WIXLIB

UC DavisDermatology Online JournalTitleAddressing public criticism: a potential HIPAA /82z3h1k1JournalDermatology Online Journal, 24(6)AuthorsMartin, EliseLober, CliffordBenabio, Jeffet al.Publication Date2018DOI10.5070/D3246040710Copyright InformationCopyright 2018 by the author(s).This work is made available under the terms of a CreativeCommons Attribution-NonCommercial-NoDerivatives License, available 0/eScholarship.orgPowered by the California Digital LibraryUniversity of California

Volume 24 Number 6 June 2018 24(6): 4Dermatology Online Journal CommentaryAddressing public criticism: a potential HIPAA violationElise Martin1 BA, Clifford Lober2 MD JD, Jeff Benabio3 MD MBA, Steven R Feldman1,4,5 MD PhDAffiliations: 1Center for Dermatology Research, Department of Dermatology, Wake Forest School of Medicine, Winston-Salem,North Carolina, USA, 2Clinical Affiliate Associate Professor of Medicine, Department of Dermatology and Cutaneous Surgery,University of South Florida, Tampa, Florida, USA, 3Dermatology Chief of Service, Director Healthcare Transformation, KaiserPermanente San Diego, San Diego, California, USA, 4Department of Pathology, Wake Forest School of Medicine, Winston-Salem,North Carolina, 5Department of Social Sciences & Health Policy, Wake Forest School of Medicine, Winston-Salem, North CarolinaCorresponding Author: Steven R. Feldman MD, PhD, Department of Dermatology, Wake Forest School of Medicine, Medical CenterBoulevard, Winston-Salem, NC 27157-1071, Tel: 336-716-7740, Fax: 336-716-7732, Email: sfeldman@wakehealth.eduAbstractphysical or mental health or condition of anindividual; the provision of health care to anAlthough patients are able to speak openly abouttheir healthcare experience in negative reviews, lawsprotecting the privacy of the patient constrainproviders from responding as freely. Unfortunately,violation of this principle occurs when responding toonline patient criticism. We describe a case of aphysician assistant revealing protected healthinformation of a patient in response to a critical NewYork Times article. Providers must be wary of violatingcriticizedimplementation of a security awareness and trainingprogram for all members of the workforce is required[2]. Most healthcare entities require training for newemployees and annual education for all employees.Despite the need for, and training in compliancewith, HIPAA standards, between April 2003 andSeptember 2017, a total of 165,175 privacy rulecomplaints were received [3].These complaints can go beyond accidental privacybreaches of protected health information. In theworld of social media and electronic communication,anonymity promotes temerity. This is manifest in theincreased violation of accepted social norms as seenin the prevalence of cyber-bullying and onlineaggression [4]. Whether encouraged by thebrashness that an online platform affords or not,healthcare providers continue to occasionallydisregard HIPAA regulations when posting in onlineforums. In a ProPublica investigation co-published in2016 with The Washington Post, 1.7 million publicreviews on Yelp were examined. Three thousand fivehundred reviews mentioned privacy or HIPAA.Healthcare professionals, disagreeing with negativereviews posted online may retaliate and exposepatient information thus violating HIPAA regulations[5]. Responses to criticism that reveal patientinformation not only violate HIPAA rules but alsooptions for responding to negative reviews.Keywords: dermatology, dermatologic surgery, socialmedia, patient satisfactionIntroductionInInsurance Portability and Accountability Act (HIPAA)are engrained into medical professionals withoftentimes equal vigor as the Hippocratic Oath. ThePrivacy and Security Rules ensure patient privacy inthe electronic arena [1]. HIPAA stipulates thatproviders cannot use or disclose protected healthinformation, even if patients reveal this informationthemselves. Protected health information includesindividually identifiable health information, definedas-1-

Volume 24 Number 6 June 2018 24(6): 4Dermatology Online Journal Commentarysabotage the trust between patients and providers[6]. The prevalence of this issue is evident in multiplearticles urging healthcare professionals to avoidviolating HIPAA when responding to online reviews[7-11].reassured him that superficial radiation was notindicated and proposed surgical removal of many ofthe previously diagnosed basal cell carcinomas.pigmented, asymmetrical spot slightly bigger than aWe present a case of a provider revealing patientinformation in response to a negative patientcommentary in the New York Times.was a malignant melanoma. It was reportedly missedby physician assistants in the four exams over a fourmonth period.Among the social media comments received wasone in which the writer identified himself or herselfas one of the physician assistants who saw thepatient. Thereafter, he or she discussed the details ofthe healthcare encounter with this patient, revealingphysical examination findings and other healthinformation not mentioned in the article. Multiplecommenters noted this violation of patient privacy.re than a flagrantBody of ArticleIn a recently online published article in the New YorkTimesQuestionvignettes described the lack of satisfaction withdermatologic care provided primarily by physicianassistants [12]. In one such case, the patient was seenfirst by two young women wearing lab coats whomhe assumed to be physicians and later found to bephysician assistants. At his first visit, one of thephysician assistants biopsied ten lesions. At his nextvisit one month later, the second physician assistantinformed the patient he would need radiation forbasal cell carcinomas on his temple, shoulder, andear. The patient tried to argue with her by statingthat in the past he was treated for this condition withrecommended retraction of the statement. Thehave already been discussed in the article, the dateof visit, the procedure in questionspoke in detail about his own visit, to the New YorkTimes, that was full of inaccuracies, which is liable onhis behalf. Stating facts that strongly dispute histhese procedures were necessary because if thelesion above his right eye was surgically removed hemight become unable to blink that eye. She also toldhim that radiation was required to treat the canceron his ear so that he did not lose the entire ear. Shealso told him that he would need Mohs surgery totreat several of the other basal cell carcinomas. Thepatient never saw a physician on any of these visits.He questioned the number of biopsies that had beenperformed and the aggressive treatmentrecommended. On the day he was scheduled forsurgery, he was injected with anesthetic by thesecond physician assistant. Afterwards, feelingapprehensive in the waiting room, he decided to notundergo the treatment. He realized he had not seena physician and his concern that the physicianassistant would be performing surgery promptednot been removed.DiscussionThe scenario of HIPAA-violation is not uncommon.Although providers have been trained in theimportance of maintaining patient privacy, whentheir expertise is questioned, the HIPAA regulationsmay be forgotten. When the physician assistantrevealed information related to the physical health ofthe individual, he or she violated HIPAA regulations[2]. The appearance of this issue in the New YorkTimes draws needed attention for healthcareproviders to both avoid this pitfall and learn how toappropriately respond to public criticism. Severalcommenters identify solutions to improveunderstanding and avoid violating HIPAA laws; oneproposed more thorough and regular employeetraining on HIPAA Privacy and Security policies.decision to find a different dermatologic practice.The dermatologist whom he subsequently saw-2-

Volume 24 Number 6 June 2018 24(6): 4Dermatology Online Journal CommentaryTo better respond, physicians should consider thethree-Importantly, providers should not assume that aprotected health information grants providersauthority to disclose this information [9]. Onecommenter is and the setting in which the postoccurred. If it the comment is insignificant, providersmay do best by not responding. Additionally,listening can help physicians understand howpatients experience the practice, possiblyuncovering unrecognized deficiencies. Oftencomplaints can lead to actionable advice, improvingthe quality of the practice. Second, providers shouldknew who this patient was. None of my patientsmatch the situation described. If you are this patient,please contact me so that we can address thisand offering to help, providers can request theent [10]. However,providers must be wary of filing suit to have the postremoved, as this may result in only more attentionbrought to the matter, a phenomenon known as thein a direct conversation or responding in a publiconline forum would be more effective andappropriate [10]. One option is to politelyacknowledge a negative review while offeringfurther discussion to be held in a private, HIPAAcompliant setting [8]. By redirecting theconversation away from an online setting in which aConclusionThe need for providers to respect HIPAA policieswhen countering public criticism is important since abreach in confidentiality in a public forum incitesgeneral mistrust of healthcare providers. Otherreplies to the purported treating physician assistantomment does not inspire trustproviders can communicate in a more appropriatevenue should they choose to respond. Finally,commenter [10]. If the decision is made to engagecommenters, providers should consider makingefforts to utilize neutral, non-confrontationallanguage and avoid arguing or appearingfaltering trust. We present this case of HIPAAviolation to encourage providers to respondappropriately to criticism in the public online sectorin order to uphold not only HIPAA standards ofpatient privacy, but also the relationship of trust onwhich the patient-physician relationship is founded.recognize that the commenter is upset withoutnecessarily agreeing with his or her statement [10].Moreover, responding in a caring and compassionate manner can counteract the offensive post [11].References1. U.S. Department of Health and Human Services. HIPAA rprofessionals/index.html. Accessed on January 5, 2108.2. 45 C.F.R. § 164.308(a)(5)(i) (2013).3. U.S. Department of Health and Human Services. Numbers at aGlance Current. 2017. nce-enforcement/data/numbersglance/index.html. Accessed on January 5, 2108.4. David-Ferdon C, Hertz MF. Electronic media, violence, andadolescents: an emerging public health problem. J Adolesc Health.2007;41(6):S1-5. [PMID: 18047940].5. Ornstein C. Doctors fire back at bad Yelp reviews and revealtion online. The Washington Post. ews-andreveal-patients-information-online/?utm term .ff7da19ac87d.Accessed on January 5, 2108.6. Lee V. Transparency and Trust - Online Patient Reviews ofPhysicians. N Engl J Med. 2017;376(3):197-9. [PMID: 28099823].7. Henry TA. How to respond to bad online reviews. AMA Wire. pond-bad-onlinereviews. Accessed on January 5, 2108.8. Gin R. Establishing and Protecting Your Online Reputation. FamPract Manag. 2015;22(6):29-32. [PMID: 26761082].9. Segal J. The Right Way to Fight Bad Online Reviews. Medscape.2014. https://www.medscape.com/viewarticle/835077. Accessedon January 5, 2108.10. Benabio MJ. How to handle negative reviews. Dermatology iews. Accessed on January 5,2108.-3-

Volume 24 Number 6 June 2018 24(6): 4Dermatology Online Journal Commentary11. Lober CW. Responding to online defamation. Dermatology World.2017;27(10):24-5.12. Hafner K, Palmer G. Skin Cancers Rise, Along With ancer.html. Accessed on January 5, 2108.-4-

Volume 24 Number 6 June 2018 24(6): 4 - 1 - Dermatology Online Journal Commentary Addressing public criticism: a potential HIPAA violation Elise Martin1 BA, Clifford Lober2 1,4,5MD JD, Jeff Benabio3 MD MBA, Steven R Feldman MD PhD Affiliations: 1Center for Dermatology Research, Department of Dermatology, Wake Forest School of Medicine, Winston-Salem,