By Charles Ornstein, ProPublica

Burned by negative reviews, some health providers are casting their patients’ privacy aside and sharing intimate details online as they try to rebut criticism.

In the course of these arguments — which have spilled out publicly on ratings sites like Yelp — doctors, dentists, chiropractors and massage therapists, among others, have divulged details of patients’ diagnoses, treatments and idiosyncrasies.

One Washington state dentist turned the tables on a patient who blamed him for the loss of a molar: “Due to your clenching and grinding habit, this is not the first molar tooth you have lost due to a fractured root,” he wrote. “This tooth is no different.”

In California, a chiropractor pushed back against a mother’s claims that he misdiagnosed her daughter with scoliosis. “You brought your daughter in for the exam in early March 2014,” he wrote. “The exam identified one or more of the signs I mentioned above for scoliosis. I absolutely recommended an x-ray to determine if this condition existed; this x-ray was at no additional cost to you.”

And a California dentist scolded a patient who accused him of misdiagnosing her. “I looked very closely at your radiographs and it was obvious that you have cavities and gum disease that your other dentist has overlooked. … You can live in a world of denial and simply believe what you want to hear from your other dentist or make an educated and informed decision.”

Health professionals are adapting to a harsh reality in which consumers rate them on sites like Yelp, Vitals and RateMDs much as they do restaurants, hotels and spas. The vast majority of reviews are positive. But in trying to respond to negative ones, some providers appear to be violating the Health Insurance Portability and Accountability Act, the federal patient privacy law known as HIPAA. The law forbids them from disclosing any patient health information without permission.

Yelp has given ProPublica unprecedented access to its trove of public reviews — more than 1.7 million in all — allowing us to search them by keyword. Using a tool developed by the Department of Computer Science and Engineering at the NYU Tandon School of Engineering, we identified more than 3,500 one-star reviews (the lowest) in which patients mention privacy or HIPAA. In dozens of instances, responses to complaints about medical care turned into disputes over patient privacy.

The patients affected say they’ve been doubly injured — first by poor service or care and then by the disclosure of information they considered private.

The shock of exposure can be effective, prompting patients to back off.

“I posted a negative review” on Yelp, a client of a California dentist wrote in 2013. “After that, she posted a response with details that included my personal dental information. … I removed my review to protect my medical privacy.”

The consumer complained to the Office for Civil Rights within the U.S. Department of Health and Human Services, which enforces HIPAA. The office warned the dentist about posting personal information in response to Yelp reviews. It is currently investigating a New York dentist for divulging personal information about a patient who complained about her care, according to a letter reviewed by ProPublica.

The office couldn’t say how many complaints it has received in this area because it doesn’t track complaints this way. ProPublica has previously reported about the agency’s historic inability to analyze its complaints and identify repeat HIPAA violators.

Deven McGraw, the office’s deputy director of health information privacy, said health professionals responding to online reviews can speak generally about the way they treat patients but must have permission to discuss individual cases. Just because patients have rated their health provider publicly doesn’t give their health provider permission to rate them in return.

“If the complaint is about poor patient care, they can come back and say, ‘I provide all of my patients with good patient care’ and ‘I’ve been reviewed in other contexts and have good reviews,’ ” McGraw said. But they can’t “take those accusations on individually by the patient.”

McGraw pointed to a 2013 case out of California in which a hospital was fined $275,000 for disclosing information about a patient to the media without permission, allegedly in retaliation for the patient complaining to the media about the hospital.

Yelp’s senior director of litigation, Aaron Schur, said most reviews of doctors and dentists aren’t about the actual health care delivered but rather their office wait, the front office staff, billing procedures or bedside manner. Many health providers are careful and appropriate in responding to online reviews, encouraging patients to contact them offline or apologizing for any perceived slights. Some don’t respond at all.

“There’s certainly ways to respond to reviews that don’t implicate HIPAA,” Schur said.

In 2012, University of Utah Health Care in Salt Lake City was the first hospital system in the country to post patient reviews and comments online. The system, which had to overcome doctors’ resistance to being rated, found positive comments far outnumbered negative ones.

“If you whitewash comments, if you only put those that are highly positive, the public is very savvy and will consider that to be only advertising,” said Thomas Miller, chief medical officer for the University of Utah Hospitals and Clinics.

Unlike Yelp, the University of Utah does not allow comments about a doctor’s medical competency and it does not allow physicians to respond to comments.

In discussing their battles over online reviews, patients said they’d turned to ratings sites for closure and in the hope that their experiences would help others seeking care. Their providers’ responses, however, left them with a lingering sense of lost trust.

Angela Grijalva brought her then 12-year-old daughter to Maximize Chiropractic in Sacramento, Calif., a couple years ago for an exam. In a one-star review on Yelp, Grijalva alleged that chiropractor Tim Nicholl led her daughter to “believe she had scoliosis and urgently needed x-rays, which could be performed at her next appointment. … My daughter cried all night and had a tough time concentrating at school.”

But it turned out her daughter did not have scoliosis, Grijalva wrote. She encouraged parents to stay away from the office.

Nicholl replied on Yelp, acknowledging that Grijalva’s daughter was a patient (a disclosure that is not allowed under HIPAA) and discussing the procedures he performed on her and her condition, though he said he could not disclose specifics of the diagnosis “due to privacy and patient confidentiality.”

“The next day you brought your daughter back in for a verbal review of the x-rays and I informed you that the x-rays had identified some issues, but the good news was that your daughter did not have scoliosis, great news!” he recounted. “I proceeded to adjust your daughter and the adjustment went very well, as did the entire appointment; you made no mention of a ‘misdiagnosis’ or any other concern.”

In an interview, Grijalva said Nicholl’s response “violated my daughter and her privacy.”

“I wouldn’t want another parent, another child to go through what my daughter went through: the panic, the stress, the fear,” she added.

Nicholl declined a request for comment. “It just doesn’t seem like this is worth my time,” he said. His practice has mixed reviews on Yelp, but more positive than negative.

A few years ago, Marisa Speed posted a review of North Valley Plastic Surgery in Phoenix after her then–3-year-old son received stitches there for a gash on his chin. “Half-way through the procedure, the doctor seemed flustered with my crying child. …,” she wrote. “At this point the doctor was more upset and he ended up throwing the instruments to the floor. I understand that dealing with kids requires extra effort, but if you don’t like to do it, don’t even welcome them.”

An employee named Chase replied on the business’s behalf: “This patient presented in an agitated and uncontrollable state. Despite our best efforts, this patient was screaming, crying, inconsolable, and a danger to both himself and to our staff. As any parent that has raised a young boy knows, they have the strength to cause harm.”

Speed and her husband complained to the Office for Civil Rights. “You may wish to remove any specific information about current or former patients from your Web-blog,” the Office for Civil Rights wrote in an October 2013 letter to the surgery center.

In an email, a representative of the surgery center declined to comment. “Everyone that was directly involved in the incident no longer works here. The nurse on this case left a year ago, the surgeon in the case retired last month, and the administrator left a few years ago,” he wrote.

Reviews of North Valley Plastic Surgery are mixed on Yelp.

Health providers have tried a host of ways to try to combat negative reviews. Some have sued their patients, attracting a torrent of attention but scoring few, if any, legal successes. Others have begged patients to remove their complaints.

Jeffrey Segal, a onetime critic of review sites, now says doctors need to embrace them. Beginning in 2007, Segal’s company, Medical Justice, crafted contracts that health providers could give to patients asking them to sign over the copyright to any reviews, which allowed providers to demand that negative ones be removed. But after a lawsuit, Medical Justice stopped recommending the contracts in 2011.

Segal said he has come to believe reviews are valuable and that providers should encourage patients who are satisfied to post positive reviews and should respond — carefully — to negative ones.

“For doctors who get bent out of shape to get rid of negative reviews, it’s a denominator problem,” he said. “If they only have three reviews and two are negative, the denominator is the problem. … If you can figure out a way to cultivate reviews from hundreds of patients rather than a few patients, the problem is solved.”

ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for their newsletter.