A New Jersey-based health care provider has reached a $30,000 settlement with the Office for Civil Rights of the U.S. Department of Health and Human for disclosing patient information while responding to a negative review online.
The issue settles a complaint that Manasa Health Center LLC, which provides psychiatric treatments for adults and children, responded to a patient’s unfavorable online review by disclosing the patient’s medical information in April of 2020, according to a June 5 news release.
“OCR continues to receive complaints about health care providers disclosing their patients’ protected health information on social media or on the internet in response to negative reviews,” OCR Director Melanie Fontes Rainer said in the release. “Simply put, this is not allowed. The HIPAA Privacy Rule expressly protects patients from this type of activity, which is a clear violation of both patient trust and the law. OCR will investigate and take action when we learn of such impermissible disclosures, no matter how large or small the organization.”
OCR found that failing to implement policies and procedures with regard to protected health information and improper disclosure of patient protected health information in response to unfavorable online reviews are both potential violations of the Health Insurance Portability and Accountability Act Privacy Rule, the release reported.
OCR examined the patient’s complaint and found Manasa Health Center provided health information related to the reviewer's diagnosis and treatment of their mental health problem, according to the release. During the investigation, OCR found the health center also violated HIPAA with three other patients.
As a result of the settlement, OCR will monitor Manasa Health Center for compliance of the HIPAA Privacy Rule for two years, along with the development of a plan to make sure such actions are never violated again, the release said.
For Manasa Health Center to comply with the HIPAA policy, they must train owners, managers and employees on the company's policies and practices relating to the issue, the release reported. Anyone who is found to violate HIPAA policy online without consent will be notified of their violation by Manasa Health Center.
