How to Respond to Patient Reviews Without Violating HIPAA

A practice can respond to patient reviews, but it must not reveal anything about the reviewer as a patient, including the fact that they are one. That holds even when the reviewer has already described their own treatment in public. The patient may share their information. The practice may not confirm or add to it without authorization.

This article is general information, not legal advice. Ask your own counsel about your specific situation.

In this article

• Why this matters: a real enforcement case
• What you cannot include
• What you can say
• Templates
• A simple internal process
• Can a patient give permission?
• Should you respond to patient reviews at all?
• Risky wording and safer alternatives
• More templates for common situations
• Five checks before you post
• What to do away from the screen
• Reporting reviews that break the rules
• Who should reply
• An illustrative example
• Reviews on other platforms and on social media
• Frequently asked questions
• A short written policy for the practice
• Common misunderstandings
• Why a careful reply is also good marketing

Why this matters: a real enforcement case

In December 2022 the HHS Office for Civil Rights announced a settlement with a California dental practice over its responses to reviews on Yelp. According to reporting on the case, the replies named patients who had posted under a nickname and shared details of their visits, treatment and insurance. The practice paid $23,000 and agreed to a corrective action plan with two years of monitoring.

The replies were written to defend the practice. That instinct is exactly what creates the risk.

What you cannot include

• Confirmation that the person is or was a patient
• Dates or details of appointments
• Diagnosis, treatment, appliances or progress
• Billing, insurance or payment information
• The patient’s name, if they did not use it publicly
• Anything about a child’s care in response to a parent’s review

What you can say

• General thanks for feedback
• General statements about your practice’s policies or standards
• An invitation to contact the office directly

Templates

Positive review

“Thank you for taking the time to share this. Kind words like these mean a great deal to our whole team.”

Negative review

“Thank you for your feedback. We take concerns seriously and would like to understand more. Please call our office and ask for the practice manager so we can talk directly.”

Review that contains inaccuracies

“We are unable to discuss any individual’s situation in a public forum. Our policy is to explain all fees and treatment options in writing before treatment begins. We would welcome the chance to speak with you directly.”

Notice that none of these confirm a visit, and the third corrects the record only by describing general policy.

A simple internal process

1. One named person drafts replies.
2. A second person checks each reply against the list above before it is posted.
3. Negative reviews wait at least a day before a reply is sent.
4. The real conversation happens by phone, not in public.
5. Reviews that break the platform’s rules are reported through the platform.

Can a patient give permission?

A valid written HIPAA authorization can permit specific disclosures. A patient posting publicly is not the same thing. In practice, a general reply is almost always the better choice.

Should you respond to patient reviews at all?

Yes. Google notes that replying to reviews shows you value feedback. Prospective patients read how a practice handles criticism as closely as the criticism itself.

We draft and check review replies as part of orthodontic reputation management. For earning reviews in the first place, see how to get more Google reviews.

Risky wording and safer alternatives

The instinct to explain is what causes trouble. The table shows how an ordinary reply can reveal protected information, and what to write instead.

Tempting reply	Why it is a problem	Safer alternative
“We are sorry your appointment on Tuesday ran late.”	Confirms the person is a patient and gives a visit date	“We aim to see everyone on time, and we take feedback about waiting seriously.”
“Your son’s braces were fitted exactly as planned.”	Confirms a child’s treatment	“We are unable to discuss any individual’s care here. Please call us so we can talk directly.”
“Our records show your insurance was explained at your consultation.”	Reveals billing and insurance details	“Our policy is to explain all fees and insurance in writing before treatment begins.”
“Thank you. It was a pleasure treating you.”	Confirms a treatment relationship	“Thank you for taking the time to share this.”
“We have no record of you as a patient.”	A statement about patient status, either way	“We would like to understand more. Please contact our office.”

The safer versions share three features: they speak about the practice in general, they reveal nothing about the reviewer, and they move the conversation offline.

More templates for common situations

Use these as starting points when you respond to patient reviews. Change the wording so that replies do not all read alike, but keep the structure.

A complaint about waiting

“Thank you for your feedback. We work hard to keep to time and we are sorry when that does not happen. Please call our office and ask for the practice manager, who would like to hear more.”

A complaint about cost or billing

“Thank you for raising this. Our policy is to explain fees and payment options in writing before any treatment begins. We cannot discuss individual accounts here, but our practice manager would be glad to speak with you directly.”

A complaint about a member of the team

“We expect everyone who visits us to be treated with courtesy, and we take feedback like this seriously. Please contact our office so that we can understand what happened.”

A detailed positive review

“Thank you for these kind words. Our whole team appreciates you taking the time to share them.”

A review that seems to be about a different business

“Thank you for your feedback. We are not certain this relates to our office. Please contact us directly so that we can help.”

A review from someone unhappy with a result

“We want every person who visits our practice to feel heard. We are unable to discuss care in a public forum, so please call our office and we will arrange a time to talk.”

None of these confirms a visit, a treatment or a relationship. That is the test every reply has to pass.

Five checks before you post

1. Does the reply confirm, even by implication, that the reviewer or their child is a patient?
2. Does it mention a date, an appointment, a treatment, a fee or an insurance detail?
3. Does it use a name the reviewer did not make public?
4. Would it still be acceptable if the reviewer turned out not to be a patient at all?
5. Has a second person read it?

If the answer to any of the first three is yes, rewrite it. If the answer to the fourth is no, rewrite it. The fifth catches most mistakes, which is why a second reader is worth the two minutes.

What to do away from the screen

The public reply is the smallest part of handling a complaint. The real work happens offline.

1. Find out what happened. Speak to the team members involved before anyone replies.
2. Contact the person directly, if you know who they are, by phone rather than in writing. Listen first.
3. Put right what can be put right. An apology, a corrected bill or an earlier appointment often ends the matter.
4. Record the complaint and the outcome in the same way you record any other complaint.
5. Do not ask for the review to be removed or changed in exchange for anything. If the person chooses to update it, that is their decision.
6. Look for the pattern. Three reviews about the same problem are information, not bad luck.

A practice that treats reviews as feedback improves faster than one that treats them as attacks.

Reporting reviews that break the rules

Platforms publish rules about what a review may contain. Reviews that are spam, off topic, abusive or written by someone with a conflict of interest can be reported through the platform’s own tools. Reporting is not the same as disagreeing. A harsh but genuine opinion will usually stay, and the right response is a calm reply.

When you report, do not include patient information in the report either. Describe the rule the review breaks, not who the person is or what care they received.

Who should reply

Role	Responsibility
One named person, often the practice manager	Drafts every reply
A second person, ideally the doctor or privacy lead	Reads each reply against the five checks
The doctor	Decides how complaints are resolved offline
Any agency you use	May draft replies for approval, but should not post without sign-off

Train anyone who has access to the profile. Most disclosures are not deliberate. They are written late in the evening by someone who felt the practice had been treated unfairly. A rule that negative reviews wait a day, and that nobody posts alone, prevents nearly all of them.

An illustrative example

The example is invented and simplified.

A parent posts that the practice “kept us waiting forty minutes and then charged us for a broken bracket.” The first draft of the reply reads: “We are sorry about the wait on the 14th. Your daughter’s bracket was replaced under our standard policy, which you signed.” Every part of that confirms a patient relationship and reveals detail.

The second reader stops it. The posted reply reads: “Thank you for your feedback. We aim to keep to time and to explain all charges clearly in advance. We cannot discuss individual situations here, but our practice manager would like to speak with you. Please call the office.” The manager then phones the parent, apologizes for the wait and explains the charge. The review stays, the reply shows a practice that listens, and nothing protected was disclosed.

Reviews on other platforms and on social media

The same rule applies everywhere: Facebook, Yelp, healthcare directories and comments on your own posts. The enforcement case described earlier in this article concerned replies on Yelp, not Google. Check the main platforms a few times a year, and use the same templates and the same two-person check wherever you reply.

Frequently asked questions

Can we thank a patient by name for a good review?

Use the name they posted under if you wish, and keep the reply general. Do not add details such as their treatment or how long you have known them.

The reviewer described their own treatment. Can we respond to those details?

No. The patient may share their own information. The practice may not confirm or add to it without a valid authorization.

Can we say that the reviewer is not our patient?

Avoid it. A statement about whether someone is or is not a patient is a statement about patient status. Invite them to contact the office instead.

Should we respond to patient reviews that are positive as well?

Yes, briefly. Replying only to criticism makes the criticism more prominent, and Google notes that replying shows you value feedback.

How quickly should we reply?

Within a few days. For a negative review, wait at least one day so that the reply is calm, and make the offline contact first if you can.

Is a written authorization from the patient enough to discuss details?

A valid HIPAA authorization can permit specific disclosures, but a public reply is rarely the right place even then. A general reply and a private conversation are almost always better.

Can staff reply from their personal accounts?

No. Replies should come from the practice’s profile, from a trained person, after a second read.

Does this apply to reviews about a child’s treatment?

Yes, and with extra care. Do not confirm anything about a minor’s care in response to a parent’s review.

Where can we get help?

We draft and check replies as part of orthodontic reputation management. For a fair process to earn reviews, see how to get more Google reviews.

A short written policy for the practice

A one-page policy removes the guesswork. It does not need legal language. It needs to be read and followed. The points below are a starting list to adapt with your own counsel.

1. Only named, trained people may reply to reviews, and only from the practice’s own profile.
2. Every reply is read by a second person before it is posted.
3. Replies to negative reviews wait at least one day.
4. No reply confirms that anyone is or is not a patient.
5. No reply mentions appointments, treatment, fees, insurance or anything about a child’s care.
6. The real conversation happens by phone or in person, and its outcome is recorded.
7. Nothing is ever offered in return for changing or removing a review.
8. Reviews that break a platform’s rules are reported through the platform, without patient details.
9. New team members read this policy before they are given access.

Keep the policy with your other privacy documents and review it once a year. When access to the profile changes, update the list of people allowed to reply.

Common misunderstandings

• “The patient went public first, so we can answer in detail.” The patient’s choice to share does not give the practice permission to share.
• “We did not use their name, so it is fine.” Confirming a visit or describing care can identify someone even without a name.
• “A private message on the platform is safe.” Messaging tools on review sites are not designed for health information. Use the phone.
• “Deleting our reply fixes a mistake.” The disclosure has already happened. Treat it as a privacy incident and follow your own procedure.
• “Only negative reviews carry risk.” A warm reply to a positive review can confirm a treatment relationship just as easily.
• “Our agency handles replies, so the responsibility is theirs.” The practice remains responsible for what is posted in its name.

Why a careful reply is also good marketing

Privacy and reputation point the same way here. A future patient reading your replies wants to know two things: that the practice listens, and that it will not discuss their family in public. A short, courteous, general reply shows both. A long defensive one, however accurate, suggests the opposite. When you respond to patient reviews with the same care you would bring to a conversation at the front desk, the reply protects the patient, the practice and the next family’s trust at once.