The allegation was shocking and, if true, would devastate the orthopedic surgeon’s reputation.
An online commenter accused him of operating on the wrong arm or leg. But the “very upset” surgeon was puzzled: there was no such patient in his records. Instead of clapping back, he hired a law firm. After some digging, the poster accusing the surgeon of malpractice was revealed to be none other than a medical equipment vendor whose business relationship he had terminated.
“We actually went through a number of steps, both using some computer forensic techniques and the subpoena powers of the court” to identify the commenter, recalled Marc Kallish, a shareholder in the Chicago office of Roetzel & Andress. “This was retaliation against a doctor. We sued…for slander. If you are a doctor and you have somebody that is abusing the privilege of [using a website] to post repetitively and maliciously…there are things that you can do…you don’t have to just take it.”
The vendor ultimately agreed to a financial settlement that included paying the surgeon’s attorneys’ fees and removing the offending comments, Kallish said. The case demonstrates the appropriate steps a doctor or other HIPAA covered entity or business associate can use to address negative comments online that may appear on the plethora of websites that review providers—including dentists—and health systems.
If they respond to such barbs the wrong way—by challenging comments while revealing protected health information (PHI) to make their argument—providers risk costly enforcement action from the HHS Office for Civil Rights (OCR). That’s exactly what happened to Nidagalle Gowda, M.D., a New Jersey psychiatrist who agreed to pay OCR $30,000 and implement a two-year corrective action plan . OCR announced the settlement in June following an investigation into comments the agency said he made to four patients online that disclosed their mental health diagnoses and treatment.
The settlement was one of three the agency made public that month. Another was for $75,000 with iHealth Solutions, “a Kentucky-based business associate that provides coding, billing, and onsite information technology services to health care providers.” According to OCR, “a network server containing the protected health information of 267 individuals was left unsecured on the internet.”[1]
The July issue of RPP explored OCR’s $240,000 settlement with MultiCare Yakima Memorial Hospital resolving allegations that in 2017, 23 security guards snooped on approximately 400 patients’ information through the electronic health records system.[2]
Kallish was one of three Roetzel attorneys who provided strategies and recommendations to address online comments. He was joined by Erika Adler, also a shareholder and the firm’s health care practice group manager and attorney Julia Mohan, who has since left Roetzel and is now senior counsel for Epsilon Digital Media Services.[3]
When someone is insulted, it’s human nature to want to strike back—particularly if the slings and arrows strike at professional skills and threaten one’s livelihood. And, with easy access to internet review sites, negative comments can appear almost instantaneously and “live” online nearly forever.
But the target of the comments should not respond emotionally.
“Even though these comments can warrant an emotional reaction, [do] not react, maintain that professionalism and call another professional—your lawyer—to see if you can deal with this outside of the realm of the public space,” said Mohan.
“You can identify who these people are, seek redress through the websites and through the court system,” Kallish added, particularly if “people are being malicious and hurting your practice or your peace of mind.”
“When it comes down to it, doctors do have a couple of different options,” Adler pointed out.
First, ask, “Does this really matter if you've got 5,000 five-star reviews” and one one-star? Providers also need to consider whether to invest the “time, effort, and money into fighting about this,” she said. “And that’s a really important decision because this can be an expensive process, and the outcome can be uncertain.”
In fact, Kallish estimated it could cost “tens of thousands of dollars…to identify these people, to subpoena the various internet providers and the websites, and then file lawsuits and get people served and then commence a lawsuit.”
Solicit Positive Reviews?
One way to prevent these problems is to consider turning off comments when that option is available—such as on the practice’s website. This is not something that can be done with sites such as Yelp or Healthgrades, however.
But when there are bad reviews or comments, the first step is to determine if a response is warranted at all. Is the comment an opinion, or is it provably false and defamatory and could result in damages awarded in court? Or does the provider just want the comments removed as quickly as possible?
To counter negative comments, Adler suggested a provider could simply “invite patients who are happy with your services to post positive reviews.”
In addition to announcing several enforcement cases against providers related to their responses to reviews, OCR officials also have addressed proper ways to react that don’t violate HIPAA or require attorney involvement.
In 2019, Serena Mosley-Day—then senior advisor for HIPAA compliance and enforcement—recommended following a strategy used by restaurants, which responded, “We’re so sorry that you didn’t have the experience that you expected when you visited our restaurant on your anniversary. If you’d like to contact our manager, we’d love to have you in to try and make it right.”[4]
She noted that a rude response also turns off other patients, but an offer to “call our office to resolve” the issue or a statement that “We’ve reached out to you privately; we’d love to discuss your concerns” will garner patient trust and not violate privacy.
Defamation Vs. Opinion
Noted Kallish: “You really need to evaluate what your goal is. The majority of people that are making these posts are not financially capable of giving you any kind of compensation.”
Consider what the commenter is saying. Generally, no legal action can be brought if the statements are truthful—or simply opinion, the attorneys said.
It’s not defamation “if you’re saying something like, ‘The doctor has a bad bedside manner,’ or ‘The doctor made me wait in the waiting room too long’…those are very different than saying, ‘The doctor killed my mother. The doctor did surgery on the wrong body part; the doctor failed to diagnose me,’” Adler explained. “Stating something that’s false is really the line between where the doctor can take some action or not.”
As in the case Kallish described, the statements were false and thus actionable under defamation law, he said.
What the vendor posing as a patient wrote was “completely malicious,” Kallish added. Because the vendor’s company had the ability to pay, a settlement was possible. But this isn’t always the case, the attorneys pointed out.
They also recommended against any public response. The provider or other individual’s “first inclination is always to respond back and say, ‘That’s not true,’ or ‘That’s not how it happened.’ And of course, from a health care perspective, we don’t want doctors responding online to anything because acknowledging somebody’s your patient can present HIPAA issues,” warned Adler.
Public responses also can grow into a “battle of words online, and we don’t want that,” Mohan said.
Several Subpoenas May Be Necessary
Another step is to identify the commenter—sometimes people use their real names, but not always, and there can be a “multistep process in order to ascertain who is actually doing the posting,” as there was in the vendor case, said Mohan.
“The first thing that we would do is issue a subpoena to the website where you can see the post, and that website should be able to identify the IP [internet protocol] address of the poster,” she said. “The second step then would be to issue a subpoena to an internet service provider [ISP] associated with that IP address. So, you’re actually doing two subpoenas.”
Mohan noted that speed is of the essence in many cases.
“One thing, though, to keep in mind is you sort of have to act fast,” Mohan explained. “The internet service providers, your Comcast, your Sprint, often give what’s called a dynamic IP address to a device. So, my phone could have an IP address associated with it for a week, a number of days, and then it would have a new one. The ISPs often only keep their records now for about 90 days or 120 days because they’re constantly changing these IP addresses. In order to get that subscriber information, you really have to act fast in issuing these subpoenas to get the information you need and find out who made the post.”
Once the poster has been identified, there are several options.
“A strongly worded letter from a lawyer is often effective,” in which a request is made to remove the comments, Mohan said. If the comments violate websites’ terms of service by being repetitive as well as false, the website can be told to remove them, she said.
Comments May Violate Terms of Service
If it can be shown that the poster is using a fictitious name, that can be a violation and subject to removal by the website, Kallish added. “Some of these review sites are very responsive. Others will not respond unless you begin taking formal action against them, bring them into a lawsuit, issue subpoenas, get their lawyers involved. And all of a sudden, sometimes you’ll get more of a response once their legal teams behind these websites approach you.”
Although it is not always easy to determine whom to contact, “it can be very effective if you can prove to them that somebody is doing something malicious or often it’s a violation of their terms of service, they’ll take it down,” he said.
In cases where the doctor knows who the poster is, if the comment is about paying a bill or about office procedures, “the office of the doctor can certainly reach out directly, not mentioning anything online, of course, and work something out for that person to take the information down,” said Adler.
Kallish agreed, clarifying that “when you're talking about a lawsuit, you always need to evaluate what the ability is ultimately of the potential defendant to pay a judgment or award or whether they care.”
In the case of the vendor, “they had assets and the ability to sustain a judgment if we got a judgment against them, which we probably would’ve based upon their false posts. But the majority of the people that post maliciously, sometimes they have mental illness, sometimes they’re just members of the public, and they don’t really have assets, or money, so you have to decide what is your approach,” he said.
Besides a financial settlement, it may be possible to get an injunction that requires the author of the troubling comments or website to remove the posts, Kallish said. But “sometimes it’s quicker and easier…to go through the website to get it taken down.”
Harsher Consequences for Competitors
Those who may “have a desire to get an award of money for damages caused to your reputation or to your practice or [to cover] the legal fees that you spent identifying the person” and related costs of proving the allegations or comments are false “have to be aware of…the ultimate defendant collectible in any lawsuit,” Kallish said.
Moreover, it may be more complicated to calculate damages, he said. There is no federal libel law, generally leaving it up to state judges or juries to determine if someone suffered reputational damage and an amount of compensation. It may be difficult to quantify income loss. “You may feel that you’ve been terribly harmed, and they may think that it’s rather minor and not award significant damages,” he said.
Sometimes that poster might be a competitor. Kallish’s firm has been involved in cases where competitors, including dentists, posted negative comments “for the purpose of getting a competitive advantage,” Kallish said.
In such situations, “the courts will not look very favorably on that, in addition to [the comments] being defamatory,” and there will be an “assumption of damages,” the amount of which would be “left in large part to the judge or the jury,” he said.
“In addition, there are statutes about unfair competition and other statutory penalties,” including punitive damages and awards of attorneys’ fees in cases where the comments were made “for competitive advantage,” Kallish added. “It’s a very dangerous thing to do, and there could be very significant penalties. The professional licensing boards also would probably take on this issue. I don’t know if there’s really been anyone that’s lost their license [over this], but to me, it would be an issue, certainly be an issue for dental or medical boards if people are engaging in this kind of conduct.”
Adler also offered a warning. “Doctors are pretty high-income earners, and sometimes they don’t display great behavior either,” she said. “Doctors also need to understand that they’re actually pretty good targets and very worthwhile targets for lawyers to go after if they’re making statements that are false or untrue.”
‘I Was Drunk When I Did That’
Adler asked Mohan how individuals respond when they are confronted—whether they quickly agree to settle or “put up a fight thinking it can’t be proven” they are responsible.
When it comes to “being malicious or saying false things,” people won’t “fight quite as much because they can’t back up what they’re saying,” Mohan said. “This is very different than a lot of fights where both parties do believe they’re in the right.”
She added that “a lot of parties are surprised that they could face legal action” and are “accustomed to the notion that you can say whatever you want online…with impunity. So, once they are approached with a letter from a lawyer or with service of process, I think they are more likely to engage.”
From her experience with cases of this type, “we find most of these postings are done in the middle of the night, [during] off hours,” Adler added. “People have claimed, ‘Oh, I was drunk when I did that,’” and will acknowledge they were “not on their best behavior” and were “kind of caught red-handed.”
“A lot of times, doctors really just want things taken down,” said Adler. “They aren’t necessarily looking for money. They just want it to go away, and they’re not really looking for a big pay date, which I think can help make it a quicker issue to resolve.”
Mohan agreed. “Both parties, once you get to that point, just really want to walk away…and have no further damage.”
Adler said she hoped the information the attorneys offered help providers “think twice” about both posting and responding to negative comments and reviews.
“People should remember that when they’re online, they may think that they can be anonymous, but they’re not,” Kallish added, as the digital fingerprints left behind can be tracked and identified.
1 Theresa Defino, “Two Settlements Net OCR $105K, Highlight Online Review Comments, Unsecure Server”, Report on Patient Privacy 20, no. 8 (August 2023).
2 Theresa Defino, “Curiosity Cost the Hospital: OCR Collects $240K After Guards ‘Snooped’ in Hundreds of Records,” Report on Patient Privacy 23, no. 7 (July 2023), https://bit.ly/47d5myU.
3 Roetzel & Andress, “Roetzel Health Law HotSpot: Negative Online Reviews and Reputation Management: Tips for Health Care Practices and Providers,” June 17, 2021, https://bit.ly/45fgF7M.
4 Theresa Defino, “OCR Wrist-Slap on Dental Practice Puts Focus on HIPAA-Compliant Responses to Reviews,” Report on Patient Privacy 19, no. 10 (October 2019), https://bit.ly/3NJSaaQ.
[View source.]
