Elite Dental Associates, Dallas (Elite Dental) and the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) entered into a $10,000 no-fault settlement agreement and two year corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA).

Elite Dental is a privately owned dental practice located in Dallas, Texas. HHS-OCR received a complaint from an Elite Dental patient on June 5, 2016, alleging that Elite Dental responded to the patient’s Yelp review regarding Elite Dental by disclosing the patient’s name, details of the patient’s treatment plan, insurance, and cost information. HHS-OCR’s investigation into the incident revealed that Elite Dental impermissibly disclosed the complainant-patient’s protected health information (PHI) as well as other patients’ PHI who also published reviews on Elite Dental’s Yelp webpage. HHS-OCR’s investigation further indicated that Elite Dental failed to implement policies and procedures with respect to PHI. As a reminder, the HIPAA Privacy Rule prohibits covered entities from disclosing PHI without a valid patient authorization, subject to limited exceptions. Elite Dental must develop written policies and procedures to comply with HIPAA as part of its two year corrective action plan with HHS-OCR.