A review of 80,300 public Google review replies from medical and dental practices found that roughly 26 percent contained language disclosing or confirming patient information, according to a study published Tuesday.
The study team combed through replies from 4,019 medical and dental practices spanning 10 clinical disciplines in California and the Pacific Northwest. A two-stage process used a rule-based classifier to flag 26,147 replies, then had human reviewers adjudicate 9,844 of them against a conservative rubric that counted only what the practice itself disclosed. That works out to an estimated 21,117 replies overall, or 26.3 percent of the full sample.
The most common problem was subtle. Of the replies hand-confirmed as risky, 58 percent confirmed a patient or visit existed, 41 percent revealed clinical specifics like a condition, procedure, or outcome, and 1 percent touched billing or insurance. The authors dubbed the patterns care narrators, who repeat the patient’s story, and visit confirmers, who acknowledge the reviewer received care.
Practice-level rates were highest in fertility and reproductive medicine at 90 percent, followed by sports medicine at 76 percent, pain management at 69 percent, and dermatology at 64 percent. Psychiatry, podiatry, and pediatrics each landed near 61 to 62 percent.
The authors note the review does not establish a national HIPAA violation rate: it measures public disclosure risk. For covered entities, the lesson is that a patient mentioning their own care in a review does not grant the provider license to confirm, elaborate on, or tie the reviewer to treatment in a public reply.
