Thank you! We’re happy Dr. Sam was able to help with your check-up and ensure you were comfortable during your visit.”

Rewritten HIPAA-compliant response: “Thank you for sharing your experience! We’re thrilled to hear that you felt comfortable and well cared for. Your feedback helps us continue improving our services for all patients.”

---

"The staff at this clinic wasn’t clear about how I should take my medication, and I had to call back twice for clarification. It caused me a lot of stress."

Non-HIPAA-compliant response: “We’re sorry that you didn’t feel our instructions were clear enough. We would have been happy to explain them further if you asked during your visit.”

Rewritten HIPAA-compliant response: “We always aim to provide clear and detailed instructions to all patients. We’re sorry if there was any confusion, and we appreciate your feedback. Due to privacy regulations, we can’t discuss specific details here, but please contact us directly if you have any further concerns.”

Consequences of HIPAA Violations

To comply with HIPAA in the context of online reviews can result in hefty fines and damage to the practice’s reputation. The penalties for HIPAA violations range from $100 to $50,000 per violation, depending on the severity of the breach, with an annual maximum fine of $1.5 million. In addition to financial penalties, a violation also has negative consequences regarding patient trust and retention.

Conclusion

Managing online reviews is an important aspect of building a healthcare practice’s reputation, but it must be done in a way that respects patient privacy and complies with HIPAA regulations. Staying on top of HIPAA regulations and ensuring that all interactions, even in online reviews, respect patient privacy is critical to building trust, maintaining compliance, and avoiding costly fines.