How to respond to Google reviews as a practice without breaking HIPAA

The HIPAA rule that changes how practices reply

HIPAA protects individually identifiable health information. Under 45 CFR 160.103 (opens in a new tab), that includes information relating to "the provision of health care to an individual" that identifies the person, or where "there is a reasonable basis to believe the information can be used to identify the individual." A reviewer's name and photo sit right above your reply. Anything in the reply that ties that person to care at your practice is a disclosure.

The reviewer posting first doesn't open the door. Patients can say whatever they like about themselves; the practice still needs a permission under the Privacy Rule, and for a public reply that usually means a written authorization under 45 CFR 164.508 (opens in a new tab). Nobody gets one before replying to a review.

HHS's Office for Civil Rights (OCR) has settled cases over this. From its reports to Congress:

• Brandon Au, DDS dba New Vision Dental (South Pasadena and Glendora, California) paid $23,000. A complaint alleged the practice "impermissibly disclosed the PHI of numerous patients in response to online reviews of its practice." The settlement occurred in November 2022 and required the practice to remove posts containing PHI, notify the patients and post a substitute notice on its Yelp page (OCR CY2022 report (opens in a new tab)).
• Manasa Health Center (Kendall Park, New Jersey; adult and child psychiatric care) paid $30,000. The complaint alleged it disclosed the PHI of four individuals "in response to negative online reviews posted on Google Reviews." The March 2023 settlement required breach notices to everyone whose information was disclosed "on Google Reviews or any other internet platform without a valid authorization" (OCR CY2023 report (opens in a new tab)).

Both cases also cited missing privacy policies. A written reply policy is part of the fix, not paperwork. If you're unsure whether a detail is protected, start with what counts as PHI.

What a reply must never do

Run every draft past this list before it goes live:

1. Confirm the reviewer is or was a patient. No "thank you for your visit," "we enjoyed seeing you" or "as your provider."
2. Use the reviewer's name. Google displays it; your reply shouldn't repeat it.
3. Mention care, dates or details. No procedures, diagnoses, medications, appointment times, test results or provider names tied to this person.
4. Correct the record with facts. "Actually, you arrived 40 minutes late" is a disclosure about a visit.
5. Discuss money tied to the person. No balances, copays, insurance denials or collections.
6. Argue, threaten or accuse. Under the FTC's review rule, unfounded legal threats, intimidation and knowingly false public accusations aimed at getting a review removed are prohibited (FTC Q&A (opens in a new tab)).
7. Offer anything for a change or removal. Google's review policy (opens in a new tab) bans incentives "in exchange for posting any review or revision or removal of a negative review."

Templates: positive, neutral and negative reviews

Each template below is generic on purpose. It works whether or not the reviewer is a patient, which is the point. Swap in your own practice name and phone number, then have your privacy officer approve the final set.

Notice what's missing: no "we're sorry your visit went badly," no "we hope you're feeling better," no "Dr. Lin." Each of those would tie the reviewer to care.

Billing, wait-time and staff complaints

These are the reviews where the urge to explain is strongest, and explaining is where disclosures happen. Answer the policy, never the person.

Don't name or defend the staff member in public. Handle it internally, and document what you did.

Reviews from people who were never patients

Saying "we have no record of you" sounds safe, but it isn't neutral: it implies that people you don't mention that way are patients. Use the same wording whether or not you recognize the reviewer.

Then deal with the review through Google. If it looks fake, from a competitor, or not about an experience at your practice, report it; our guides to fake reviews and getting a review removed cover the categories, the Reviews Management Tool and the one-time appeal.

Taking it offline: when and how

Move the conversation off Google whenever a reply would need any fact about a visit, a bill or a person. In practice that's most negative reviews.

How to do it well:

1. Post the public reply first, with a direct phone number or a monitored email for the practice manager. Not the general line.
2. Wait for the reviewer to make contact. Don't call or message someone from your records because you think you recognize their review. That uses their information for a purpose they didn't ask for, and it can feel like intimidation.
3. Verify identity on the call before discussing anything, as you would for any patient inquiry.
4. Listen, fix what you can, and write it down. A summary note in the complaint log is enough.
5. Never ask for the review to be removed in exchange for anything. A refund offered on condition that the review comes down is an incentive under Google's policy. The FTC's Q&A adds that incentives to remove negative reviews could be an unfair practice under the FTC Act.

If the patient decides to update their review on their own, that's their choice.

Who should reply, and how fast

Give one person ownership, usually the practice manager, with a backup. Clinicians shouldn't reply from personal accounts, and nobody should reply from a personal account at all.

Google's review management page (opens in a new tab) sets the mechanics. You must verify the business before replying. Replies are public, labeled as coming from the business (your personal name isn't shown), and the reviewer is notified. Google checks replies against its content policies: "Replies usually take up to 10 minutes to review, but sometimes a review can take up to 30 days." You can edit or delete a reply later.

A workable cadence: check reviews twice a week, reply to positive reviews within a few business days, and for negative ones post the approved template only after the manager has read the review in full. Don't let speed tempt anyone into improvising.

Your privacy officer should approve the template set, and the team should use only approved wording. Review the set yearly and after any incident. The same discipline applies on Facebook, Yelp and Instagram comments; see HIPAA and social media.

Medfy doesn't write or post review replies. Its free marketing audit includes your rating and review count in the Google listing score, which gives you a dated baseline to track. For the full reputation picture, see our guide to online reviews and reputation.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

Can I thank a patient by name in a review reply?

No. A thank-you that uses the reviewer's name and refers to their visit confirms they were your patient, and that fact is protected health information. Even though Google shows the reviewer's name, your reply shouldn't repeat it or mention a visit, provider or treatment. Thank them generically instead: thank you for taking the time to share this, we're glad to hear it.

Can a practice respond to a review where the patient describes their own treatment?

Yes, but not to the treatment. Patients may share their own information; your practice still can't confirm, correct or add to it without a valid HIPAA authorization. Reply about general policies and invite the person to contact the practice manager directly. Manasa Health Center paid $30,000 to settle an OCR investigation of replies to negative Google reviews that involved four people's information.

Should we reply to every Google review?

Reply to most of them with approved templates, but you aren't obliged to answer every one. Google notes that helpful replies show you're responsive, and every reply is public. Hold back when a review is clearly fake or abusive and you've reported it, or when any answer would start a public argument. Silence is always safer than a reply that discloses something.

What do we say when a reviewer was never a patient?

Say nothing that confirms or denies it. A reply like 'we have no record of you' tells readers who is and isn't a patient. Use a neutral template: you take feedback seriously, you can't discuss individuals publicly, and the person can call the practice manager. Then report the review to Google under the reason that fits, such as conflict of interest or spam.