Yelp Responses Lead to HIPAA Settlement

A recent settlement between a Texas dental practice and the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) demonstrates that healthcare providers must think twice before sharing any information on social media that can be linked to a patient.

OCR investigated Elite Dental Associates of Dallas after receiving a patient complaint and found that the practice had disclosed protected health information of several patients on a Yelp page in violation of HIPAA. In responding to the patients’ reviews, the practice disclosed their names and details about their health conditions without authorization. Elite also failed to maintain proper policies and procedures to protect the privacy and security of patient information, including a Notice of Privacy Practices, as required by the HIPAA Privacy Rule.

The practice settled with OCR for $10,000 and also agreed to adopt a corrective action plan under which it will continue to be monitored by OCR for two years. The settlement is a reminder that all social media interactions must comply with HIPAA. As explained by OCR Director Roger Severino, “Social media is not the place for providers to discuss a patient’s care.”