MFG Wellness | Where Healthcare Meets Marketing
A patient posts something unfair on Google. The front desk reads it, the owner reads it, and somebody wants to set the record straight. The facts are on the practice’s side, the review leaves out half the story, and a reply would take ninety seconds.
That ninety seconds has cost practices real money, because the instinct to correct the record runs directly into the HIPAA Privacy Rule.
What OCR actually did about it
In March 2023, a psychiatric practice in Kendall Park, New Jersey signed a resolution agreement with the HHS Office for Civil Rights. The agreement with Manasa Health Center records that OCR’s investigation indicated the practice impermissibly disclosed the protected health information of four patients in responses to their negative reviews on Google Reviews, and that it had not implemented privacy policies and procedures meeting the Privacy Rule’s requirements. The resolution amount was $30,000. The agreement states expressly that it is not an admission of liability.
This was not the first. In October 2019 OCR announced that a dental practice paid $10,000 to settle social media disclosures of patients’ protected health information. A separate settlement with another dental practice over disclosures of patient information followed in December 2022.
Three enforcement actions on one behaviour is a pattern rather than bad luck.
The part that surprises people
Read the Manasa corrective action plan and one obligation stands out. Within 30 days, the practice had to issue breach notices to every individual whose PHI it had disclosed on Google Reviews or any other internet platform without a valid authorization, and report those breaches to HHS through the breach portal.
A reply to a review became a reportable breach.
The corrective action plan also required the practice to revise its Notice of Privacy Practices to describe the uses and disclosures requiring a patient’s authorization, naming posting on the practice’s website, social media pages, and other public platforms as examples. It ran for two years, with policies submitted to HHS for approval and annual reports after that.
The $30,000 was not the expensive part.
Why a reasonable-sounding reply still fails
The trap is that confirming a fact is itself a disclosure. A reviewer may announce publicly that they were a patient. The practice confirming it, even gently, is the covered entity disclosing that a named individual received care there.
Everything that feels natural in a reply tends to make it worse. Mentioning when they came in. Noting what they were treated for. Explaining that they missed appointments. Describing the billing dispute. Saying that the account of the visit is inaccurate, which confirms there was a visit.
Even “we have no record of you as a patient” says something about an identifiable person’s records.
What practices do instead
The approach that holds up avoids the specific entirely. A short, generic response that thanks the reviewer for the feedback, states the practice’s general commitment to patient concerns, and gives a phone number or email for discussing it offline, with no acknowledgment of whether the person is or was a patient.
That reads as bland. Bland is the point. It also moves the conversation to a channel where the practice can speak freely once identity is verified.
Several practices go further and prepare the wording in advance, so that nothing gets drafted at the moment someone is annoyed. The Manasa corrective action plan points the same direction, requiring written policies and workforce training on permissible disclosures.
Staff matter here more than policy documents. A front desk employee with access to the Google Business Profile can create the exposure in a minute.
Reviews still matter for being found
None of this argues for ignoring reviews. Ratings and listings carry weight in how patients and search engines assess a practice, which we covered in why provider data accuracy became a growth problem.
The route that stays clear is asking satisfied patients to leave reviews in the first place, which is permitted and changes the average far more reliably than arguing with one unhappy person. What a practice may ask, and how, is worth confirming with your compliance officer, since review solicitation touches both HIPAA and FTC endorsement rules.
The same caution applies to anything else the practice publishes about patients. The limits on what a website may collect and transmit are covered in HIPAA website tracking rules for practices in 2026.
Frequently Asked Questions About Reviews and Patient Privacy
Can a practice respond to a negative review at all?
Yes, in general terms. The enforcement actions concern disclosing patient information, not responding. A reply that thanks the reviewer, states a general commitment, and offers an offline channel avoids disclosing anything about an identifiable individual.
Does it matter that the patient posted publicly first?
A patient may disclose their own information freely. That does not authorize the covered entity to disclose it. The Manasa agreement records disclosures in responses to reviews the patients themselves had posted.
What if the review is factually wrong?
Correcting it publicly generally requires referring to the care, which is the disclosure. The usual approach is to invite the reviewer to discuss it directly, and to raise genuinely fraudulent or policy-violating reviews with the platform.
Can we ask patients for reviews?
Asking is generally permitted, and the request itself should not reveal anything about a person’s care to anyone else. How and when to ask touches HIPAA and FTC endorsement rules, so confirm the approach with your compliance officer.
Who at the practice should be allowed to reply?
Whoever has access can create the exposure. The Manasa corrective action plan required written policies and workforce training on permissible disclosures. Limiting access and preparing approved wording in advance both reduce the risk.
Does this apply to social media too?
The 2019 dental settlement concerned social media disclosures, and the Manasa corrective action plan covered Google Reviews and any other internet platform. The platform does not change the analysis.
MFG Wellness: Reputation Work That Does Not Create a Disclosure
MFG Wellness works exclusively with healthcare providers, from York, Pennsylvania. Review strategy is where marketing advice and privacy obligations collide most often, and it is one of the few areas where a well-meant reply can become a reportable event.
How we work on it:
- Medical Public Relations: Response frameworks drafted before anyone is annoyed, access limited to people who know the rules, and attention moved toward earning good reviews rather than arguing with bad ones
- Healthcare SEO: Ratings and listings feed how patients and search engines read a practice, so we treat review volume and listing accuracy as the same piece of work
Want your review responses looked at before the next one arrives? Request a quote and we will read what is already posted under your name.
Works Cited
United States, Department of Health and Human Services, Office for Civil Rights. “Manasa Health Center LLC Resolution Agreement and Corrective Action Plan.” HHS.gov, 5 June 2023, www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/manasa-ra-cap/index.html.
United States, Department of Health and Human Services, Office for Civil Rights. “Dental Practice Pays $10,000 to Settle Social Media Disclosures of Patients’ Protected Health Information.” HHS.gov, 2 Oct. 2019, www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/elite/index.html.
United States, Department of Health and Human Services, Office for Civil Rights. “Resolution Agreements.” HHS.gov, reviewed 1 Oct. 2026, www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html.
Disclaimer
MFG Wellness is a healthcare digital marketing agency in York, Pennsylvania. We are not a law firm and do not provide legal or compliance services.
This article describes published federal enforcement records and guidance as they stand at the time of writing. We did not conduct any investigation or generate any of these findings, and we offer no opinion on any party’s conduct. The resolution agreements cited state that they are not admissions of liability. Current as of 31 August 2026.
This article is general information and is not legal or compliance advice. Healthcare regulations change and apply differently depending on your arrangement. Confirm current requirements with your compliance officer or counsel.
