Defamation in healthcare is a false statement of fact about a provider, practice, or patient that gets communicated to someone else and causes real reputational or financial harm. It is not a bad review, not a frustrated opinion, and not a disagreement about care. It is a verifiable factual claim that turns out to be untrue, and because medical careers and medical practices live or die on trust, the stakes are unusually high on both sides of the exam room.
The Four Elements You Have to Prove
Every defamation claim, in healthcare or anywhere else, rests on the same four building blocks.
The statement must be a false assertion of fact rather than an opinion. “I didn’t like my experience at the clinic” is opinion and protected. “The clinic billed me for procedures that were never performed” is a factual claim that can be checked. Courts ask whether a reasonable person would read the statement as conveying a concrete fact or merely a subjective view.
The statement must have been communicated to at least one person other than the subject. Lawyers call this publication, but it does not require a newspaper. A remark to a colleague in the break room, a social media post, or a review on a medical rating site all qualify. A statement made privately to the person it is about, with no one else around, does not.
The speaker must have been at fault. For private individuals, which includes most doctors and nurses, that usually means negligence: the speaker failed to take reasonable steps to verify the claim before making it. Public figures carry a heavier burden. Under New York Times Co. v. Sullivan, a public figure has to show actual malice, meaning the speaker knew the statement was false or acted with reckless disregard for its truth.1Justia Law. New York Times Co. v. Sullivan, 376 U.S. 254 (1964) A hospital CEO or a physician with a regular television presence may be classified as a public figure; the typical practitioner is not.
The false statement must have caused actual harm. For a provider, that often shows up as canceled appointments, dried-up referrals, or a measurable revenue drop after the statement spread. Tying the loss to the statement is frequently the hardest part of the case.
When the Law Presumes Damages: Defamation Per Se
Some false statements are treated as so inherently damaging that the law presumes harm without requiring proof of specific financial loss. This category, defamation per se, matters a great deal to healthcare professionals because one of its traditional branches covers false statements about a person’s fitness to perform their job or profession. Falsely claiming a surgeon operates while impaired fits directly within it.
The other recognized branches include falsely accusing someone of a crime, falsely stating someone has a contagious or stigmatized disease, and falsely accusing someone of sexual misconduct. A false claim that a nurse carries a dangerous infectious disease could qualify under both the professional unfitness and disease branches. Where defamation per se applies, the plaintiff can recover presumed damages without documenting exact losses.
The statement still has to be a verifiable factual assertion. Calling a doctor “unprofessional” is too vague to qualify. Claiming a doctor “falsified patient records” is specific, checkable, and fits within professional unfitness.
Who Sues, and Who Gets Sued
Providers themselves are the most common plaintiffs: physicians, dentists, nurses, and therapists whose standing has been injured by false statements. Organizations can sue as well. A hospital, clinic, or group practice has a reputation of its own, and false claims about billing, safety, or sanitation can injure that institutional reputation in ways that cost real money.
Defendants span a wider range. Patients who post fabricated claims online are the obvious group, but other healthcare professionals turn up frequently as defendants. A physician who spreads false rumors about a competitor’s qualifications, a former colleague who publicly accuses a provider of incompetence without basis, or a former employee who makes false public statements about a practice’s operations can all face a claim.
Patients can be plaintiffs too. If a provider falsely tells a third party that a patient has a condition the patient does not actually have, the patient may have grounds to sue. Those cases often overlap with privacy violations, which is where HIPAA enters the picture.
When the Employer Is on the Hook
A hospital or practice can sometimes be held responsible for an employee’s defamatory statement under vicarious liability. The question is whether the employee was acting within the scope of their job. A charge nurse who falsely tells a patient’s family about a diagnosis during a care discussion is acting within scope. A staff member gossiping about a patient in the parking lot is not, and the employer has a strong argument against liability. Courts look for a clear tie between the employee’s workplace responsibilities and the defamatory act.
Online Reviews: Where Most Modern Cases Live
Review platforms and social media have become the main arena for healthcare defamation disputes. A single false review can sit at the top of search results for years. Opinion-based criticism such as “the wait times are terrible” or “the doctor seemed rushed” is protected. When a review crosses into false facts, such as “Dr. Jones performed surgery on me while intoxicated” or “this clinic uses expired medications,” it becomes potentially actionable as libel. The permanence of online content amplifies the injury far beyond what a spoken rumor could do, and litigation itself can draw more attention to the false statement, which complicates the decision to sue.
The Platform Is Almost Always Immune
Under Section 230 of the Communications Decency Act, no provider of an interactive computer service can be treated as the publisher of content posted by a user.2Office of the Law Revision Counsel. 47 U.S. Code 230 – Protection for Private Blocking and Screening of Offensive Material Google, Yelp, Healthgrades, and Facebook are not legally responsible for user-posted reviews, even after being told a review is false. A lawsuit has to target the person who wrote the review. When the review is anonymous, the provider may need to file a John Doe lawsuit and subpoena the platform to unmask the author before the case can go forward. Some platforms will remove reviews that violate their own terms of service, but they have no legal obligation to do so.
Anti-SLAPP Statutes Cut Both Ways
More than 30 states have enacted anti-SLAPP statutes, which give defendants a fast-track procedure to dismiss meritless defamation claims early, before expensive discovery. SLAPP stands for Strategic Lawsuit Against Public Participation. If the defendant wins the motion, the plaintiff typically pays the defendant’s attorney fees and court costs. For providers thinking about suing a patient over a review, that creates a real risk: a weak case can end with the provider paying the patient’s legal bills. The same statutes work in a provider’s favor when the provider is the one being sued, say by a competitor, and can seek early dismissal.
Non-Disparagement Clauses Do Not Work
Some practices have tried to prevent negative reviews by having patients sign agreements promising not to post critical commentary. Federal law voids these clauses. The Consumer Review Fairness Act makes unenforceable any provision in a standard-form contract that restricts a person’s ability to post reviews, imposes penalties for posting them, or demands transfer of intellectual property rights in the review.3Office of the Law Revision Counsel. 15 USC 45b – Consumer Review Protection The statute reaches essentially every patient intake agreement, because those are form contracts imposed without meaningful negotiation. Offering a contract with such a clause is itself unlawful, and trying to enforce one invites regulatory scrutiny and public backlash that will damage the practice’s reputation far more than the review would have.
Where HIPAA Collides with Defamation
HIPAA protects the privacy of a patient’s health information. Defamation law protects reputation.4U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule They are separate frameworks, but they intersect when a provider improperly discloses information about a patient and that information is also false and damaging. A nurse who tells a patient’s coworker the patient is being treated for a psychiatric condition the patient does not have has both breached HIPAA and defamed the patient.
Patients cannot personally sue under HIPAA for money. Enforcement runs through the HHS Office for Civil Rights, which can impose civil monetary penalties.5U.S. Department of Health and Human Services. HIPAA Compliance and Enforcement A patient can file an OCR complaint and separately bring a civil defamation lawsuit for the reputational harm.6U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint
Responding to a Review Without Breaking HIPAA
This is where providers most often get themselves into trouble. The urge to answer a bad review with specifics, context, and corrections can be catastrophic. HIPAA bars disclosure of protected health information, and that protection reaches information as basic as confirming whether someone is or was a patient. A patient who talks about their care publicly does not waive their privacy rights or free the provider from HIPAA obligations.
OCR has fined providers for disclosing patient details while responding to online reviews. One dental practice paid a $50,000 penalty after sharing details about a patient interaction in a Google review response. Another provider paid $10,000 and agreed to a corrective action plan after repeatedly disclosing patient information on its review page.
The safe response is generic. A provider can describe general policies and standards of care without confirming or denying that the reviewer is a patient. “Our practice is committed to providing quality care and takes all feedback seriously” is fine. “That is not what happened during your visit on March 3rd” is not. When in doubt, run the response past a privacy officer or attorney before posting.
Peer Review Immunity
Hospitals and medical organizations routinely conduct peer review to evaluate physician competence, and those proceedings involve statements about skill, judgment, and conduct that would look defamatory in almost any other setting. The Health Care Quality Improvement Act provides immunity from damages for participants in peer review, provided the review meets specific standards.7Office of the Law Revision Counsel. 42 USC 11111 – Professional Review
To qualify, the review has to be conducted with a reasonable belief that it furthered quality healthcare, after reasonable efforts to gather the facts, with adequate notice and a fair hearing for the physician, and with a reasonable belief that the action was warranted by what was found. Immunity extends to the review body, its members and staff, people under contract with it, and anyone who assists in the review.
The protection has limits. A peer review driven by personal vendetta, economic competition, or internal politics rather than genuine quality concerns falls outside the statute. Immunity also does not cover anyone who provides information they know to be false. Peer review proceedings are generally shielded from discovery in civil litigation, so a physician targeted by a negative review action usually cannot use peer review testimony or records as evidence in a defamation suit against the reviewers.
Defenses the Other Side Will Raise
Truth is the strongest defense. If the statement is substantially true, the claim fails regardless of the damage. The plaintiff bears the burden of proving falsity, so a patient who posts that a provider charged for services never rendered has a complete defense if the billing records back the claim.
Opinion is close behind. Courts separate verifiable factual claims from subjective judgments. “Dr. Smith is the worst doctor I have ever seen” is opinion. “Dr. Smith misdiagnosed me on purpose” is a factual assertion. The dividing line is not always obvious, and courts look at the full context, including where the statement appeared and how a reasonable reader would take it.
Qualified privilege protects certain good-faith communications made for a legitimate purpose. In healthcare, this matters for provider-to-provider discussions about patient care, mandatory reports to licensing boards or public health authorities, and communications within the chain of care. A physician who reports a colleague’s suspected impairment to a licensing board is generally protected even if the report turns out to be unfounded, as long as it was made in good faith and without malice. The privilege can be lost if the speaker acts with malice or spreads the information more widely than necessary.
How Long You Have to File
Defamation statutes of limitations vary by state, but most require filing within one to two years. The deadlines are enforced strictly; miss the window and the claim is gone no matter how clearly defamatory the statement was.
For online content, most courts apply the single publication rule: the clock runs from the date the statement was first posted, not from each new reader. A defamatory review posted in January 2024 that a provider does not discover until December 2025 may already be at the edge of the deadline in a one-year state. Some states allow tolling when the plaintiff could not reasonably have discovered the statement sooner, but the rules vary.
Providers who find a potentially defamatory statement should consult an attorney quickly. A common first step is a demand letter asking for retraction and removal. In many cases that resolves things without litigation. If it does not, the letter puts the speaker on notice that the statement is false, which can strengthen the case if a lawsuit becomes necessary.