HHS Office of Civil Rights Reaches Settlement with New Jersey Health Care Provider Who Disclosed PHI in Response to Negative Online Reviews

New Jersey Psychiatric Practice Pays $30,000 to Resolve Complaint About Inadmissible Disclosure of Protected Health Information by Disclosing This Information in Online Review

Today, the United States Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced an agreement with Manasa Health Center, LLC, a health care provider in New Jersey that provides psychiatric services for adults and children. Settlement resolves a complaint OCR received in April 2020 alleging that Manasa Health Center inadmissiblely disclosed a patient’s PHI when the entity posted a response to the patient’s negative online review . As a result of an OCR investigation, potential violations of the Health Insurance Portability and Accountability Act (HIPAA) privacy rule include impermissible disclosures of patient PHI in response to negative online reviews and failure to implement policies and procedures related to protected health information. Manasa Health Center paid $30,000 to OCR and agreed to implement a corrective action plan to resolve these potential violations.

OCR continues to receive complaints about healthcare professionals disclosing PHI about their patients on social media or the internet in response to negative reviews. Simply put, this is not allowed, said OCR director Melanie Fontes Rainer. The HIPAA privacy rule explicitly protects patients from this type of activity, which is a clear violation of both patient trust and the law. OCR will investigate and take action upon becoming aware of such inadmissible disclosures, no matter how large or small the organization.

OCR opened an investigation in response to a patient complaint alleging that Manasa Health Center had posted a response to the patient’s negative online review that included specific information regarding the individual diagnosis and treatment of his or her condition. mental health. In addition to the patient who filed the complaint, OCR’s investigation found that Manasa Health Center impermissibly disclosed the PHI of three other patients in response to their negative online reviews. The OCR investigation also found that Manasa Health Center failed to implement HIPAA privacy policies and procedures.

In addition to the monetary settlement, Manasa Health Center will be undertaking a corrective action plan that will be monitored for two years by the OCR to ensure compliance with the HIPAA privacy regulation. The corrective action plan includes the following steps:

• Develop, maintain and review its written policies and procedures to comply with the HIPAA privacy regulation,
• Educate all members of the Manasa Health Center workforce, including owners and managers, on the organization’s policies and procedures for complying with HIPAA privacy and security regulations,
• Within 30 calendar days of the agreement, Manasa Health Center will issue infringement notices to all individuals, or their personal representatives, whose PHI is disclosed on any Internet platform without valid authorization, and
• Within 30 calendar days of the agreement, Manasa Health Center will file a violation report with HHS regarding individuals whose PHI is disclosed on any Internet platform without valid authorization.

The termination agreement and corrective action plan can be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/manasa-ra-cap/index.html

OCR is committed to enforcing HIPAA rules that protect the privacy and security of people’s health information. If you believe that your or another person’s health information privacy or civil rights have been violated, you may file a complaint with OCR at: https://www.hhs.gov/ocr/complaints/index.html .