PHI on Yelp results in $10,000 OCR settlement

Elite Dental Associates has agreed to pay $10,000 to the Office for Civil Rights (OCR) for allegedly posting protected health information (PHI) on the social networking site Yelp, the U.S. Department of Health and Human Services (HHS) said in a news release.

According to the resolution agreement, an Elite Dental Associates patient filed a complaint with OCR in June 2016, alleging that the dental practice disclosed her PHI in a response to her Yelp review. The patient stated that her last name, details of her treatment plan, and insurance and cost information were included in the post without her permission.

The incident was not an isolated one, according to HHS. While investigating the patient’s complaint, OCR found that Elite Dental Associates “had also impermissibly disclosed PHI of other patients when it responded to those patients’ reviews without valid authorizations.”

OCR’s investigation concluded that Elite Dental Associates not only disclosed PHI without authorization but also failed to implement policies and procedures to protect PHI, including on social media, and failed to have the minimum content required in its Notice of Privacy Practices.

In addition to paying $10,000, Elite Dental Associates has agreed to adopt and comply with a Corrective Action Plan, which includes two years of OCR monitoring to ensure HIPAA compliance.

The incident exposed the perils of social media for covered entities. “Social media is not the place for providers to discuss a patient’s care,” OCR Director Roger Severino said in the news release. “Doctors and dentists must think carefully about patient privacy before responding to online reviews.”