HIPAA-compliant review responses, with examples

A one-star review from a patient stings, and the first urge is to set the record straight. For a dental office, a chiropractor, a physical therapist or a counseling practice, that urge is where the legal risk starts. The safest rule for HIPAA-compliant review responses is short: the reply should never confirm that the reviewer is a patient, even when the reviewer said so in the review.

This guide covers what that rule rests on, the cases HHS has settled, the phrases that give a patient away, and a reply formula that works for good and bad reviews alike. You'll get more than a dozen before-and-after rewrites across six kinds of practice, a phone script for taking it offline, a staff policy you can adapt and a checklist for AI-drafted replies. For replies outside health care, see how to respond to negative reviews.

This is general information about the HIPAA Privacy Rule as of October 2026, not legal advice. Your privacy officer or a health care lawyer should approve your standard reply, and state laws can add rules of their own.

The rule for HIPAA-compliant review responses

The safe approach is to never confirm in a reply that the reviewer is or was your patient, and never mention their condition, treatment, appointments, bills or insurance. That holds for positive reviews, negative reviews and reviews where the patient described everything themselves. Thank them, say you don't discuss care in public, and offer a phone call.

The Privacy Rule says a covered practice "may not use or disclose protected health information, except as permitted or required" by the rule (45 CFR 164.502). Outside those permissions, a disclosure needs the patient's valid written authorization (45 CFR 164.508). HHS has been blunt about review replies. Announcing a 2022 settlement, the director of its Office for Civil Rights (OCR) said that "Providers cannot disclose protected health information of their patients when responding to negative online reviews" (HHS).

Protected health information covers far more than a chart. The rule's definitions (45 CFR 160.103) include information about a person's "past, present, or future physical or mental health or condition," about "the provision of health care to an individual," and about payment for that care, when it identifies the person or could reasonably be used to. The reviewer's name sits right above your reply. Add "your crown" or "your last adjustment" and the reply ties a named person to care you gave them.

The patient said it first. Does that change anything?

The safe answer is no. The Privacy Rule limits what your practice discloses. It lists the permitted disclosures (164.502) and requires a valid authorization for most others, and a patient's own public post is not on the list. The HHS cases below don't say what the reviewers had written themselves, so they don't settle the point, and a lawyer can tell you how it applies to your practice. Until then, your reply adds nothing, corrects nothing and confirms nothing, even when agreeing would be friendlier and correcting would feel fair.

Review replies HHS has acted on

OCR, the part of HHS that enforces the Privacy Rule, has announced several settlements over review replies. Three of them show the pattern.

1. 2019: Elite Dental Associates, Dallas

   A patient complained that the practice replied to a review with the patient's last name and details of their health condition. OCR found it had disclosed several patients' information in replies on its Yelp page. It paid $10,000 and took on a corrective action plan with two years of monitoring.

2. 2022: New Vision Dental, California

   A complaint alleged that replies to online reviews disclosed patient names, treatment and insurance information. The practice paid $23,000 and agreed to a corrective action plan monitored for two years.

3. 2023: Manasa Health Center, New Jersey

   A psychiatric practice replied to a negative review with details of the patient's mental health diagnosis and treatment. OCR found three more patients' information in other replies. It paid $30,000 and agreed to a two-year corrective action plan.

The details are on HHS's pages for Elite Dental Associates (and its 2019 press release), New Vision Dental and Manasa Health Center. HHS now serves some of its older press releases from an archive, so a link may open there. Three things repeat across them.

• Size is no shield. OCR accepted a reduced amount from Elite in consideration of its size, financial circumstances and cooperation, but it still settled, and the 2023 announcement says OCR will act "no matter how large or small the organization."
• Missing policies were cited too. Elite had no policy on disclosures in social media, New Vision failed to implement privacy policies, and Manasa "failed to implement HIPAA Privacy policies and procedures."
• The payment came with more work. Manasa's plan required written policies, training for all staff including owners and managers, and breach notices to every patient whose information had been posted online without authorization.

The 2023 announcement was plainer still: "Simply put, this is not allowed" (HHS).

Can doctors respond to Google reviews?

Yes. Replying is allowed, and it helps: Google's help page on reviews says "helpful and positive replies to reviews can show that you're responsive to your customers," and it notifies the reviewer when you reply (Google Business Profile Help). Google's own tips also say to "never share a reviewer's private information" (Google). The same care applies on Yelp, Facebook, Healthgrades or any other site, since the Privacy Rule governs what you disclose wherever you post it. Manasa's corrective plan, for example, covered information disclosed "on any internet platform."

Who the Privacy Rule covers is set by its definition of a covered entity (45 CFR 160.103): health plans, clearinghouses, and any "health care provider who transmits any health information in electronic form in connection with" a standard transaction, such as an insurance claim. Most practices that bill insurance electronically fit. A practice that takes only cash may or may not, and that's a question for a lawyer. Each kind of practice has its own trap.

A safe reply formula for any patient review

The formula has five parts. Negative and mixed reviews get all five. A positive review needs only the thanks and the sign-off, and some practices add the privacy line to every reply so that all their replies read alike.

1. 1

   Thank you for taking the time to share this.

   Thank them for the review

   Thank them for writing, never for visiting. 'Thanks for coming in' confirms a visit.

2. 2

   We don't discuss anyone's care, or confirm whether someone is a patient, in a public reply.

   The privacy line

   It explains your silence, and because you say it to everyone, it confirms nothing about this reviewer.

3. 3

   We want every person who calls or walks in to feel respected and heard.

   A general statement about the practice

   Talk about how the practice runs, in the present tense, rather than about what happened to the reviewer.

4. 4

   Please call our practice manager, Dana, at (555) 010-0142.

   The way to reach you

   A first name and a direct line. Avoid 'we'll call you', which implies you have their number on file.

5. 5

   The team at Maple Street Dental

   Sign-off

   The practice name, or a first name and role. No clinician names linked to the reviewer.

Templates you can adapt

Template: negative or mixed review

CopyPrint

Thank you for taking the time to share this. To protect everyone's privacy, we don't discuss anyone's care, or confirm whether someone is a patient, in a public reply. We take every concern seriously and would like the chance to talk with you directly. Please call [Practice name] at [phone] and ask for [First name], our [practice manager or privacy officer].

Template: positive review

CopyPrint

Thank you for taking the time to write this. Kind words like these mean a great deal to our whole team, and we'll share them at our next team meeting.

Template: star rating with no comment

CopyPrint

Thank you for your rating. If you'd like to share more, we'd be glad to hear from you at [phone].

Template: a review you can't place, or that seems to be about another business

CopyPrint

Thank you for posting. We don't confirm whether anyone is a patient, but we take every concern seriously. If you'd like to talk about this, please call [First name] at [phone].

The positive template is deliberately plain. An enthusiastic, detailed reply to a five-star review has usually said too much, because the details are the patient's care. For more on short, warm replies to good reviews, see how to respond to positive reviews, and for blank ratings, how to respond to a Google review with no comment.

Phrases that confirm someone is a patient

Most risky replies are friendly ones. Every phrase below comes from good intentions, and every one ties the reviewer to your care.

A grammar trick helps. Write about "we" in the present tense ("we aim to see everyone on time") and leave out "you" in the past tense ("when you waited"). The first describes your practice. The second describes the reviewer's visit.

How to respond to negative patient reviews: examples

Every review, practice and name below is made up. The "before" replies are the kind HHS has acted on, or close to it. The "after" replies confirm nothing.

Billing and insurance

Wait times and scheduling

JJordan P.

Google

Sat in the waiting room for 50 minutes past my appointment time and nobody said a word. Exam was fine but I won't book a Monday morning again.

Reply from Clearview Eye Care

Thank you for taking the time to share this. We don't discuss anyone's visit in a public reply, but long, unexplained waits are something we want to fix. Our front desk should keep everyone updated when the schedule runs behind. If you'd like to talk, please call our office manager, Tess, at (555) 010-0163. The Clearview Eye Care team

A rude front desk

A bad outcome or pain

Counseling and mental health

A parent reviewing a child's visit

A reviewer who was never a patient

If the review looks fake or meant for another business, reply with the template and report it to Google. How to respond to fake reviews on Google covers the evidence that helps.

A review that names another patient

A review that names someone else and describes their health can break Google's rules. Its content policy says "Do not distribute or post personal information without consent" and counts "medical information" as personal information about others. Report it from your Business Profile: open Read reviews, select the report icon next to the review, choose a reason and send the report. Google says evaluation usually takes several days, and you can appeal once if the report is rejected (Google). How to remove a Google review explains what Google will and won't take down.

Positive reviews that name a procedure

SSam R.

Google

I had my implants done here and I can finally eat steak again. The whole team was patient with all my questions.

Reply from Maple Street Dental

Thank you for taking the time to write this. Our team works hard to make every visit comfortable and to answer every question, and kind words like these mean a lot to all of us. The Maple Street Dental team

Two more made-up examples, from a dental office and a chiropractic office.

How to take a patient review offline without confirming anything

The public reply gives a phone number and stops. For complicated situations, Google's tips suggest asking the reviewer to contact you through a private channel (Google), and that fits HIPAA well. Let them call you. Avoid "we'll reach out" or "we've left you a voicemail," which tell readers you have their number on file.

Once you're on the phone with the patient, the rule is different. The Privacy Rule permits disclosure "to the individual" (164.502), so you can discuss their own care with them. Confirm you're speaking with the patient the way your office normally does before you open the account.

• Customer

  Hi, I left a review about my bill. Your reply said to call Renee.

• You

  This is Renee, thanks for calling. Before I pull anything up, can you confirm your date of birth and the address we have on file?

• Customer

  Sure, it's March 4, and 12 Elm Street.

• You

  Thank you. I see the statement. Let's go through each line, and I'll tell you what I can fix today.

• Customer

  Okay. Honestly, I just want to understand the second charge.

Two things to leave out of the call. Don't ask the patient to remove or change the review in return for a refund, a credit or anything else: Google's tips list incentives to change or remove reviews as prohibited. And don't pressure them at all. Google notes that customers can still change their review after reading your reply, so if the call goes well, that's their decision.

The "we spoke with the patient" update trap

After a good call, owners often edit the reply to show the problem was solved. That edit is an easy place to slip.

If the review led you to change something for everyone, you can say so in general terms in a reply to a later review, or on your website: "We've added a second person at the front desk during the morning rush." Tie it to the practice, never to the reviewer.

Using AI to draft patient review replies

AI writing tools are good at sounding warm, and a common way they do it is by echoing the review back: "We're so sorry your root canal was painful, Sam." That's the kind of disclosure HHS has acted on. A tool can also repeat the same mistake across every reply in a week, which is worse than one person slipping once.

Two rules keep AI drafts safe.

• Give the tool the review and your template, nothing else. Never paste chart notes, appointment history or billing details into it to personalize a reply. The Privacy Rule lets a covered practice share protected health information with a business associate acting on its behalf if the practice "obtains satisfactory assurance that the business associate will appropriately safeguard the information," and that assurance must be documented in a written agreement (164.502(e)). Ask your privacy officer before any tool touches patient records.
• A person checks every draft before it posts, against a short list.

Before an AI-drafted reply goes live

• No name, initial or nickname of the reviewer
• Nothing that confirms a visit: no 'thanks for coming in', no 'your appointment'
• No condition, symptom, body part, procedure, medication or result
• No dates, times, staff names or clinicians tied to the reviewer
• No bills, balances, insurers or payments
• No family members
• The privacy line is there, and so is a first name and phone number
• The reply would read the same if the reviewer had never been a patient

0 of 8 done

A staff policy for replying to patient reviews

HHS cited missing policies in all three cases above, and the rule requires them. A covered practice "must implement policies and procedures with respect to protected health information," "must train all members of its workforce" on them, and "must have and apply appropriate sanctions" against staff who don't follow them (45 CFR 164.530). The workforce includes employees, volunteers and trainees (160.103), so the front desk and the student hygienist count.

1. 1

   Review arrives

   One named person reads it. Nobody replies from a personal account or in the moment.
2. 2

   Draft from the template

   Start from the approved reply and change only the general practice line.
3. 3

   Second check

   A second person checks it against the list above. If in doubt, use the plain template.
4. 4

   Post, then wait for the call

   Post the reply, log it, and handle details only with the patient, by phone.

Template: review reply policy (have your privacy officer or lawyer review it)

CopyPrint

[Practice name] review reply policy, version [number], effective [date]

1. Only [role, such as practice manager] and [backup role] reply to online reviews, from the practice's own business accounts.
2. Every reply starts from an approved template. Replies never confirm that the reviewer is or was a patient and never mention any condition, treatment, visit, date, staff member, bill, insurer or family member.
3. A second trained person checks each reply before it is posted. AI tools may be used only with the review text and the template, never with patient records.
4. Replies never ask a reviewer to change or remove a review, and never offer anything for doing so.
5. Details are discussed only with the patient or their personal representative, privately, after confirming identity under our usual procedure.
6. Edits that add details after a conversation ("update" posts) are not allowed.
7. A reply that may have disclosed patient information is removed at once and reported to [privacy officer] the same day.
8. All staff are trained on this policy when hired and when it changes. Breaking it leads to sanctions under our privacy policy.

If a reply already shared too much

Move fast. Google lets you edit or delete a reply from Read reviews (Google Business Profile Help), so take it down first and rewrite it from the template later.

Go back through older replies too. Replies posted years ago are still public, and New Vision's complaint dated from 2017, five years before the settlement.

Common mistakes in patient review replies

The urge to defend your work is strongest when a review is unfair. Future patients read the reply, too, and a calm, private-minded answer tells them their own information would be safe with you. Asking every patient for a review the same way helps too. Google's content policy says merchants may not "selectively solicit positive reviews from customers," and asking everyone the same way matches that rule. It also means the occasional unfair review sits among many honest ones.

Where Reputation Beam fits

Reputation Beam brings your Google and Yelp reviews into one feed in the dashboard, and replies to Google reviews can be written and posted from there. Yelp reviews are read-only in the dashboard. Writing each reply, and checking it against your template and policy, is still your job.

Reputation Beam also sends review requests by text and email from the dashboard. It records each patient's permission to be texted, and its message templates use placeholders for the name, the business name and the review link, so no treatment details need to go into a request.

Keep going

If you're asking patients for reviews, how to ask customers for reviews covers wording for every channel, and texting customers for reviews explains consent and opt-outs, including why health practices need consent for review texts. Dental offices should also read how to get more Google reviews for your dental practice. For the mechanics of posting and editing a reply, see how to reply to Google reviews, and for Google's wider rules, the Google review policy.

To bring in more reviews, read how to get more patient reviews. Practice-specific plans include chiropractic marketing, physical therapy marketing, dermatology marketing, urgent care marketing, home care marketing and plastic surgery marketing.