How to respond to patient reviews without violating HIPAA

Practices have paid for review replies

The HHS Office for Civil Rights has taken several enforcement actions against practices whose replies to online reviews disclosed patient information:

• 2019: a Dallas dental practice paid $10,000 after Yelp replies disclosed patient information.
• 2022: a North Carolina dental practice was fined $50,000 after naming a patient in a reply to a pseudonymous Google review.
• 2022: a California dental practice paid $23,000 after Yelp replies included patients' full names and details of their visits and insurance.
• 2023: a psychiatric practice paid $30,000 after replies to four patients' Google reviews disclosed their health information.

The rule: don't confirm, don't explain

Even when a reviewer shares their own story, your reply can't confirm they are a patient or add any detail about their care. That includes their name, dates of visits, diagnoses, treatments, billing or anything said in the room. Defending yourself with the facts of the visit is exactly what led to these penalties.

• Don't confirm the person is or was a patient.
• Don't mention any detail about care, appointments or billing.
• Don't argue publicly. Invite them to contact the office directly.
• Keep replies short, polite and the same tone for every review.

Reply templates your team can use

• Positive review: "Thank you for taking the time to share this. We're glad to hear it, and we appreciate you."
• Negative review: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing any individual's care here. Please call our office manager at [number] so we can talk directly."
• Review that isn't about you: "We take all feedback seriously, but we can't find a record that matches this description. Please contact our office at [number] so we can look into it."

Make reviews a steady process

The best protection against one harsh review is a steady stream of honest ones. Ask satisfied patients at checkout or in a follow-up message, make it easy with a direct link to your Google Business Profile, and check new reviews weekly. Avoid offering incentives for reviews, which breaks Google's policies.