How to respond to negative reviews without breaking HIPAA
To respond to a negative review under HIPAA, reply briefly and generically, never confirm that the reviewer is a patient, never mention their visit, treatment, condition, dates or bill, and move the conversation offline to a named role and phone number. A patient can post anything about their own care. The practice cannot respond with protected health information, even to correct something untrue. HHS has fined or settled with practices that did, and this guide shows the cases, a step-by-step process and reply templates for the situations practices face most.
- The reviewer's own disclosure does not give you permission to discuss their care in public.
- Don't even confirm they are a patient. "We have no record of you" can be a disclosure too.
- HHS's Office for Civil Rights has taken action against dental and behavioral health practices over review replies, including a $50,000 civil money penalty.
- Use a five-step process: pause, check, route, reply generically, resolve offline.
- Never offer anything in exchange for removing or changing a review, and never threaten legal action over an honest one.
- Every practice welcome — retainers from $499/mo, Goals-Driven engagements, Performance-Linked Payout Models available.
- Dallas, Texas LLC
- 10-person US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
Why a review reply can be a HIPAA disclosure
HIPAA's Privacy Rule limits how covered entities, including most medical and dental practices, use and disclose protected health information (PHI). PHI is broader than a diagnosis. It includes the fact that someone is a patient, the dates they were seen, what they were treated for, what they were billed and what their insurer paid, when that information can be tied to them.
A public review reply is a disclosure to anyone who reads it. So a reply that says "We're sorry you waited on Tuesday, your crown appointment ran long" confirms a patient relationship, a date and a treatment. The reviewer's choice to post about their own care doesn't change that. They can disclose their own information. The practice can't, without a valid authorization.
This is also why "We have no record of you as a patient" is a poor reply. It discloses information about who is and isn't a patient, invites argument, and reads as defensive to every other prospective patient.
What HHS has done about review replies
The HHS Office for Civil Rights (OCR) enforces HIPAA. Its published resolution agreements and penalties include several cases that began with a reply to an online review:
| Practice | What happened | Outcome |
|---|---|---|
| Dental practice, Dallas, Texas (announced October 2019) | Disclosed several patients' PHI in responses to reviews on a review site. | $10,000 settlement and a corrective action plan. |
| Dental practice, Charlotte and Monroe, North Carolina (announced March 2022) | Disclosed a patient's PHI on a webpage in response to a negative online review, and did not respond to OCR's data request or subpoena. | $50,000 civil money penalty. |
| Dental practice, California (2022) | Replies sometimes gave patients' full names where reviewers used screen names, and details about visits and insurance. | $23,000 settlement and a corrective action plan. |
| Psychiatric practice, New Jersey (announced June 2023) | Disclosed PHI of four patients in replies to negative Google reviews, and lacked required privacy policies. | $30,000 settlement and a corrective action plan. |
The amounts are modest next to large data breaches, but corrective action plans typically require new policies, staff training and reporting to OCR for a set period. The reputational cost of a public enforcement notice naming the practice is harder to measure. State licensing boards and state privacy laws can add further consequences.
The pattern in these cases is the same: a provider felt the review was unfair and tried to set the record straight with facts. That instinct is exactly what to train out of your team.
A five-step process for every negative review
- Pause. Don't reply the same hour, and never let the provider who was named reply from their own account. Set a target of replying within two to three business days.
- Check internally. The practice manager looks up what happened in your own systems, privately. This informs the offline resolution, not the public reply.
- Route by type. Service issues (wait times, phones, front desk) go to the practice manager. Billing goes to the billing lead. Anything suggesting a clinical complaint, injury, legal threat or board complaint goes to the owner or medical director and, if needed, counsel and your malpractice carrier, before any reply.
- Reply generically. Use an approved template. Two to four sentences. No names, dates, treatments, conditions, outcomes, bills or insurance. No arguing.
- Resolve offline and record it. If you can identify the person from your records, contact them through your normal patient channels, not through the review site. Log the review, the reply and the outcome.
The "could this be about anyone?" test
Before posting, read the reply and ask: would this make sense under any review at all? If it only makes sense for this specific person, it probably says too much.
Reply templates for common situations
Long wait
Use: "Thank you for the feedback. We work hard to keep waits short and we're sorry this experience didn't meet that standard. Our practice manager would like to hear more. Please call [number]."
Avoid: "Dr. Patel was delayed by an emergency surgery that morning."
Billing or insurance
Use: "We take billing concerns seriously and want to help. Please contact our billing team at [number] so we can look into this with you."
Avoid: "Your insurer denied the claim because the procedure wasn't covered under your plan."
Rude staff
Use: "We're sorry to read this. Courtesy is something we expect from every member of our team, and we'd like to understand what happened. Please call our practice manager at [number]."
Avoid: "Our receptionist says you raised your voice first."
Unhappy with a clinical result
Use: "Thank you for sharing this. We take every concern seriously and would welcome the chance to talk directly. Please contact our office manager at [number]."
Avoid: "Results from fillers vary and you were told this at your consultation."
Reviewer shares a diagnosis
Use: the same generic reply. Don't repeat, confirm or comment on anything they disclosed.
Avoid: "We're glad your anxiety medication is working better now."
Possibly fake or not a patient
Use: "We take all feedback seriously. Please contact our practice manager at [number] so we can learn more." Then report the review to Google if it breaks policy.
Avoid: "You've never been our patient."
Positive reviews need care too
"Thank you, we're so glad your daughter's braces came off in time for prom!" is a disclosure. "Thank you for the kind words. It means a lot to our team" is not. Use generic replies for every review, positive or negative.
When you can ask Google to remove a review
Google removes reviews that break its policies, not reviews that are merely negative or unfair. Report a review from your Business Profile when it is:
- Spam or fake engagement, including a review not based on a genuine experience.
- From a conflict of interest, such as a current or former employee or a competitor.
- Off-topic, including political rants unrelated to the practice.
- Harassing, hateful, sexually explicit or containing personal information about staff.
Things to never do, because they create new problems:
- Offer a refund, discount or gift in exchange for revising or removing the review. Google's policy prohibits it.
- Threaten legal action over an honest review. The FTC's 2024 review rule prohibits using unfounded or groundless legal threats, intimidation or certain false public accusations to prevent or remove negative reviews.
- Ask staff, friends or family to post positive reviews to bury it. That is fake engagement under Google's policy and can fall under the FTC rule's insider-review provisions.
- Use non-disparagement clauses in patient agreements to block reviews. The federal Consumer Review Fairness Act restricts form-contract clauses that limit honest reviews.
If a review is genuinely defamatory, or the reviewer is threatening staff, talk to counsel. Legal action is a last resort and draws attention to the review.
Write it into a one-page policy
OCR's corrective action plans in these cases required written policies and staff training. You can do that before anyone requires it. A one-page review response policy should include:
- Who may reply (one or two named roles), from which account, and who approves.
- The approved templates, and the rule that replies never include patient details.
- The escalation list: clinical complaints, legal threats and board complaints go to the owner and counsel first.
- The reply target (for example, within three business days) and logging requirements.
- A ban on review incentives, insider reviews and threats.
- Annual training for everyone with access to review platforms, including agencies and vendors. Any vendor that sees PHI in the process should be under a BAA.
Ichelon Consulting US handles review monitoring and replies for practices as part of our reputation management service. Our client-facing teams hold HIPAA compliance training certificates, we sign a BAA with every US client, and replies follow the practice's approved templates. For the review-generation side, see how to get more Google reviews; for the profile itself, see our Business Profile guide for doctors. More how-to guides are in the US guides library.
Sources
- HHS: Dental practice pays $10,000 to settle social media disclosures of patients' PHI (October 2019)
- HHS: HIPAA enforcement action, North Carolina dental practice ($50,000 civil money penalty) and HHS announcement, March 2022
- HHS: Settlement with a California dental practice over disclosures in review replies (2022)
- HHS: Agreement with a New Jersey provider that disclosed patient information in response to negative online reviews (June 2023)
- Google Maps user-generated content policy: fake engagement
- FTC: Consumer Reviews and Testimonials Rule, questions and answers
- FTC: Consumer Review Fairness Act, what businesses need to know
Related pages from the US team
Reputation management for US practices
Review monitoring, replies and escalation, run by HIPAA-trained teams.
How to get more Google reviews
A compliant request process so one bad review isn't the whole story.
Should dentists reply to Google reviews?
What our dental study found about reply rates.
Reviews and FTC rules for pediatric practices
The FTC and Google rules explained for family practices.
HIPAA-compliant healthcare marketing
The wider picture: authorizations, testimonials, email and ads.
Every practice welcome — Goals-Driven engagements from $499/mo
We benchmark your last 90 days, agree monthly goals with you, and track them live on Ichelon Agency OS with a report every Monday. Performance-Linked Payout Models are available. Our US leadership is based in Dallas, and strategy calls run in US business hours.
Common questions
Can a doctor respond to a negative Google review?
Yes, but only in general terms. The reply should not confirm that the reviewer is a patient or mention any detail of their care, visit, bill or condition. Thank them, say the practice takes feedback seriously, and invite them to contact a named role, such as the practice manager, by phone.
If the patient already shared their diagnosis in the review, can we discuss it?
No. A patient choosing to share their own information does not authorize the practice to disclose or confirm it. HHS enforcement cases have involved practices that responded to reviews with details about the patient's care.
What happened to practices that disclosed information in review replies?
HHS's Office for Civil Rights has resolved several cases. A Dallas dental practice paid $10,000 in 2019. A North Carolina dental practice was given a $50,000 civil money penalty, announced in 2022. A California dental practice paid $23,000 in 2022. A New Jersey psychiatric practice paid $30,000 in 2023 after disclosing information about four patients in replies to Google reviews. Each also agreed to, or was subject to, corrective action.
Should we reply to every negative review?
Usually yes, with a short generic reply. It shows other readers that the practice listens. Skip or delay a reply when the review involves a possible legal claim or a complaint to a licensing board, and talk to counsel first.
Can we get a negative review removed?
Only if it breaks Google's content policies, for example if it is spam, off-topic, hateful, from a conflict of interest, or not based on a real experience. Report it through your Business Profile. Negative reviews that reflect a real experience will not be removed, and using threats or groundless legal action to suppress them is prohibited by the FTC's 2024 review rule.
Can we ask the patient to change their review after we fix the problem?
You can resolve the problem and leave it to the patient whether to update their review. Never offer a refund, discount or anything else in exchange for revising or removing a review; Google's policy prohibits it.
What if the reviewer is not actually a patient?
Don't say so publicly, because confirming who is or isn't a patient can itself disclose information. Use the same generic reply and, if the review appears fake or from a competitor or former employee, report it to Google.
A note on this guide: it explains marketing practice, not legal advice. Rules on privacy, advertising and insurance change and vary by state, so confirm anything compliance-related with your own counsel.
Need a safer review reply process?
A 30-minute benchmarking call with the US team. We'll look at your recent replies, flag any risks and set up a process your staff can follow.