A daughter posts a one-star review saying the aide never showed up on Saturday and nobody called her back. The office manager knows the aide arrived 20 minutes late, that the client had refused care the week before, and that the daughter was called twice. The urge is to reply with the facts.
That reply is the problem. When a home care agency, home health agency or hospice confirms that someone is its client or patient and adds details about their care, it is disclosing protected health information in public. OCR has settled cases against providers who did exactly that. This guide covers what those cases found, what the HIPAA rules say, what the FTC's consumer reviews rule adds, and a response method your staff can follow without calling a lawyer every time.
Why a Reply Can Be a Disclosure
HIPAA's general rule, at 45 CFR 164.502(a), is that a covered entity may not use or disclose protected health information except as the Privacy Rule permits or requires. Answering a review is not on the list of permitted disclosures.
The definitions are broad. Under 45 CFR 160.103, individually identifiable health information includes information created or received by a health care provider that relates to the provision of health care to an individual and identifies them, or could reasonably be used to identify them. A public reply that says "we sent your mother's aide on time" confirms that a specific, identifiable person receives care from your agency. Adding the schedule, the diagnosis, a refusal of care or a family dispute makes it worse.
It does not matter that the reviewer posted first. The reviewer can say what they like about their own or their family's care. The agency is the covered entity and remains bound by the rule.
What OCR Has Settled Cases Over
Two resolution agreements are the clearest guide.
Manasa Health Center (2023). A New Jersey psychiatric practice responded to negative online reviews. According to OCR's summary of the settlement, the complaint arrived in April 2020, and potential violations included impermissible disclosures of PHI in response to negative online reviews and failure to implement policies and procedures. The practice paid $30,000 and agreed to a corrective action plan. The resolution agreement states that Manasa disclosed the PHI of four patients in response to their reviews on Google Reviews, citing 164.502(a), and failed to implement policies required by 45 CFR 164.530(i).
The corrective action plan is a useful template of what OCR expects:
- Written policies on permissible and impermissible uses and disclosures, submitted to HHS within 90 days for approval.
- Training for all workforce members, including owners and managers, with signed certifications.
- Breach notices, within 30 calendar days, to every individual whose PHI was disclosed on Google Reviews or any other internet platform without authorization, plus breach reports to HHS.
- A two-year compliance term with annual reporting.
Elite Dental Associates (2019). OCR's summary describes a Dallas dental practice that paid $10,000 and adopted a corrective action plan to settle potential Privacy Rule violations involving social media disclosures of patients' protected health information.
Neither practice was a home care agency. The pattern transfers directly: a small provider, an angry review, a well-intentioned reply, and a settlement that required breach notices to the very people who wrote the reviews.
What the FTC Rule Adds
The FTC's Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, applies to businesses generally, including agencies selling private-pay services. Several provisions bear on how agencies handle reviews:
- Review suppression. Under 465.7(a), it is an unfair or deceptive practice to use an unfounded or groundless legal threat, a physical threat, intimidation, or a public false accusation made knowing it is false or with reckless disregard, to try to prevent a review or get one removed. Threatening a family with a defamation suit you have no basis for falls here.
- Displayed reviews. Under 465.7(b), a business may not misrepresent that the reviews displayed on its own site represent most or all reviews submitted when reviews are being suppressed because of their rating or negative sentiment. The rule allows withholding reviews on criteria applied equally to all reviews, including reviews containing the personal information of another individual.
- Buying reviews. Under 465.4, a business may not provide compensation or incentives conditioned on a review expressing a particular sentiment, positive or negative.
- Fake and insider reviews. Under 465.2, a business may not write or create fake reviews. Under 465.5, an officer or manager writing a review of the business must clearly disclose the relationship, and managers may not solicit undisclosed reviews from employees or their relatives in the ways the rule describes.
The practical effect: answer reviews carefully, do not bury the negative ones on your own site, and do not ask caregivers or their families to "balance things out."
A Response Method Staff Can Follow
- 1.Do not reply from the scheduler's or office manager's personal account. Route every review to one designated person, usually the privacy officer or administrator.
- 2.Never confirm the relationship. No "your mother," "your visit," "our client," "your care," or any reference to dates, staff names, services or diagnoses.
- 3.Use an approved template. Keep two or three short replies approved by the privacy officer. Example: "We take every concern seriously. Privacy rules prevent us from discussing any individual's care in a public forum. Please call our administrator at the office number on this page so we can listen and follow up." That reply works whether or not the reviewer was ever a client.
- 4.Move the conversation offline. If the reviewer calls, verify identity and authority before discussing anything. A family member is not automatically entitled to information; check who the client has authorized and whether the caller is a personal representative.
- 5.Log and investigate. Treat the review as a complaint. Record it, investigate it under your grievance process, and fix what was wrong. The review may be accurate.
- 6.Flag false or abusive content through the platform. Platforms have their own processes for content that violates their policies. Use them rather than arguing in public.
- 7.Respond the same way to positive reviews. "Thank you, we are glad your mother is doing well with Maria" is the same disclosure as a rebuttal.
If Staff Already Replied
Act quickly and involve counsel.
- 1.Remove the reply.
- 2.Assess whether PHI was disclosed. The Manasa plan treated each such reply as a breach requiring notification under 45 CFR 164.404.
- 3.Document the risk assessment and the decision.
- 4.Notify affected individuals and HHS as the Breach Notification Rule requires.
- 5.Retrain the person who replied and anyone else with access to the agency's review accounts, and apply your sanctions policy consistently.
Policies and Training That Close the Gap
OCR's findings in both cases included missing policies, not just bad replies. A short written policy should cover who may respond on behalf of the agency, the approved templates, a ban on personal-account replies about clients, what to do when a review names a staff member, how the FTC rule limits your response, and how a review becomes a complaint record. Train on it at onboarding and annually, and have staff sign that they received it.
Watch for the subtle disclosures: photos of caregivers with clients in recruitment posts, "employee of the month" stories that name a client, and replies to comments on the agency's own social pages. All of these are the same problem in different places.
Where Software Helps and Where It Does Not
Review responses are a judgment call made by a person, and no tool makes an agency compliant. What helps is control: knowing who can post, keeping approved language in one place, and requiring approval before anything goes out. Nuraflow is being designed so that social media management uses approved templates and brand assets, with review and approval before scheduled publishing. The Trust page describes how Nuraflow approaches security and privacy, and the compliance software guide explains why software should organize this work rather than make the decisions.
This article is general information, not legal advice. HIPAA, state privacy laws and the FTC rule can apply differently to your facts, so have counsel review your review-response policy and any reply that has already been posted.