A Yelp Review is Not an Authorization to Release Client Information: Online Reviews and Confidentiality

Today, on Twitter, I got pulled into an exchange about whether or not client reviews on websites can be assumed to be waiving their confidentiality rights. Thank you to @dr_wayne and @TherapyOnline, my two co-discussants in online ethical dilemmas.

The conversation started in response to this posting describing how clinicians are more free to respond to anonymous reviews and explaining how requiring people to post with real names is not great for health-related businesses (or the clients who wish to review them), as it would violate our pledge of confidentiality.

This is an area in which we need to exercise restraint and caution. Clients reviewing us on a website, no matter whether their real name is used, is not the same thing as their signing a release of information authorizing us to discuss their care. Even when we do get such releases of information, we can discuss only the minimum amount of necessary information, and only to people who are involved in their treatment.

While it can be tempting to defend our professional reputations on online review sites, I’d argue that this is not a necessary sharing of information relevant to an individual’s treatment. It is an unjustified breach of our primary obligation of confidentiality, disclosing a treatment relationship to a wide public audience, let alone one that is clearly not involved in their care. Yes, negative online reviews are problematic, but we need to consider other ways of managing this. And let us remember, that clients do not owe us confidentiality. This is a one way street.

This is also a good time to look back at what our agreements are with clients at the outset of treatment. If we outline the limits of confidentiality and we do not state that online reviews constitute an exception to this on our part, it is a huge breach to disclose this information whether or not we like the review a client has left of our practice.

There have been cases in which physicians have attempted to limit the freedom of speech of clients by requiring treatment agreements that care can be terminated if the client posts an online review. Others have tried to assert copyright ownership over online reviews left by their clients. Perhaps physicians and clinicians would be better off outlining how they intend to respond to reviews instead and making this part of treatment agreements.

It is my belief that clients have a right to disclose their relationship to us with anyone they choose, without a threat of our disclosing their health data.

Similarly, if an individual tells a friend or their spouse that they see us in psychotherapy, this does not mean we have a free pass to discuss them with these people. If a client tells a room of people that they met with us and loved us (or hated us) we are not permitted to talk to those people about their care.

Should a public forum on the Internet be any different? Why or why not?

Do you think a client leaving a review should mean their clinician can comment about their treatment?

Note: comments are now enabled on this blog. I’d love to know people’s thoughts and responses to this.


18 Responses to “A Yelp Review is Not an Authorization to Release Client Information: Online Reviews and Confidentiality”

  1. clare

    As you say, a client must always be free to comment on the counsellor they’re working with. I’d go so far as to say that the counsellor should *never* respond to the clients on line comments. And the counsellor can say that the client is free to make a formal complaint to their professional body.

    I’m assuming that this is a US thing. I’m not aware of anything like this in the UK, thank goodness. When therapy becomes just the same as a pizza delivery or dry cleaning service something’s very wrong.

  2. Neal Gillett

    A client leaving a review is sharing subjective impressions of a specific or general experience with a provider. It is NOT a release for the provider to discuss details of the treatment process, just as a consumer’s comments on shopping or dining does not permit a store or restaurant to share the customer’s credit score, purchase details, amount of tip, compliments or complaints, or other info. The exception: if a legal process is initiated – & statements that are part of an investigation are confidential until a hearing or trial. So if there is no formal Board complaint or filing of legal charges against a provider, he/she would be ethically bound to uphold rules of confidentiality.

  3. Roy Huggins

    I agree that confidentiality is a one-way duty, and I think that’s the main argument for why posting a review doesn’t constitute waiving confidentiality rights. Thanks for all your work on this subject. It’s a bigger one than many realize!

  4. Dr. Wayne Roffer

    This is a great topic as it is multi-factoral and more than one issue is at hand, making it a very complex issue at that.

    At its core, you have:
    1) Posting a reply to a review
    2) Asking for a review to be taken down
    3) Privacy
    4) Confidentiality

    Whether a provider can post a reply to a review or request one be taken down is not just about confidentiality. Confidentiality refers to the protection of data, and the responsibility usually falls on the provider (with some exceptions). The patient is free to discuss the details of their treatment to whoever they want. That’s because no matter how much a person discusses the nature of their treatment, we as providers remain bound to protect that data. A patient sharing the details of their treatment does not waive confidentiality in of itself. In this regard, I agree with Dr. Kolmes.

    Privacy, though, is another matter. Privacy refers to the person, and at its core, the relationship the person has with the provider, or even that the patient has a relationship in the first place.

    When a patient posts a review of a provider on a website, they waive their right to privacy. They have just publicly acknowledged the relationship and there is no going back. Sure, I could in theory deny someone is a patient of mine, but how does that work when they have posted a review of me? I could answer with a “due to privacy limitations I cannot say so-so is a patient or not a patient of mine.” I actually hate this response since if they weren’t a patient, saying no wouldn’t violate any sense of privacy. That response essentially acknowledges some degree of a relationship, breaching privacy, confidentiality, or both. But I digress…

    Thus, while I agree with Dr. Kolmes that we have to maintain confidentiality, no matter what a person writes about us online, the patient’s privacy has been waived. In fact, a judge recently ruled that there is no expectation of any sense of privacy with public tweets. This sets the stage for further rulings (which I am sure will come) that anything posted on the Internet is no longer private.

    It’s the issue of privacy I argue that allows us to either reply to a review online or request that it be taken down. A provider could easily reply to a negative or positive post without breaching confidentiality. A “thank you” for a positive post or a “please contact my office to discuss your concerns” for a negative post does not breach confidentiality. It would normally breach privacy, except for the fact that the patient has already waived that.

    Likewise, as privacy has been waived, I further argue we have the right to contact the site hosting the reviews to request that a particular review be taken down. However, we again have to be careful in what information we share about our relationship with the patient when making such a request, even if the poster uses a alias, as confidentiality is still bound.

    In the end, it will likely take a court ruling to firmly establish whether it is okay for health care providers to post replies to reviews or request reviews be taken down. I for one do not want to be the subject of such a case and therefore will play it safe. I like Dr. Kolmes’ suggestion, “Perhaps physicians and clinicians would be better off outlining how they intend to respond to reviews instead and making this part of treatment agreements.” Make this part of your informed consent and/or social media policy.

  5. Ofer Zur

    This is a great cutting edge topic, Keely. I wonder at what point therapists have the right to ‘defend themselves.’ For example, if a client post online that his or her psychotherapist stole money from him/her or had sex with him/her, can the therapist deny it or respond online?

  6. drkkolmes

    Thank you all for your comments. I’m happy to be able to have these conversations in more than 140 characters.

    Ofer, I like your question. I think all responses to reviews need to be done with great care, but I think a clinician could easily post, “I have never had sex with a current or former client, but I always welcome feedback, both critical and complimentary.”

    I do think there are ways to comment without confirming the relationship, but this is a tricky area. It will be interesting to see how the courts rule, as Dr. Roffer has pointed out. Also, in response to Dr. Roffer, when clinicians are sure that the poster is not a client, I have encouraged them to address this with the review site and I know that Yelp and some other sites have removed reviews left by non-patients, as it is a violation of their terms of service.

    I’m aware of several court cases right now involving online review sites and healthcare providers:




    The courts seem to be ruling that patients posting opinions is a protected form of speech and they are not ruling in favor of the doctors. It can also be very difficult to prove reputational damage.

    I frequently hear from clinicians struggling with reviews that they fear will harm their businesses, but I also worry about the negative press that comes attached to a court case going after the poster of such a review. This is expensive, time-intensive, and yet another way to call attention to the fact that people do not like your business.

    I think the best tactic when getting a bad review is to sit with it, seek support, and see if there is any grain of truth in the review that can help you become a better clinician. This is all easier said than done, of course.

  7. Jo

    Keely, it might be interesting to ask Eric Harris, PhD, JD, an attorney for the American Psychological Association, to comment on this topic.

  8. drkkolmes

    I would love to have Eric Harris, Ph.D., J.D. weigh in and am trying to get him to come post a reply or a guest post on this topic.

  9. Jeff Younggren

    Let me get ahead of Eric here. I think that there is a concept in the law called “inconsistent conduct” that relates directly to rights to confidentiality. That is, when a client’s conduct is inconsistent with an expectation that information be confidential, like not paying your bill, you have rights to proceed to collect the bill legally which might be seen as a violation of confidentiality, which is isn’t. It might be unwise to do but it is not a violation of the law. Perhaps the strongest example of this can be found in the exception to privilege where a client puts their mental health at issue in a legal proceeding. When this occurs, privilege has been waived. Now, whether an attack on the internet of your reputation would be seen as inconsistent conduct is a legal question that has not been answered yet. While I think that such conduct does increase the right of the therapist to defend him or herself, one should really be careful here. I would think that a psychologist considering this would be wise to consult with an attorney experienced in mental health law before doing so.

  10. drkkolmes

    Dr. Wayne Roffer was kind enough to link to this blog post on LinkedIn:


    There was a great point raised by Roy Huggins in that discussion.

    I quote: “The identities of reviewers aren’t authenticated in any authoritative way, however. I can see myself posting a review of Dr Wayne Roffer, claiming to be someone I suspect is your patient. The nature of your response could inform me as to whether or not my suspicion is correct.”

    This is a fantastic point and it highlights another challenge we have when looking at the ethics of responses to online reviews. It is possible to be lured into ethical landmines by people posing as our clients. To assume that the client is engaging in “inconsistent conduct” in regard to confidentiality could be a true nightmare for a clinician if it is not actually our client posting the information.

    I have heard more than one anecdote of people who are not clients posing as clients to post negative reviews of a business, including angry exes and business competitors. This is just another reason to tread very carefully when feeling moved to respond to a review.

  11. Dr. Sheila

    So what do we do when one of us makes a blog post about something “controversial” (like suggesting that women, people of color, GLBTQ people, or fat people are human beings with rights for example) that goes viral, and one of the methods that Internet trolls use to attack us (in addition to the usual death threats, fantasies about us getting raped or assaulted, porn with our heads pasted on, and the like) is posting nasty Yelp reviews?

    • drkkolmes

      @Dr. Sheila, if someone who you are certain was *not* your client is attacking you on a site like Yelp, I recommend reporting it to the site as most review sites would consider this a violation of their Terms of Service. I have spoken to other clinicians who had negative reviews removed when they were posted by individuals seeking to harm them who had not actually utilized their services.

  12. Psychotherapist's tool for managing negative online reviews | Psychologist San Francisco

    […] A Yelp Review is Not an Authorization to Release Client Information: Online Reviews and Confidential… […]

  13. My2Cents

    Maybe I’m unusual, but I’m not that swayed by most reviews. I take them into account, especially noticing if they appear to be “excessive”–in either direction.

    Are there details that give a sense of credibility? Do the issues raised matter to me? Is the tone mostly matter-of-fact, or highly agitated?

    Most highly negative online reviews are the Internet version of road rage, or other types of acting out. I may look at them, but only in conjunction with other information.

    Online reviewers are notoriously Unreliable Narrators. And I credit most people with understanding that and taking it into account. I’d actually prefer someone to go to a different therapist, if they are going to be so swayed by a harsh, disparaging online review of my services.

  14. Dr. Brian Sedgeley

    Keely what a wonderful discussion! I appreciate your thoughts.

    I do think one way to conceptualize negative reviews is as defensive and acting out. Splitting and projection may be at the heart of many of these “attacking” comments. I’ve had numerous experiences where I received negative feedback from individuals I have never worked with directly. Instead, I seemed to embody something they were projecting on to me.

    I think the milieu that the internet creates lends itself to these types of projections, and may be the new reality clinicians must deal with.

    Understanding negative review in this way seems to help me feel less attacked by them. Though I do strive to look for any grain of truth in them as an opportunity to develop my clinical skills further.

    As this is an old blog post, I’d love to hear about any developments or further thoughts you might have.

    • drkkolmes

      I am writing an updated post soon on my thoughts about asking colleagues to support you by writing positive reviews. I used to suggest this practice, but not any longer. I agree with you that it is important to look for the grain of truth in a negative review, just to see if it provides important information about how one may be failing their patients. But I have also heard of clinicians getting negative review from people they haven’t see (e.g., complaints about office staff, when they have none, etc.).

  15. BL

    I’ve recently received some bad reviews online from a client that terminated with me last month, and the site won’t remove them. I had an attorney send a cease and desist letter to the client after termination when the client continued to email me. I regret doing that rather than responding to the client myself first and asking them to stop. Now, the client is using online reviews to tell the public that I revealed their identity and other info to an “unauthorized third party”. At this point, I’m not even sure that I did the right or legal thing, and the former client is threatening to file a misconduct complaint. On top of all this, I’m getting conflicting opinions as to whether or not it was ethical or legal for me to use the attorney to send the C&D, and I am having no luck getting any answers from the state office of professions. I advise everyone in a similar position to go very slowly before responding to negative emails, online postings, etc from disgruntled clients. We can end up being the ones in real trouble.

    • drkkolmes

      Dear Becca, I’m so sorry to hear this. I also agree that any action on our part should be very carefully considered and although I’m not an attorney, I do believe that legal action can backfire, and, as noted previously, the courts are ruling that this is protected speech. I think your story is a good warning to others. I do believe that we often may need to let the clients have the last word although that can feel hard when we have a different experience of what occurred (and sometimes very much wish to repair it). In my trainings, my biggest advice is do nothing, but to get emotional support from people who believe in you and the work you do (but not your own patients, of course). I’m sorry that you are suffering.

Leave a Reply