[ballenf]

You can explain just that in the response and not much more.

Even if the patient reveals PHI you should avoid confirming or acknowledging it as the "covered entity" under HIPAA. A confirmation of a diagnosis is different than a person discussing symptoms. I would argue that you probably should avoid even acknowledging that the person is a patient or has been seen in the office. The approach will reinforce to others how seriously you take privacy and you can taut your customer service policies, etc.

I wouldn't call this unfair since all providers are in the same situation.

(This isn't legal advice, obviously.)

[SilasX]

It's not unfair in the sense of "advantage over competitors", but it definitely seems unfair in the sense of "not being allowed to publicly refute public allegations against you".