See how a naturopathic physician's attempt to defend her reputation online resulted in costly board discipline — and what every ND can learn to protect their practice.
Posted in ND Insights Newsletter on Thursday, July 2, 2026
Dr. Maya Bennett is the owner of a single-provider naturopathic medical clinic in the outskirts of Portland, Oregon. Due to the size of the community she serves, Dr. Bennett is highly aware of market factors that influence her practice, including patient expectations and public perception. She has invested significant time, energy, and resources into building her clinic into a trusted and respected part of the local healthcare community.
Dr. Bennett strives to be transparent with patients regarding their treatment plans, clinical decision-making, and overall patient experience. She also encourages satisfied patients to share constructive reviews of her clinic and care on social media platforms and online review sites. Her patients have generally been pleased with their experience, leaving Dr. Bennett with more than 150 positive reviews on a popular review platform. She often responds to reviews by thanking patients for their feedback and sharing a brief overview of the services her clinic offers. She views these interactions as an opportunity to engage with the community and promote her practice without relying heavily on paid advertising; positive reviews often translate into new patient referrals.
Case Analysis
In early 2024, Dr. Bennett noticed several negative reviews posted online, including complaints about clinic staff interactions and criticism of her treatment recommendations.
One particularly critical review alleged that Dr. Bennett recommended an inappropriate treatment plan that delayed the patient's recovery. Frustrated that her clinical judgment and professional qualifications were being challenged publicly, Dr. Bennett decided to respond. In doing so, she posted a screenshot of the patient's chart note from her electronic health record system.
In her response, Dr. Bennett further suggested that the patient had not been truthful with other healthcare providers and implied that the patient sought treatment primarily to support an ongoing disability claim and maintain access to medications "she so clearly depends on."
After several rounds of public exchanges on the review platform, the patient filed a complaint with the state naturopathic medical board regarding Dr. Bennett's conduct and disclosure of protected health information. Dr. Bennett subsequently returned to the review platform and threatened legal action against the patient for filing what she described as "a completely unfounded complaint."
The naturopathic medical board did not agree with Dr. Bennett's assessment. Following a thorough investigation, the board concluded that Dr. Bennett violated both state and federal patient confidentiality protections, publicly embarrassed the patient by posting portions of her medical record and insinuating medication dependency, and engaged in unprofessional conduct by threatening retaliation through litigation.
The Outcome
Ultimately, the board disciplined Dr. Bennett, imposing a $25,000 fine and requiring her to complete 25 hours of continuing education focused on compliance, patient confidentiality, HIPAA, professional ethics, and standards of conduct. The board also issued a formal public reprimand.
Importantly, the board made no findings regarding the clinical appropriateness of Dr. Bennett's treatment decisions or recommendations. The discipline stemmed entirely from her conduct in responding to the online review rather than from any aspect of patient care or medical decision-making.
This suggests that had Dr. Bennett responded differently, the investigation may have concluded without any disciplinary action. Instead, she now has a public reprimand attached to her professional record.
What Can We Learn?
Confirming Patient Status May Violate HIPAA
The primary basis for Dr. Bennett's discipline was her violation of patient confidentiality protections.
HIPAA protects all individually identifiable health information held or transmitted by a healthcare provider in any form. This includes a patient's name, medical condition, and receipt of healthcare services. Even when a reviewer publicly identifies themselves as a patient, a provider generally cannot confirm that individual is or was a patient of the practice. A patient's own disclosure does not authorize the provider to disclose protected information in return.
In Dr. Bennett's case, merely confirming that the reviewer was her patient constituted a violation of patient privacy protections.
Posting a Patient Record Is a Clear HIPAA Violation
Under the HIPAA Privacy Rule, providers may not publicly disclose identifiable patient information, including diagnoses, treatment plans, dates of service, or billing information.
By posting portions of the patient's chart online, Dr. Bennett clearly violated HIPAA protections. Even accidental disclosures of identifiable health information can trigger investigations by regulators and enforcement agencies. Inadvertent violations may sometimes be resolved through corrective action plans or revised privacy policies. Willful violations, however, can result in extensive investigations, audits, and substantial financial penalties, with fines ranging from approximately $14,000 to more than $2 million depending on the circumstances.
Planning Ahead
Consider developing standardized templates for responding to online reviews. Whether feedback is positive or negative, healthcare providers should exercise caution in public responses. For positive reviews, providers may consider a simple response thanking the reviewer for their time and feedback without confirming a patient relationship. Generic responses can still demonstrate appreciation while preserving patient privacy.
For negative reviews, consider using language that acknowledges concerns, explains that privacy laws prevent discussion of individual circumstances, and invites the reviewer to contact the clinic directly to discuss the matter further.
Providers should never disclose treatment details, dates of service, diagnoses, billing information, or ongoing clinical concerns in a public forum.
Providers should also avoid overreacting to negative reviews. Public responses often shape community perception more than the review itself. A single negative review is unlikely to harm a well-established practice or reputation. In Dr. Bennett's case, fewer than 3% of all online reviews were negative. However, an inappropriate response to criticism can have lasting consequences for a provider's license, reputation, and ability to continue serving patients effectively.
About the Author
Joseph A. Pickels is a Senior Associate with Brisbee & Stockton, LLC in Hillsboro, Oregon. He focuses his practice on healthcare and professional liability defense and represents healthcare providers and employers before state and federal courts, administrative and licensing boards, and with OSHA and HIPAA compliance in Oregon and Washington.
Although this case study is based on a real case, names, dates and details have been changed to protect patient and doctor privacy.