Platform removal is not a HIPAA rule
Platform removal rules. Review sites are generally protected from liability for what users post (Section 230), and they decide removals under their own content policies. Separately, the Consumer Review Fairness Act preserves a business's right to remove, from its own website, content that contains another person's personal information, is unlawful or abusive, unrelated, or clearly false. It gives a practice no power over third-party review sites. [F-034, F-032]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Federal rules this research read
F-032. 15 U.S.C. 45b
Consumer Review Fairness Act: a provision of a form contract is void if it prohibits or restricts an individual's ability to post a review, imposes a penalty or fee for doing so, or takes the reviewer's intellectual property in the review (other than a non-exclusive license). It does not affect legal duties of confidentiality, defamation claims, or a business's right to remove from its own website content that contains another person's personal information, is unlawful or abusive, unrelated, or clearly false. The FTC and state attorneys general enforce it.
Research caveat: Med spa pass, final phase part 2 (2026-10-22). Read on GovInfo U.S. Code (2024 ed.) (V-071). Bars patient 'gag clauses' in form contracts; does not authorize removal of reviews on third-party platforms.
F-033. 16 CFR 465.7; 465.4 (89 FR 68034, Aug. 22, 2024)
FTC Consumer Reviews and Testimonials Rule: it is unlawful (a) to use an unfounded or groundless legal threat, a physical threat, intimidation, or a knowingly or recklessly false public accusation in an attempt to prevent a review or have one removed, and (b) for a business to misrepresent that the reviews it displays represent most or all reviews while suppressing reviews because of rating or negative sentiment (neutral content criteria are allowed). The rule also bars buying reviews conditioned on positive or negative sentiment.
Research caveat: Med spa pass, final phase part 2 (2026-10-22). Read on eCFR (V-072). Civil penalties attach to knowing violations of trade regulation rules; amounts not stated here.
F-034. 47 U.S.C. 230(c)(1)-(2)
Section 230: no provider or user of an interactive computer service may be treated as the publisher or speaker of information provided by another information content provider, and platforms are protected for good-faith moderation decisions. Review sites generally decide removal under their own policies; they are generally not liable for patients' reviews.
Research caveat: Med spa pass, final phase part 2 (2026-10-22). Read on GovInfo (V-073). Exceptions in 230(e) (federal criminal law, IP, etc.) not analyzed. Statements about platform policies are inference, not law.
Frequently asked questions
- Can a practice sue or use HIPAA to make a patient delete a negative review?
- HIPAA does not restrict what patients say about their own care, and using groundless legal threats or intimidation to get a review removed is unlawful under the FTC's reviews rule. Defamation claims remain possible in principle, but this guide does not assess them. [F-033, F-007, F-032]
Related pages
States
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
Topics
Healthcare industry
Sources
F-034. 47 U.S.C. 230(c)(1)-(2)
Section 230: no provider or user of an interactive computer service may be treated as the publisher or speaker of information provided by another information content provider, and platforms are protected for good-faith moderation decisions. Review sites generally decide removal under their own policies; they are generally not liable for patients' reviews.
Statute · Explicit (text); 'generally decide under their own policies' is an inference · High · Med spa pass, final phase part 2 (2026-10-22). Read on GovInfo (V-073). Exceptions in 230(e) (federal criminal law, IP, etc.) not analyzed. Statements about platform policies are inference, not law.
https://www.govinfo.gov/link/uscode/47/230?type=usc&year=mostrecent&link-type=html
F-032. 15 U.S.C. 45b
Consumer Review Fairness Act: a provision of a form contract is void if it prohibits or restricts an individual's ability to post a review, imposes a penalty or fee for doing so, or takes the reviewer's intellectual property in the review (other than a non-exclusive license). It does not affect legal duties of confidentiality, defamation claims, or a business's right to remove from its own website content that contains another person's personal information, is unlawful or abusive, unrelated, or clearly false. The FTC and state attorneys general enforce it.
Statute · Explicit · High · Med spa pass, final phase part 2 (2026-10-22). Read on GovInfo U.S. Code (2024 ed.) (V-071). Bars patient 'gag clauses' in form contracts; does not authorize removal of reviews on third-party platforms.
https://www.govinfo.gov/link/uscode/15/45b?type=usc&year=mostrecent&link-type=html
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
V-071. V-071
This reference id is cited in the publication and is not a row in the claim register supplied with it.
F-033. 16 CFR 465.7; 465.4 (89 FR 68034, Aug. 22, 2024)
FTC Consumer Reviews and Testimonials Rule: it is unlawful (a) to use an unfounded or groundless legal threat, a physical threat, intimidation, or a knowingly or recklessly false public accusation in an attempt to prevent a review or have one removed, and (b) for a business to misrepresent that the reviews it displays represent most or all reviews while suppressing reviews because of rating or negative sentiment (neutral content criteria are allowed). The rule also bars buying reviews conditioned on positive or negative sentiment.
Regulation · Explicit · High · Med spa pass, final phase part 2 (2026-10-22). Read on eCFR (V-072). Civil penalties attach to knowing violations of trade regulation rules; amounts not stated here.
https://www.ecfr.gov/current/title-16/chapter-I/subchapter-D/part-465
V-072. V-072
This reference id is cited in the publication and is not a row in the claim register supplied with it.
V-073. V-073
This reference id is cited in the publication and is not a row in the claim register supplied with it.