In April 2020, OCR received a complaint alleging that Manasa Health Center had violated the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule by responding to a patient’s negative review with information relating to the patient’s diagnosis and mental health treatment. Upon investigation, the OCR discovered that Manasa had also disclosed the protected health information of three additional patients while responding to their negative online reviews. OCR further found that the Center failed to implement adequate HIPAA Privacy policies and procedures.
OCR Director Melanie Fontes Rainer emphasized that disclosing patient information in response to negative reviews on social media or the internet is strictly prohibited under HIPAA Privacy Rule and constitutes a violation of patient trust and the law. She added that the OCR would continue to take action against such impermissible disclosures.
As part of the settlement, Manasa Health Center will implement a corrective action plan to ensure compliance with the HIPAA Privacy Rule. This plan, which the OCR will monitor for two years, includes the development and maintenance of written policies and procedures, workforce training on these policies and procedures, issuing breach notices to all individuals whose protected health information was disclosed without valid authorization, and submitting a breach report to HHS within 30 days of the agreement.
Contact our office today if you’re uncertain about your practice’s privacy policies and procedures, are worried about potential disclosures, and need professional training to avoid mishaps. We can provide the expert guidance and support you need to safeguard your practice, reputation, and, most importantly, your patient’s trust.
