In an all too familiar scenario, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), has reached a settlement with Manasa Health Center, a psychiatry practice in New Jersey. The settlement resolves a complaint that the health care provider disclosed a patient’s protected health information in response to a negative online review. The OCR investigation found potential violations of the HIPAA Privacy Rule, including impermissible disclosures of patient information and failure to implement policies and procedures. Manasa Health Center paid $30,000 to OCR and agreed to implement a corrective action plan. OCR Director Melanie Fontes Rainer emphasized that disclosing patient information in response to negative reviews is not allowed and will be investigated and addressed. The investigation also revealed that Manasa Health Center disclosed the protected health information of three other patients in response to their negative online reviews. In addition to the monetary settlement, the health center will develop and revise policies, train its workforce, issue breach notices, and submit a breach report to ensure compliance with the HIPAA Privacy Rule.
