As part of a recent settlement with the HHS Office for Civil Rights (OCR), Manasa Health Center LLC—a psychiatry practice operated by Nidagalle Gowda, M.D.—agreed to notify four patients that he allegedly violated HIPAA by disclosing their protected health information (PHI) in response to negative reviews they had posted online.
Gowda also paid a $30,000 fine and will implement a two-year corrective action plan (CAP). He did not respond to RPP’s request for comment. Gowda’s is one of seven settlements announced so far this year and one of three recent agreements. In the July issue, RPP discussed a $240,000 settlement with MultiCare Yakima Memorial Hospital related to its security guards inappropriately accessing emergency department records.[1]
This is not the first time OCR has sanctioned a covered entity for posts that reveal PHI as an attempt to defend against online comments, but, unlike a case from 2022, the agency did not repeat any comments made to the patients. Also, in a break from other similar cases, OCR resolved this one fairly quickly.
Diagnosis, Treatment Disclosed Online
While online reviews and comments can be hurtful or damaging, providers should not respond emotionally but instead explore legal ways to address them.[2]
The case began when a patient complained to OCR in April 2020 that the practice “posted a response to the patient’s negative online review that included specific information regarding the individual’s diagnosis and treatment of their mental health condition,” the agency announced.[3] “In addition to the patient who filed the complaint, OCR’s investigation found that Manasa Health Center impermissibly disclosed the protected health information of three other patients in response to their negative online reviews.”
The agency “continues to receive complaints about health care providers disclosing their patients’ protected health information on social media or on the internet in response to negative reviews. Simply put, this is not allowed,” said OCR Director Melanie Fontes Rainer. “The HIPAA Privacy Rule expressly protects patients from this type of activity, which is a clear violation of both patient trust and the law. OCR will investigate and take action when we learn of such impermissible disclosures, no matter how large or small the organization.”
The CAP calls for Gowda, who practices in Kendall Park, New Jersey, to notify the four patients within 30 days of the effective date of the agreement. Further, by the same deadline, he must notify OCR and any other individuals or their personal representatives whose PHI was disclosed “on Google Reviews or any other internet platform without a valid authorization.”[4] In addition to Google, other review sites include Yelp, Healthgrades, Vitals, and RateMDs. Not all permit responses from individuals or organizations being reviewed.
Aside from these specific complaints, OCR discovered Gowda had not implemented required privacy policies and procedures.
