It happens to all of us: You log onto the Internet one day and discover a scathing review from a disgruntled patient or family member, usually complaining about something totally irrelevant to the excellent care they received.
Urupong/Getty Images
Your first impulse may be to post a response, but wait – it turns out that “protected health information” is more liberally defined than most of us think. If you include any information that could be used to identify the patient, you can be considered in violation of HIPAA. This is true even if the patient has already disclosed information, because doing so does not nullify their HIPAA rights; and HIPAA provides no exceptions for responses. Even acknowledging that the reviewer was in fact your patient could, in some cases, be considered a violation.
In 2013, a California hospital paid $275,000 to settle claims that it violated HIPAA when it disclosed a patient’s health information in response to a negative review. And the Department of Health & Human Services, which enforces HIPAA, has sent warning letters to a variety of physicians and dentists who divulged patient information while responding to reviews. (An HHS spokesperson couldn’t tell me how many such warnings have been issued, because they “don’t track complaints that way.”)
All of that said, :
- Ignore them. This is your best choice 90% of the time. Most negative reviews have minimal impact and simply do not deserve a response, and responding may simply pour fuel on the fire. Besides, an occasional negative review actually lends credibility to a reviewing site, and to the positive reviews posted on that site. Polls show that readers are suspicious of sites that contain only rave reviews. They assume such reviews have been “whitewashed” – or just fabricated. If your total number of reviews on that site is too small – for example, there are only 4, and 2 are bad – you have what I call a denominator problem. The solution in those cases is to increase the denominator – that is, increase the total number of reviews. The more you can obtain, the less impact the complaints will have, since you know the overwhelming majority of your patients are happy with your care and will post a positive review if asked. Solicit them on your website, on social media, in your e-mail reminders, or simply leave a stack of requests at your check-out desk and tell your receptionist to hand them out. To be clear, you must encourage all reviews, good or bad, not just favorable ones; if you specify that all reviews must be favorable, you are “filtering,” which can be perceived as false or deceptive advertising.
- Respond generically. In those rare cases where you feel you must respond, do so without acknowledging that the individual was a patient, or disclosing any information that may be linked to the patient. For example, you can say that you provide excellent and appropriate care, or describe your general policies, or direct readers to positive reviews without referencing any individual cases. You might point out that HIPAA prevents you from disclosing information in response. Be polite, professional, and sensitive to the patient’s position. Readers tend to respect and sympathize with a doctor who responds in a professional, respectful manner and does not trash the complainant in retaliation.
- Take the discussion offline. Sometimes the person posting the review is just frustrated and wants to be heard. In those cases, consider contacting the patient and offering to discuss their concerns privately. In select situations, this has been very effective for me; in one case, the patient not only removed the negative post, but also became a loyal supporter. If you cannot resolve your differences, try to get the patient’s written permission to post a response to their review. If they refuse, you can at least explain that on the site, thereby capturing the moral high ground.