Online Healthcare Reviews and HIPAA

Ever since the University of Utah Health system paved the way with online physician reviews several years ago, more hospitals and health systems have seen the value of such a transparency effort and have initiated their own online reviews. Even if organizations do not offer reviews on their own sites, there are other options for online reviews. While other industries have been using online reviews for quite some time, such reviews are an entirely different matter in healthcare—due to HIPAA.

So how does a healthcare organization better serve its patients with online reviews while also adhering to HIPAA requirements?

• Active reputation management is vital. Even if you aren’t currently using your own online reviews, people are still reviewing your organization elsewhere—social media, Healthgrades, Yelp and many others—so you should already be using a reputation management tool to look for negative reviews. If you don’t currently employ such a tool, look into it soon. The sooner you are aware of negative reviews and can address them appropriately, the better.
• Encourage sharing of positive patient experiences. Whenever you are told of a positive patient experience, ask the person if he/she would be willing to share the experience online. They can do so anonymously. Such requests can be done programmatically with the Get Five Stars tool.
• Handle negative reviews appropriately. You cannot acknowledge publicly that the complainant is/was a patient, nor can you give out any details of a specific incident publicly without violating HIPAA regulations.
  • If a negative review is posted, your initial response to the complainant should be via a private mode. Any public response should be something on the order of “Please contact us at [insert contact info] so that we can get more details about this.”
  • Carefully review the negative post to determine the poster’s intention.
    • Is the review of a mildly negative nature, with no real frustration or upset indicated?
    • Is the reviewer expressing real frustration or upset, but not threatening any action?
    • Is the reviewer angry and threatening legal action?

    In the first two instances, consider reaching out to the reviewer offline. However, it is best to avoid the third type without legal advice.

  • Investigate the incident internally. Talk with the staff members who were involved in the patient’s care. Review the medical record. Gather all the facts to determine what actually happened.
  • If the negative review was posted on an outside site, ask to have the negative review removed, especially if:
    • The reviewer was not the person involved but posted on behalf of someone else.
    • The reviewer did not use your services but is posting based on something else.
    • There were personal attacks on the staff, with derogatory or defamatory language or other personal attacks.
  • If you are able or willing to try to remedy the issue, reach out to the person offline.
  • If at all possible, have the physician involved reach out to the patient. This indicates that you are taking the person’s feedback seriously. Listen to what the person has to say.