Beware: Online Reviews That Expose Patient Information Go Too Far

Urgent care centers and other facilities often ask patients to rate their experiences. However, the Federal Trade Commission says online reviews that include too many details constitute a violation of patient privacy, even if the patients themselves provided the information. The problem is that some survey companies don’t make it clear that reviews will wind up on the internet. Most recently, the FTC reached a settlement with Practice Fusion, a cloud-based electronic health records vendor, over charges that the company asked patients to review physicians without sufficient warning their words would be posted online. The Privacy Rule, one stipulation of the Health Insurance Portability and Accountability Act of 1996, limits who can look at and receive an individual’s health information. Practice Fusion is alleged to have included personal health details, such as mental health issues and the fact that one female patient had a yeast infection, public reviews. The company did not admit to any wrongdoing as part of the settlement, but is prohibited from making “deceptive statements about the confidentiality of information it collects from consumers.” The settlement also requires Practice Fusion to “get affirmative approval from consumers before making their information publicly available in the future.” Urgent care providers who contract with third parties to conduct patient surveys are urged to ensure that surveyors follow suit.