As complaints and reviews increasingly move from behind-closed-doors to public fodder on the internet and social media, we asked Minter Ellison to give some advice on what providers need to know.
These types of review websites raise legal issues for both the service provider and the website operator. In particular privacy and confidentiality, defamation, consumer laws and for healthcare providers, the National Law.
It is the responsibility of the website operator in operating the website and publishing content on the website to manage these legal risks and comply with the requirements of these laws particularly the websites that make this content available to the world at large.
The reviews may be of the provider organisation or agency and/or the individual healthcare provider. Some websites focus on the provider organisation and others on the individual healthcare provider.
Websites can collect and publish non-confidential factual information about organisations such as their address, location, contact details, which is not protected by copyright protection.
Privacy
To the extent website collects personal information about individual healthcare providers and personal and health information about consumers, the website operator will need to comply with applicable privacy laws including the Privacy Act 1988 (Cth) and State and Territory based health records laws when collecting, using and disclosing personal information.
Websites can collect individual provider’s personal information that is publically available for the purposes of including it on the website to set up a pre-populated profile with basic practice details about the provider. It is therefore difficult for individual providers to object to or prevent this collection. However websites must comply with the collection notice obligations in Australian Privacy Principle 3 of the Privacy Act which requires them to take reasonable steps to notify providers of the collection and of certain matters such as the circumstances and purposes of collection.
Websites may have a policy of trying to seek the providers’ consent as far as possible for their information to be used and disclosed on the website and for reviews about them to be published.
There may be particular personal reasons why a provider would not want their practice details published and they should take this up with the website. Most websites will offer providers the ability to ‘own’ their profile and register to update and manage its details, but providers are not required to do so. However this should not be an issue for organisations.
Provider reviews
The nature and potential impact of provider reviews will depend on the rating review categories the website offers, the extent to which they permit free text comments and the extent to which they moderate the review/comments.
Some may be based simply on a satisfaction rating of eg 1 to 5 and others may have a range of review questions and permit more detailed comments.
Websites which permit patients to disclose personal sensitive information about themselves and provide opinions about medical procedures or may permit anonymous reviews.
However, usually users are required to register to post reviews and provide their personal details. This can help to minimise the risk of individuals posting unconsidered reviews under the protection of anonymity.
Websites should ensure that the reviews they publish are not false and defamatory of the individual providers. Organisations with 10 or more full time employees cannot sue for defamation but smaller service providers could. Also, an individual employee or someone connected with an organisation could sue for defamation if that person is sufficiently identifiable in a review.
In addition the content and reviews on the website must not be misleading and deceptive for consumers. Websites should also consider the National Law requirements on advertising taking into account the Medical Board of Australia’s ‘Guidelines for advertising of regulated health services’, in relation to consumer comments regarding individual providers (whether negative or positive) particularly if comments are of a clinical nature and about clinical ability.
Rules for consumers about what they can and can’t post, a moderation policy and procedure will help to manage these legal risks.
A well-managed website will also make it clear the nature and purpose of the content and include appropriate disclaimers so users are clear about what the nature and purpose of the content and what the website does and does not do.
The website should have a policy for assessing objections from providers about content and complaints management procedure and that providers can follow if they think that a review is defamatory or misleading or breaches client privacy of confidentiality.
Websites may have a policy of choosing not to publish certain aspects of reviews before giving the provider an opportunity to respond.
Providers can certainly respond to feedback on the site from consumers but need to take care that they do not disclose any information that could breach a client confidentiality and privacy.
If a client has chosen to disclose particularly sensitive information, providers should not treat this as their consent to then disclose other information via the website. They should maintain client privacy and confidentiality and instead consider inviting the client to contact them direct to resolve their concerns.
It is also an opportunity for providers to consider their own complaints resolution process and what opportunity clients have for raising their concerns direct – a lot of the time clients resorts to these websites if they have found they cannot adequately raise their concerns direct with the service provider.
Given the nature of health services in the areas of disability, aged care and mental health and the clients, the provider’s clients’ needs are likely to be more complex and not always easy to resolve through a public website interaction.
On the other hand, client concerns do not always relate to the health ore medical aspect of care but other service issues and the reviews do offer an opportunity for providers to understand and respond directly to these concerns about their services.
Defamation cases
There are certainly examples of defamation proceedings being brought by individuals and small businesses who can sue for defamation in relation to reviews on websites or other types of reviews. These include:
- A case of a scathing restaurant review published by Fairfax Media in 2003 that was held to be defamatory of the restaurant operators. The case was appealed all the way to the NSW Court of Appeal where, over 12 years after the review, the restaurant operators were awarded damages of just under $200,000 for the three plaintiffs;
- A Melbourne dentist who has recently (January 2017) issued defamation proceedings against a member of the public for a negative review posted on the Google Review service. The review suggested that the dentist was greedy and unprofessional. This case is obviously yet to be determined; and
- A Melbourne plastic surgeon who sued a member of the public for a comment on a positive review that suggested that the positive review had been posted by one of the plastic surgeon’s staff rather than a satisfied customer. This case settled out of court.
Content on these websites is no different to user generated content on many other websites including social media platforms, where defamation cases often arise. The legal issues are the same in relation to defamation.
Any content about an identifiable individual or small business that is published to a third party (ie it can be downloaded and read) and which includes words or images or a combination, which convey defamatory meanings to the ordinary reasonable reader that damage the reputation of the individual or small business will be grounds for a defamation claim.
The provider could choose to sue the website operator and/or the customer who wrote the review.
The website operator is taken to be a publisher of the information and should give careful attention when put on notice of a complaint.
The usual defences that would be available are truth or fair comment/honest opinion.
The website’s rules and terms of use will provide for what recourse the website has against the user if they post false reviews.
What providers should consider before engaging online with clients
Before engaging with clients through any of these websites, providers should consider the nature of the website, who its operator is (are they local or overseas, known to the provider, reputable), what rules and policies and procedures the website has for managing reviews and engaging providers and monitor their activity and whether customer can publish anonymously or must be registered/are identifiable.
Providers should also consider what their policy should be for responding to consumers reviews and how far they will engage with them on the site. They should consider involving their legal and communications/corporate affairs team on the issue.
There is no legal impediment to the website in providing such a mechanism taking into account the legal risks discussed above.
The real issue is for providers who could be in breach of their legal, professional and ethical obligations to their clients in rating them in any way, particularly for clients with mental health and disability issues or in aged care.
It would undermine the trust and confidentiality the providers owe their clients and the ability of providers to provide the necessary care to them. It also then exposes the providers to the risk of defamation and misleading and deceptive conduct.
The legal entity operating the website will generally have the same legal and compliance obligations identified above whether they are private sector or government.
There are also likely to be additional considerations for the government in relation to legal risks such as privacy as well as government and policy considerations.
Written by Veronica Scott, Special Counsel at Minter Ellison
