Last verified: October 23, 2026, against Google's review policies and Business Profile Help, the eCFR text of 16 CFR Part 465 and the HIPAA Privacy Rule, and HHS OCR's reports to Congress. General information, not legal advice.
Reputation management for doctors is mostly four jobs a practice can run itself: ask every patient for a review, reply without disclosing anything, report what breaks Google's rules, and keep away from tactics the FTC now treats as unfair or deceptive. Agencies sell this as a specialty service. This hub explains each job in plain terms and links to a step-by-step guide for each one.
Why reviews carry extra weight for practices
Reviews feed directly into how Google ranks local results. Google's own local ranking help page (opens in a new tab) lists three factors (relevance, distance and prominence) and says under prominence that "more reviews and positive ratings can help your business's local ranking." Your star rating is "the average of all ratings published on Google," per Google's review score explainer (opens in a new tab), and a new review can take up to two weeks to show up in that score.
Practices also play with one hand tied. A patient can describe their visit in detail. The practice can't even confirm that the person was a patient, because that fact is protected health information. So the strongest defense against an unfair review isn't a clever reply. It's a steady supply of genuine reviews that puts one bad experience in context.
Search demand shows where practice owners feel the pain. Far more people look for ways to remove reviews than for ways to earn them, and advertisers pay heavily for reputation keywords:
| Search (US, monthly) | Volume | Avg. CPC |
|---|---|---|
| how to remove google reviews | 8,100 | — |
| how to respond to google reviews | 1,600 | — |
| google reviews for doctors | 590 | $31.29 |
| reputation management for doctors | 260 | $40.79 |
| medical reputation management | 50 | $123.47 |
Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026.
Want a baseline before you change anything? Medfy's free marketing audit scores your Google listing as part of its local score, including your rating and review count, alongside website, SEO, AI visibility, social and ads. It reads public information only.
Getting more reviews the compliant way
Google lets businesses ask. Its review content policy (opens in a new tab) allows merchants to "solicit or encourage the posting of content that does represent a genuine experience, without offering incentives to do so or attempting to influence the rating or the contents of the review." The same policy bans the shortcuts:
- No incentives: no payment, discounts, or free goods or services, including for changing or removing a negative review.
- No selective asking: merchants may not "selectively solicit positive reviews from customers."
- No pressure on site: merchants "should not require or pressure users to leave ratings or write reviews while on the premises."
- No staff quotas, and no asking for specific content, including content that names a staff member.
A compliant program is simple. Ask every patient at the same point in the visit, with the same message, and make it one tap. Google's review link help page (opens in a new tab) shows the current path: open your Business Profile, select Read reviews, then Get more reviews, and copy the link or download the QR code. As of this check, Google says review QR codes can be generated only on a computer browser.
Two privacy rules keep requests clean. Send them from the practice's own patient messaging system, and never upload patient lists to a third-party review tool that hasn't signed a business associate agreement (BAA). And keep every message free of visit details: "How was your appointment with our team?" is fine; "How did your knee injection go?" is not.
- Scripts, timing and a tracking routine: getting more Google reviews.
- Where to find the link, shorten it and print a QR code: your Google review link.
- Hours, categories, photos and the rest of the profile: the Google Business Profile guide.
Replying to reviews without disclosing patient information
HIPAA's definition of individually identifiable health information, in 45 CFR 160.103 (opens in a new tab), covers information about "the provision of health care to an individual" that identifies the person. A reply that thanks "Maria" for her visit, or explains why her bill was higher than expected, confirms she received care. That's a disclosure, and the reviewer posting first doesn't change it.
HHS's Office for Civil Rights (OCR) has settled cases over exactly this. Its reports to Congress describe them:
| Practice | What OCR described | Payment | Settled |
|---|---|---|---|
| Brandon Au, DDS dba New Vision Dental (South Pasadena and Glendora, California) | Complaint alleged it "impermissibly disclosed the PHI of numerous patients in response to online reviews"; corrective actions included removing posts and a substitute notice on its Yelp page | $23,000 | November 2022 |
| Manasa Health Center (Kendall Park, New Jersey; adult and child psychiatric care) | Complaint alleged it disclosed the PHI of four individuals "in response to negative online reviews posted on Google Reviews" | $30,000 | March 2023 |
Sources: OCR's CY2022 compliance report (opens in a new tab) and CY2023 compliance report (opens in a new tab) to Congress.
The working rule: reply as if you don't know who wrote the review. Thank people generically, state policies rather than facts about a visit, and move anything specific to a private phone call. Google's review management page (opens in a new tab) adds two details worth knowing: replies are public and labeled as coming from the business, and the reviewer is notified when you reply.
Write a small set of reply templates and have your privacy officer approve them before anyone on the team uses them. Our guide to responding to Google reviews has HIPAA-safe templates for five-star, one-star, billing and wait-time reviews. For testimonials, photos and the authorization rule behind them, see the broader HIPAA marketing rules.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
What Google removes, and what it won't
Google removes reviews that break its content policy, not reviews that are harsh. Its reporting help page (opens in a new tab) is blunt: "Do not report a review just because you disagree with it or dislike it. Google doesn't get involved in conflict between businesses and customers."
| Usually removable under Google's policy | Usually stays up |
|---|---|
| Fake engagement: not based on a real experience, paid for, or posted from multiple accounts by one person | A one-star review from a real patient |
| Conflict of interest: current or former employees, competitors, family ties | Complaints about wait times, billing or staff manner |
| Off-topic content and "personal rants" not about an experience at the location | Opinions you think are unfair or exaggerated |
| Another person's personal information, including medical information | A review that names the doctor who works there |
| Harassment, hate speech, obscenity, "unsubstantiated allegations of unethical behavior or criminal wrongdoing" | Respectful descriptions of a negative experience |
To flag a review, open your Business Profile, select Read reviews, then Report next to the review, and pick a reason. Google says evaluation "typically takes several days." The Reviews Management Tool shows the status, and if Google finds no violation you can file a one-time appeal for up to 10 reviews at once. The full walkthrough is in removing Google reviews.
Fake reviews and review attacks
Fake reviews arrive in two forms. Some are attacks: a burst of one- and two-star reviews from accounts with no history, sometimes followed by a demand. Google's extortion scam page (opens in a new tab) describes the pattern and says not to pay, because paying may encourage more attempts and won't necessarily get the reviews taken down. It has a dedicated report form for these cases, separate from ordinary flagging.
Others are fake positives that a business buys or writes. Google removes them, and its restrictions page (opens in a new tab) says a profile caught with fake engagement can also be blocked from receiving new reviews, have existing reviews unpublished for a set period, and display a warning telling consumers that fake reviews were removed.
Our guide to fake Google reviews covers detection signals, reporting, a neutral reply and how to document a pattern for escalation.
The rules: review gating, incentives and testimonials
The FTC's Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465 (opens in a new tab), was published at 89 FR 68077 on August 22, 2024. The FTC's questions-and-answers page (opens in a new tab) says it "went into effect on October 21, 2024." We checked the eCFR text on October 23, 2026.
| Section | What it prohibits, in short |
|---|---|
| 465.2 | Writing, creating or selling fake reviews or testimonials; buying reviews the business knew or should have known were fake |
| 465.4 | Incentives conditioned, expressly or by implication, on a review expressing a particular sentiment, positive or negative |
| 465.5 | Insider reviews without a clear disclosure of the officer's, manager's or employee's relationship to the business |
| 465.6 | Presenting a review site the business controls as independent |
| 465.7 | Unfounded legal threats, intimidation or knowingly false public accusations to stop or remove a review; hiding negative reviews on your own site while implying you show them all |
| 465.8 | Buying or selling fake followers, likes and other social media indicators |
The rule "authorizes courts to impose civil penalties for knowing violations," per the FTC. The inflation-adjusted cap for that kind of rule violation is $53,088 per violation under 16 CFR 1.98 (opens in a new tab), for penalties assessed after January 17, 2025. Our explainer on the FTC fake reviews rule walks through each section.
Two points trip up practices. First, review gating (inviting only patients who rate you highly) is banned outright by Google; the FTC rule has no specific prohibition, but the FTC says the practice "could violate the FTC Act." See the review gating rules. Second, once you reuse a review in your own marketing it becomes a testimonial: HIPAA requires a written authorization under 45 CFR 164.508 (opens in a new tab), and the FTC's typicality and disclosure rules apply. See the patient testimonial rules.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
When reviews disappear or don't show
A drop in review count is usually explained by causes Google documents on its missing reviews page (opens in a new tab): reviews held for a policy check for a few days, reviews from merged profiles taking a few days to appear, reviews removed for policy violations (which "won't be restored"), and content Google temporarily disables for some profiles or categories. Google's automated spam detection can also remove a legitimate review by mistake, in which case Google says to contact support.
Before you hire anyone who offers to "recover" reviews, work through the checks in reviews that disappeared.
In-house vs a reputation management firm
Most of this work is a habit plus a policy, and a front desk can run it. A vendor can help with volume and monitoring, but everything it does happens under your name, and the FTC rule and Google's policy apply to you.
| Task | In-house | Vendor |
|---|---|---|
| Asking every patient for a review | Front-desk script plus a message from your own system | Only with a BAA if they receive patient contact details |
| Replying to reviews | Privacy-officer-approved templates | Same templates; no improvised replies |
| Reporting policy violations | Free through Business Profile and the Reviews Management Tool | No special access to Google |
| Monitoring rating and count | Monthly check | Dashboards and alerts |
Red flags in a reputation vendor:
- Promises to remove reviews, or prices "per removal."
- Asks for owner access or your Google password rather than a manager role.
- Software that asks "How did we do?" and sends only happy patients to Google.
- Offers to "seed" reviews, or writes reviews for patients to post.
- Won't sign a BAA but wants your patient list.
- Sends legal threats to reviewers on your behalf.
Ask each vendor about these points in writing before you sign.
Medfy doesn't send review requests or manage reviews. Its free audit scores your Google listing, including rating and review count, and the Base plan's Google reporting puts Business Profile data next to Search Console and Google Analytics in one view. Details are on Medfy pricing.
Frequently asked questions
Can a doctor respond to a negative review without violating HIPAA?
Yes, as long as the reply doesn't confirm the reviewer is a patient or mention anything about their care, even details the reviewer posted first. Thank them, state a general policy, and give a direct line to the practice manager. HHS's Office for Civil Rights has settled with practices over review replies alleged to disclose patient information, including New Vision Dental ($23,000) and Manasa Health Center ($30,000).
Can I ask Google to remove a bad review?
You can report it, but Google removes only reviews that break its content policies, such as spam, conflicts of interest, off-topic rants, harassment or someone else's personal information. Being negative or unfair isn't enough. Report it from your Business Profile or the Reviews Management Tool. If Google finds no violation, you get a one-time appeal, and the decision arrives by email.
Is it legal to offer patients a discount for a review?
Don't do it. Google's policy bans offering payment, discounts or free goods or services in exchange for a review, and it removes reviews posted because of one. The FTC rule (16 CFR 465.4) bars incentives tied to a positive or negative sentiment, and the FTC says undisclosed incentives can violate the FTC Act. For a Google profile, the platform rule settles it: no incentives.
Should a practice hire a reputation management company?
Only for work you can't do in-house, and only after checking how they work. Ask in writing whether their software filters requests by satisfaction, whether they ever write or seed reviews, how they handle removals, and whether they will sign a BAA before touching patient contact lists. Walk away from anyone who promises removals or wants your Google login.
Do online reviews affect where a practice ranks on Google Maps?
Yes. Google's help page on local ranking says more reviews and positive ratings can help a business's local ranking, as part of the prominence factor. Relevance and distance matter too, so reviews won't lift a profile in the wrong category or far from the searcher. A steady flow of new reviews also keeps your rating current for patients comparing practices.
What should I do about a fake review from someone who was never a patient?
Report it in your Business Profile, choosing the reason that fits, such as conflict of interest or spam. If Google finds no violation, file the one-time appeal with your evidence. Reply briefly without confirming or denying whether the person was a patient, and invite them to call. If someone demands money to remove reviews, use Google's extortion report form instead.