Online reviews, it often seems, comprise half the Internet’s original content. The other half is cat pictures of course. While the cats are darling, online reviews can be ugly, marred by vitriol, fraud, and ignorance. Rarely at issue in online reviews is whether or not the reviewer has included his or her name and detailed experience with the subject of the review.

For the free electronic health records system company Practice Fusion however, names and details included in online doctor reviews have created a dust-up over privacy that has likely given CEO Ryan Howard a headache he won’t soon forget.

Practice Fusion has solicited patient reviews since 2012. When doctors allow the company to email patients about their treatment experiences, the patients often respond with honesty, openness, and full names, extolling the virtues of a remedy or pleasant manner. Were personal health data not such a touchy subject under federal law, such reviews would be considered the best possible response. Accordingly, reviews posted on the web site of Practice Fusion’s doctor finder service are anonymized. But a handful include patients’ first and last names in the body of the review, with a few even referring to specific medical conditions as well, according to a recent review by Forbes.

The leakage of identifying information and the manner in which it was collected, through patient response to emails sent by Practice Fusion on behalf of doctors, has earned the company a stinging rebuke from doctors and privacy watchers. Forbes columnist Kashmir Hill brought the problem to broad attention, writing that “according to experts, it may have violated the grand poobah of medical privacy laws — HIPAA — potentially getting both the doctors and Practice Fusion — as a ‘business associate’ — into trouble.”

One person commenting on the patient feedback system in Practice Fusion’s online customer service forum wrote that the company “obviously thought of doctor’s offices more like a restaurant or retail store than the rather unique provider of personal health care and protector of personal data,” adding that, “It was a poorly executed plan for patient feedback, but well intentioned, I believe.”

The feedback system was launched in 2012 as a way to give doctors and other healthcare pros using the service a way to get feedback from patients about their treatment experiences. Providers found the responses helpful and patients valued the opportunity to provide feedback, leading the company to launch Patient Fusion to allow patients to find doctors and book appointments online.

Howard admits that since Patient Fusion launched, his company did find some surveys posted online where patients “mistakenly” entered their personal information. The company removed those posts immediately, he wrote in a blog post addressing the issue, and it plans to take steps to prevent patients from accidentally entering such personal information in the first place.

But no matter what Practice Fusion does to police reviews submitted by patients for over-sharing, I expect they’ll be fighting an uphill battle. Most people have acclimated to sharing their most personal experiences and intentions online, feeding such data daily into sites such as Facebook and Google, services that have against all logic built trusting relationships with millions by providing true utility.

I expect Practice Fusion aspires to build just as deep and trusting a relationship with its doctors and patients as Facebook and Google have built with their customers. As it digitally collects more and more of the data once locked in paper records, it is likely that it too will have to redouble its efforts to make sure that people understand how the information they share with the company will be used. The latest controversy seems to be a misstep on that journey, but not catastrophic.

The company deftly walks a fine line, collecting monetizable insights from the personal prescription and treatment data doctors feed into its electronic health records management system. But there will always be a sizeable number of patients and doctors using its services who don’t really understand what’s going on—that their actions and words are at the heart of the product. Those people will need extra education, extra outreach, and, it appears, a better advocate for their interests in Practice Fusion’s ranks.