HIPAA Violation in Google Response Review

[aladd2010]

Jurisdiction

Georgia

Hello! I've been contacting lawyers for a week trying to get advice on the following, to no avail. Hoping somebody can point me in the right direction.

I took my daughter to visit a doctor and left him an honest review on Google. He responded clearly upset with private details of her appointment, describing the care she received in full, including her labs, treatment offered and whether we refused or accepted it and why, mentioning her pre-existing condition.

Is this a felony HIPAA violation as he responded to demean my review of him for his own personal gain and commercial advantage? And if so, what can I do about it?

 

[welkin]

Is there anything in your review or the Dr.'s response that identifies your daughter? If the Dr. was presenting a case study (with no name), then I don't see any violation.

 

[Zigner]

Is this a felony HIPAA violation as he responded to demean my review of him for his own personal gain and commercial advantage? And if so, what can I do about it?

HIPAA is not a criminal law. You can report the alleged violation, but you won't get anything out of it based on HIPAA.

 

[Tax Counsel]

Is this a felony HIPAA violation as he responded to demean my review of him for his own personal gain and commercial advantage? And if so, what can I do about it?

It is very likely a HIPAA violation, assuming the doctor and/or his practice is a "covered entity" under the Act (and nearly all doctors are) but the only remedy for a HIPAA violation is to make a complaint about it to the U.S. Department of Health and Human Services (HHS) because the law only provides for HHS to enforce it. As you'll find on the enforcement page, the only penalties the doctor faces are civil penalties, like a civil fine. HIPAA is not a criminal statute and the doctor did not commit a crime under federal law with the disclosure. See the HHS page on Filing a HIPAA Complaint for information on how to pursue a complaint so that at least the doctor may end up having to cough up a significant fine for it, and perhaps be subject to some period of close oversight by HHS to ensure no future violations.

You may also file a complaint with the Georgia Composite Medical Board, which is the agency that licenses and regulates medical professionals in the state.

I also suggest that you ask Google to remove the doctor's response for privacy reasons, though if Google does that it might also remove your comments about the doctor as well. Either way, the more important thing is getting the private information off the review site. Your review of the doctor is only a secondary issue.

Georgia may have a law that allows you to sue for money damages for the unauthorized disclosures. I suggest you see a GA civil litigation attorney to find out if state law allows for that. Note that to win any money in most lawsuits you have to establish the amount of money that you lost or had to spend as a result of the wrongful act of the defendant. So even if there is a potential remedy, if you didn't suffer any financial harm, there might not be anything to get from it. If the state law allows statutory damages and recovery of attorneys fees, though, then that may make it worthwhile to sue even if you don't have any financial damages. That's something to discuss with the lawyer you consult.

 

[army judge]

Is this a felony HIPAA violation as he responded to demean my review of him for his own personal gain and commercial advantage?

Whatever the conduct MIGHT be can only be determined IF the local prosecutor (perhaps federal attorney) deems the conduct to be criminal.

Whatever you deem the conduct to be is merely your opinion.

And if so, what can I do about it?

A private citizen is often powerless to do anything when it comes the "purported" conduct of others. However, you can always visit your local, elected prosecutor. You could also lodge a complaint with your state's medical licensing agency.

Most people would PROBABLY let it go, move on, forget it. Real life is so much more satisfying and enjoyable than any UNSOCIAL MEDIA activity!

 

[welkin]

I took my daughter to visit a doctor and left him an honest review on Google.

Why did you feel the need to leave a review on Google? And, if your review was negative, did you not expect the Dr. to respond? If you posted any of your daughter's PHI in the review, then you are the one who opened the door.

Is there anything in your review or the Dr.'s response that identifies your daughter? If the Dr. was presenting a case study (with no name), then I don't see any violation.

Still no answer to the question.

I don't understand why persons find a need to air their laundry on the Internet for the world to see and then claim their privacy has somehow been compromised.

 

[Zigner]

I would like to give kudos to the OP for using the correct acronym.

 

[aladd2010]

It is very likely a HIPAA violation, assuming the doctor and/or his practice is a "covered entity" under the Act (and nearly all doctors are) but the only remedy for a HIPAA violation is to make a complaint about it to the U.S. Department of Health and Human Services (HHS) because the law only provides for HHS to enforce it. As you'll find on the enforcement page, the only penalties the doctor faces are civil penalties, like a civil fine. HIPAA is not a criminal statute and the doctor did not commit a crime under federal law with the disclosure. See the HHS page on Filing a HIPAA Complaint for information on how to pursue a complaint so that at least the doctor may end up having to cough up a significant fine for it, and perhaps be subject to some period of close oversight by HHS to ensure no future violations.

You may also file a complaint with the Georgia Composite Medical Board, which is the agency that licenses and regulates medical professionals in the state.

I also suggest that you ask Google to remove the doctor's response for privacy reasons, though if Google does that it might also remove your comments about the doctor as well. Either way, the more important thing is getting the private information off the review site. Your review of the doctor is only a secondary issue.

Georgia may have a law that allows you to sue for money damages for the unauthorized disclosures. I suggest you see a GA civil litigation attorney to find out if state law allows for that. Note that to win any money in most lawsuits you have to establish the amount of money that you lost or had to spend as a result of the wrongful act of the defendant. So even if there is a potential remedy, if you didn't suffer any financial harm, there might not be anything to get from it. If the state law allows statutory damages and recovery of attorneys fees, though, then that may make it worthwhile to sue even if you don't have any financial damages. That's something to discuss with the lawyer you consult.

Thank you for this helpful response!

 

[aladd2010]

Why did you feel the need to leave a review on Google? And, if your review was negative, did you not expect the Dr. to respond? If you posted any of your daughter's PHI in the review, then you are the one who opened the door.


Still no answer to the question.

I don't understand why persons find a need to air their laundry on the Internet for the world to see and then claim their privacy has somehow been compromised.

Not everyone has time to monitor a forum. And not every answer provided warrants a response, especially if they aren't helpful.

 

[welkin]

Not everyone has time to monitor a forum. And not every answer provided warrants a response, especially if they aren't helpful.

When you don't fill in the details of what and why you did what you did, then all you can get from a forum is speculation. If there is no way to identify you or your daughter on a review website, there can be no violations for a Dr. to post a case study of an anonymous person.

Well, you answered the post but not still did not answer any questions. So, you had the time. Right?

We see this all the time on the forum. When a poster doesn't hear what they want to hear, we are not helpful.