It should go without saying that any business or provider subject to HIPAA should not be intentionally sharing their patients’ protected health information (PHI) online without their consent. Certainly, personal attacks would seem to be especially off-limits.

But that’s apparently what happened three years ago to someone who, it’s safe to say, is now a former patient of a dental practice in Dallas that used to go by the name Elite Dental Associates, operated by dentist Andy Chang.

In June 2016, the practice responded to what was most likely a negative review that was posted on Yelp by sharing a female patient’s last name, “details of her treatment plan, insurance, and cost information,” according to her complaint filed the next day with the HHS Office for Civil Rights (OCR).^[1]

In November of that year, OCR informed Chang it was investigating the practice, having learned that Elite “also impermissibly disclosed PHI of other patients when it responded to those patients’ reviews without valid authorizations.” Earlier this month, OCR announced it had concluded its investigation with a $10,000 settlement with Chang, who also agreed to implement a two-year corrective action plan (CAP).^[2]

In the agency’s Oct. 3 announcement of the settlement, OCR Director Roger Severino points out that “[s]ocial media is not the place for providers to discuss a patient’s care,” cautioning that doctors “and dentists must think carefully about patient privacy before responding to online reviews.”

OCR “accepted a substantially reduced settlement amount in consideration of Elite’s size, financial circumstances, and cooperation with OCR’s investigation,” the agency’s statement adds.