If you own a restaurant or a store and someone savages your business on Yelp, you fight back.

But if you're a doctor or health care provider you'd better think twice because a HIPAA violation could be just a keystroke away.

A new investigative report from the public interest group Pro Publica and The Washington Post has found that many responses are filled with “details of patients' diagnoses, treatments and idiosyncrasies.”

This is definitely not the way to address your ratings problem, if you have one.

First of all, never get into specifics. “If the complaint is about poor patient care, they can come back and say, ‘I provide all of my patients with good patient care’, and ‘I’ve been reviewed in other contexts and have good reviews,’” Deven McGraw, deputy director of health information privacy at the Office for Civil Rights within the U.S. Department of Health and Human Services, which enforces HIPAA, told Pro Publica. But be warned, he stated, you can't “take those accusations on individually by the patient.”

In fact, crossing that line can prove costly. McGraw pointed to the 2013 case of Shasta Regional Medical Center (SRMC) in California, in which a pair of its senior leaders had met with media to talk about care given to a patient. In a statement about the case at the time, HHS explained: “When senior level executives intentionally and repeatedly violate HIPAA by disclosing identifiable patient information, OCR will respond quickly and decisively to stop such behavior,” said OCR Director Leon Rodriguez in a news release at the time.

Beyond getting hit with a $275,000 settlement, Shasta had to update its policy and procedures, as did 15 other hospitals and medical centers owned or operated by the same company as SRMC.

Many patient comments, however, do not cross over into HIPAA territory and can be responded to, albeit, still with some care. These typically focus on non-health care concerns, such as might relate to any business, like waiting times, staff attitudes and billing or bedside manner.

While some have gotten into HIPAA troubles, many doctors and institutions find a way to respond to negative care comments in a safe way, advised Yelp’s senior director of litigation, Aaron Schur.

“There’s certainly ways to respond to reviews that don’t implicate HIPAA,” Schur said.

One of the best approaches, followed by many, he noted, is simply to respond on Yelp, or other similar review sites, with an offer to discuss the matter privately offline via telephone or in person.

Jeffrey Segal was so opposed to Yelp-like sites that his Medical Justice company once even devised contracts for health care providers to force patients to give up the copyright of their comments to providers — but it didn't hold up and is no longer recommended.

He has changed his mind about such patient comments and now feels that the issue is about managing and marketing. “For doctors who get bent out of shape to get rid of negative reviews, it’s a denominator problem,” he explained to Pro Publica. “If they only have three reviews and two are negative, the denominator is the problem. … If you can figure out a way to cultivate reviews from hundreds of patients rather than a few patients, the problem is solved.”

Business Affairs Homepage