A reviewer threatened worse ratings unless I handed over records and a refund

A one-star review appeared, and alongside it came a message stating that unless I released a full copy of records and issued a refund, more one-star reviews would follow. The message was explicit that my rating would be destroyed if I did not comply. It tied the demand directly to the threat, pay or I ruin you online. The review already posted was vague, clearly a preview of what was promised. It felt like a hostage situation with my reputation as the hostage. The demand for records made it especially fraught, since those are protected. The whole thing was extortion built around PHI.

I cannot discuss whether this person is a patient or what any records might contain, because HIPAA forbids it. I have strict, lawful procedures for releasing records to a verified patient, and those cannot be shortcut by a threat. I cannot confirm publicly that a request was or was not properly made, nor can I explain the situation's specifics. Even acknowledging the interaction risks disclosing protected information. The extortion works by weaponizing my legal obligations against me. I cannot hand over records improperly, and I cannot explain publicly why I am refusing. My compliance with the law is being used as leverage.

The threat of a coordinated rating attack hung over me for weeks, and I felt it constantly. Knowing that refusing to break the law could cost me my online standing was a bitter position. I consulted an attorney and spent time and money preparing for a threat that might or might not materialize. The anxiety disrupted my sleep and my concentration during patient care. I worried that legitimate records requests would now make me flinch. The sense of being coerced through my own professional duties was uniquely stressful. It shook my confidence in the fairness of the whole system.

I refused to release anything outside my normal, verified records process. I preserved the review and the threatening messages as documentation. I reported the extortion attempt to Google and, on my attorney's advice, to law enforcement. Google removed the review only after I flagged it as an explicit threat, and even that took time. My attorney confirmed the demand was likely criminal extortion but noted the difficulty of identifying the sender. I made sure my records-request procedures were airtight and compliant. I did not give in to the demand.