June 5, 2023 The U.S. Department of Health and Human Services (HHS) launched an investigation into Manasa Health Center LLC’s (Mansa) compliance with the The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule and notified them about it on November 18, 2020. Manasa is a psychiatric practice based in Kendall Park, New Jersey. As a covered entity under HIPAA, Manasa is required to comply with these rules. The investigation uncovered certain conduct, referred to as “Covered Conduct,” which includes the illegal disclosure of four patients’ protected health information (PHI) in response to negative reviews on Google. Additionally, Manasa was found to have failed to implement policies and procedures regarding PHI that comply with the standards and requirements of the Privacy and Breach Notification Rules. Manasa has agreed to pay HHS a resolution amount of $30,000. The payment will be made on the effective date of the agreement, following written instructions provided by HHS. Manasa has also committed to complying with a Corrective Action Plan (CAP) that serves as a roadmap for Manasa to rectify its non-HIPAA-compliant practices. The CAP put in place includes implementation of compliance policies and procedures, employee trainings, breach notifications, reports. Abyde’s HIPAA Compliance Software Solution can help healthcare providers effortlessly assess risks, implement necessary policies and procedures, and receive continuous support to maintain compliance with HIPAA regulations. If you have staff that has a bad case of keyboard-itis, make sure they are trained on what NOT to type out on the internet! By utilizing Abyde, healthcare providers can rest assured that they are meeting the requirements of the Privacy, Security, and Breach Notification Rules. This proactive approach to compliance helps them avoid the potential consequences of non-compliance, such as costly settlements like the one experienced by Manasa Health Center.
HIPAA vs Online Reviews: A Primetime Matchup
March 18, 2021 Let’s face it, social media and the internet tend to call the plays when it comes to our decision-making. Whether you’re shopping for a new car or just deciding between tacos or pizza for dinner, seeing a one-star review pop up under your Google search is a total red flag. So, when 95% of patients say that online reviews are reliable and over 70% say that reviews have influence over their choice of physician – being on the receiving end of a bad review can feel like a total cheap shot. There’s really no such thing as pleasing everyone – and as a practice owner, having to deal with some unhappy patients just kind of comes with the territory. Even all-star’s get the occasional “boo” from the crowd and seeing a patient post “100% would NOT recommend!!” about your practice can be a hard hit to recover from. As much as we all want to come to our own defense, choosing to fight back does a lot more damage than just taking the ‘L’ in the online face-off with a patient. Just take it from the dental practice who was slammed with a $10,000 fine for including sensitive patient information in their response to a Yelp review. You might be thinking if someone submits a review about my practice aren’t they already admitting that they’re a patient themselves? Though you aren’t totally wrong, HIPAA law is in place to protect patients’ privacy – and a patient submitting a review is NOT authorization for you to go and release their sensitive information when responding. So, while there might not be a winning playbook for how to keep your patients happy, there are some guidelines for how to best handle online reviews: Since there’s no one-size-fits-all response for any and every online review, your practice may receive some feedback that seems a bit out-of-left-field, and knowing how to handle it might be tricky. So to give you some sideline practice, let’s pretend you just received this negative review: “I had to wait over an hour to be seen and the doctor was rude and rushed through my appointment. Overall it was a terrible experience and I will not be back.”– Negative Nancy A bad response for your practice would be: “We’re sorry you had a bad experience during your appointment, however, our records show that you were late to your appointment which therefore caused a delay in your wait time.” A HIPAA-compliantresponse would be: “Our practice’s scheduling policy allows for adequate time with the doctor in order to keep our appointments running on time. However, due to emergency situations, it is possible for us to run behind schedule occasionally. We appreciate your feedback and are committed to providing the best patient care; you’re always welcome to contact our office if you would like to discuss further.” It’s pretty easy to see why response #1 would probably end up on Sportscenter’s Not Top 10 Plays of the Week – but unfortunately, we are seeing more and more real-life examples of practice comments similar to this one. With patient complaint numbers on the rise and proposed regulation updates centered around improving patient rights, the Office for Civil Rights (OCR) has definitely made it clear that they’ll be bringing their “A” game on HIPAA enforcement. Online reviews (both good and bad) should be handled with extreme care not only to protect your practice’s reputation amongst prospective patients but also to avoid any flags thrown by the OCR. So, while we hope that you won’t have to go head-to-head with a one-star Google review anytime soon, following HIPAA best-practices when and if you do will be the ultimate game-changer.