Attorney General Cracks Down on Form Non-Disclosure Agreements Targeting Physician’s Negative Reviews

Many moons ago – actually in the aughts – Medical Justice advocated for “non-disclosure agreements” to address the emerging problem of negative online reviews. Online reviews in healthcare were just gaining traction. Our belief, then, was that the vast majority of physicians were defined by no reviews or a handful of negative reviews. And physicians were not free to respond. Any negative commentary was a one-sided debate. And doctors were becoming human pinatas. 

Regardless, we retired those non-disclosure agreements in 2011. We believed then, as we do now, that there are better ways to manage online reputations. The solution to pollution is dilution. Make it easy for your patients who are happy to post their stories. The silent majority should have a platform. And health care providers can respond online as long as they do so in compliance with HIPAA. This strategy has worked wonders for physicians who embraced them. 

Importantly, in 2016, long after we retired our version of such agreements, Congress passed, and the President signed, the Consumer Review Fairness Act (CRFA). That law made such form non-disclosure agreement void against public policy and unenforceable. It directed the Federal Trade Commission (FTC) to enforce the law, and state Attorney Generals to impose financial penalties.  

We have long recommended that if you have been using such agreements, stop using them. The CRFA made them liabilities. 

In 2019, the Federal Trade Commission took action against a Pennsylvania HVAC company, a Massachusetts flooring company, and a Las Vegas trail riding company.  Based on violations of CRFA. The FTC has continued its trend in non-healthcare related domains. Such as property managers, credit repair businesses, vacation properties, and more. 

What about healthcare? 

This brings us to the State of Washington versus Defendant Allure Esthetic (doing business under several names, including Alderwood Surgical Center), and its owner, Javad A. Sajan, M.D. The state Attorney General alleged that between 2017 and 2022 over 10,000 patients were presented with pre-service form non-disclosure agreements (NDAs). The AG alleged that these form agreements violated CRFA.  

There were several iterations of these NDAs. The first batch prohibited patients from posting any negative reviews – defined as anything “under four stars and any negative comments.” If breaching the agreement, the patient also had to agree to fine of $250,000, and “in case of a problem, to contact Allure and to allow a response from the business— “with my personal health information.”” 

The second iterations of NDAs were less onerous. It did not prohibit negative reviews. But the patient still had to contact the office and allow for a response by the business, again with the patient’s protected health information. Instead of a $250k fine, the patient agreed to pay actual monetary damages for any losses the business experienced because of the negative review. How that might be calculated is beyond me. Regardless, there was still a potential liability for patients who posted any negative review, regardless of its truth or falsity.  

The most recent NDA iteration restricted and likely prohibited patients from posting negative reviews. There was no financial penalty. 

The District Judge recently ruled.  

Finding no need for oral argument, U.S. District Judge Ricardo S. Martinez granted the State of Washington’s motion for partial summary judgment, finding that “the NDAs at issue clearly include language prohibiting or restricting patients from posting negative reviews.” The judge agreed that the documents at issue were precisely the kind of form contract envisioned by the CRFA—prohibiting or restricting the ability of individuals to engage in a covered communication, void from the inception, and also unlawful for the defendants to offer. “The State argues, and the Court agrees, that they were offered as identical form contracts on a take-it-or-leave-it basis,” Judge Martinez wrote. “It is indisputable that Allure’s pre-service NDAs were used in the course of selling services to patients.” 

The defendants argued that these were not “form contracts” and should not be covered under CRFA. 

Under CRFA, a “form contract,” generally means one with standardized terms that are: 

1. used by a person in the course of selling or leasing goods or services; and
2. imposed on an individual without a meaningful opportunity to negotiate the standardized terms. The statute explicitly states that “form contract” does not include an employer-employee or independent contractor contract.

The defendants argued patients had a meaningful opportunity to modify the terms of the agreements, and some did. Still, the vast majority made no adjustments. The judge concluded these were “form agreements” and within the authority of CRFA enforcement. (In contrast, if a physician and patient negotiate a one-off after-service agreement to have an isolated review modified or taken down, that is not a “form agreement.”) 

Financial penalties will be decided down the road. 

Interestingly, the judge’s decision did not discuss the HIPAA Privacy Rule protecting individuals’ health information. The Office of Inspector General for Health and Human Services may later weigh in on this topic. Regardless, I do not believe it’s a good idea to ask patients to pre-emptively agree to have their private information posted online to settle a debate.  

Broadly, you would be asking for the patient’s authorization to post a response, using their protected health information, if the patient posted online. To do so, you would need to obtain a formal authorization from each patient.  

A valid authorization must meet certain requirements.  45 C.F.R. § 164.508(c)(2); 

45 C.F.R. § 164.508(b)(3) and (c)(4). 

1. Identify the disclosing health care provider,
2. Identify the recipient of the PHI,
3. Label the purpose,
4. Define an expiration date or event,
5. Date, and
6. Signature.
7. The authorization must include certain required statements, indicating that failure to sign the authorization will not affect treatment or payment for treatment, that the patient may revoke the authorization at any time, and that the information may no longer be protected by HIPAA once disclosed pursuant to the authorization. The authorization must be a stand-alone document and the health care provider must provide the patient with a copy of the signed authorization.

Here, the patient might decide to not sign that authorization, and you could not use that decision to avoid treating the patient. So, the savvy patient could just say, no thanks, not going to sign. 

Next, even if the patient does sign, they are free to withdraw their authorization at any time. They could sign the agreement, be treated, then withdraw their authorization, then post a nasty review. And you’d be back where you started. 

Finally, (and back to State of Washington versus Alderwood Surgical Center, et al.) the most important reason is that it could turn into a public relations nightmare. If a patient went to the media with that authorization form, particularly after you used that agreement to release PHI, the media would have a field day. As it is having right now. 

My larger point is that it is easier to use a scalpel compared to a chainsaw to address an isolated problem. There are ways to respond to select negative reviews without revealing PHI. If you release PHI to present your side in an online debate about your care, expect a pile-on.  

The take-home messages: 

Do not use form non-disclosure agreements in advance of providing services to your patients. With the passing of CRFA, since the end of 2016, these agreements have been against the law and unenforceable.  

Next, asking patients for permission to reveal the details of their medical record to respond to online commentary is likely to turn into a PR debacle. Importantly, the patient could just withdraw their authorization, and you’d be silenced. 

There are easier ways to achieve the goal of managing your reputation. Promoting the positive and managing the negative. While being compliant with the current laws. Talk to a representative at Medical Justice about how to do it. 

What do you think?