Refund me now or I flood you with one-stars, the extortion message read
This account was submitted by a healthcare provider and de-identified before publication. Details that could identify a patient or practice have been removed, and it is shared with the provider’s consent.
A vague one-star review landed, and with it a message demanding an immediate refund and my records, or else a flood of one-star reviews would follow. The message was explicit, refund me now or I flood you with one-stars and tell everyone about your files. It gestured at protected details to suggest the sender had ammunition. The single posted review was the opening move in a promised campaign. After thirty years, I had never faced anything so nakedly coercive. It was extortion tied directly to patient information. The blend of refund demand and records threat made it especially insidious.
I cannot confirm this person's patient status or discuss any records, because HIPAA strictly forbids it. My records-release and refund processes are lawful and cannot be overridden by a threat. I cannot respond publicly with any specifics without disclosing protected information myself. Even explaining my refusal would mean engaging PHI in the open. The extortion depends on my legal obligation to remain silent. I cannot set the record straight or justify my decisions publicly. My compliance with the law becomes the sender's leverage against me.
Facing a coercive threat this late in my career made me question how I would leave the profession. The promised wave of reviews loomed over me, and I felt the anxiety in my chest daily. I worried that a lifetime of careful work could be undone by a blackmailer I could not identify. The stress affected my sleep, my mood, and my sense of security about retirement. I even weighed whether to close earlier than planned to escape the exposure. Being extorted through patient records felt like a betrayal of the trust my whole career was built on. It cast a shadow over what should have been a proud final chapter.
I refused the refund demand and did not release records outside my compliant, verified process. I saved the review and messages and reported the extortion to Google and to law enforcement on legal advice. Google removed the review after I flagged the explicit threat, though not immediately. My attorney confirmed the conduct was likely criminal extortion but noted the practical hurdles of anonymity. I reinforced my records and refund procedures to ensure full compliance. I briefed my longtime staff so they would not be caught off guard. I held my ground and refused to pay.