You can respond to patient reviews under HIPAA, but your reply has to say nothing that confirms the reviewer was ever your patient. That one rule explains almost every enforcement case and most of the risky replies sitting on practice Google profiles today.
Short answer: HIPAA does not ban replies to online reviews. It bans replies that reveal protected health information, and in practice that includes confirming that the person was seen at all. A safe reply thanks the reviewer in general terms, shares no details of a visit, and invites a phone call. The same reply works for five-star and one-star reviews.
Why does a review reply create HIPAA risk?
A patient posting about their own visit is not bound by HIPAA. Your practice is. When you answer, you are speaking as a covered entity, so any detail that links that person to your care counts as a disclosure. The American Dental Association puts it plainly: a patient sharing treatment details publicly does not change what a dentist may say back, and providers cannot acknowledge or reply in a way that reveals identifiable information about that patient.
The cost is not hypothetical. In 2023 the HHS Office for Civil Rights settled with Manasa Health Center, a New Jersey psychiatric practice, for $30,000 after it disclosed patient information in replies to negative Google reviews. The corrective action plan required written privacy policies, workforce training and breach notification letters to the affected patients. The fine was small. The paperwork was not.
How common are risky replies in dental and medical practices?
More common than most owners assume. A 2026 analysis of 80,300 public Google review replies from 2,972 medical and dental practices in California and the Pacific Northwest found that roughly 26% carried some disclosure risk. Among the replies reviewers confirmed by hand, about 58% confirmed that the reviewer was a patient or had a visit, and about 41% mentioned a clinical detail such as a procedure or condition.
Two cautions apply. The study was run by a web services firm, and the authors describe it as a measure of public disclosure risk under a conservative rubric, not a national violation rate. Still, the breakdown matters more than the headline number. Most of the risk was not in dramatic oversharing. It was in the friendly sentence that quietly confirmed someone had been in the chair.
What is the safest way to word a reply?
Write as if the reviewer were a stranger who might not be a patient at all. That means no thanks for “coming in,” no reference to a procedure, a date, a provider by name in connection with the reviewer, or an insurance or billing issue. The ADA’s advice is to keep the reply generic and move the conversation offline.
| Risky reply | Why it is risky | Safer rewrite |
|---|---|---|
| “Thanks, Maria! Glad your crown went well.” | Confirms patient status and names a procedure | “Thank you for taking the time to write. We appreciate every review.” |
| “We’re sorry you were upset about your bill.” | Confirms a billing relationship | “We take concerns seriously. Please call our office so we can talk.” |
| “Our records show you missed two appointments.” | Discloses visit history, and it escalates in public | “We’d like to understand what happened. Please contact our office manager.” |
| “Dr. Lee did everything correctly during your extraction.” | Confirms treatment and defends it with clinical detail | “We hold our care to a high standard and would welcome a conversation.” |
| “Thanks for the five stars, see you at your next cleaning!” | Even praise confirms an ongoing patient relationship | “Thank you for the kind words. Our whole team appreciates it.” |
The last row is where we part ways with the most common advice. Plenty of guides treat HIPAA as a problem only for negative reviews, so practices reply warmly and specifically to praise. Our position: positive reviews carry the same exposure as negative ones, and the only reliable policy is one reply style for every review. A staff member who has to judge each review individually will eventually judge one wrong.
Should you reply at all, or stay silent?
Reply. In an ADA Health Policy Institute survey, 39% of dentists who had received reviews said they did not respond because of HIPAA. That instinct is understandable, but it trades a manageable risk for a visible cost. In the 2026 Patient Choice Report from the reputation vendor rater8, 66% of patients said a provider’s response to reviews affects their trust, up from 42% the year before, and 75% would not book a provider rated below 4.0 stars. Rater8 sells review management, so treat the exact figures with some care. The direction is hard to argue with.
Our reading: a calm, short, generic reply does most of the trust work, because prospective patients are reading your tone, not looking for case details. A reply never needs to prove the complaint wrong. It needs to show the practice listens. Reviews also feed local visibility, which is covered in our look at Google Business Profile for medical practices.
What should a written review-reply policy include?
The Manasa corrective plan is a useful template for what an auditor expects to see: written procedures, trained staff and a breach process. A one-page policy for review replies can cover the same ground.
- One approved reply style for every rating, with two or three template openings staff can adapt.
- A named person who posts replies, and a second person who reads the first draft of anything unusual.
- A banned list: patient names, procedures, dates, providers linked to a reviewer, insurance, billing and appointment history.
- A rule to take every complaint offline with a direct phone number or email, once, in one sentence.
- An escalation step for reviews that mention a safety issue, a legal threat or a claim of false information.
- A breach check: if a reply goes out with a detail it should not have, delete it and ask your privacy officer whether notification is required.
If you also ask patients for reviews, the rules on how you ask are separate. Our guide to FTC review rules for practices covers that side.
What mistakes do practices make most often?
Three show up repeatedly. The first is defending the clinical decision publicly, which feels fair and discloses the most. The second is thanking a reviewer by name, which sounds polite and confirms the relationship. The third is letting a front-desk employee improvise replies from a personal account or phone, with no policy and no review.
Frequently asked questions
Is it a HIPAA violation to reply to a Google review?
Not by itself. A reply becomes a violation when it discloses protected health information, which includes confirming the reviewer was your patient. A generic reply that names no one and shares no details does not disclose anything.
Can I respond if the patient already shared their treatment details online?
You still cannot confirm or add to those details. The patient’s public post does not waive your obligations. Reply in general terms and invite them to contact the office.
Can I thank a patient for a positive review?
Yes, with wording that would make sense if the writer were not a patient. “Thank you for the kind words” is safe. “Glad your visit went well” is not, because it confirms the visit.
What if a review is fake or from someone who was never a patient?
Flag it to the platform rather than arguing in public. Replying “we have no record of you” is itself a statement about your records. A neutral line that you cannot find the described experience is safer, and the platform report does the real work.
Do state privacy laws add anything?
They can. Some states set stricter confidentiality duties for certain providers, and psychiatric and substance use care carry extra protections. Ask a healthcare attorney to check your reply policy against your state’s rules.
A review reply is a public record that will sit next to your name for years, so the most useful test before posting is whether the sentence would still be safe if the reviewer had never walked through your door.
