Replying to negative reviews: what a practice can say

This is general information, not legal advice.

Key takeaways

• Never confirm that a reviewer is a patient. That holds even if they post under their real name.
• Leave out visits, dates, bills, insurance and health facts. Run the five-point test below before you post.
• A reply can state office policies, such as parking or online booking. It can also ask the person to call the office.
• Sometimes the right move is no reply at all. Report only reviews that break Google’s rules.
• Never threaten, reward or silence a reviewer. Write down who may reply, and train them.

Why can’t a practice reply to reviews like other businesses do?

Because a reply that confirms someone is a patient shares patient details. Most business advice says to use the reviewer’s name and answer their complaint in detail. For a covered practice, that advice is the risk.

HIPAA, the Health Insurance Portability and Accountability Act, is the US law on the privacy of health information. Its Privacy Rule sets rules for who may share that information. A health care provider is covered if it sends health information electronically for certain tasks. Billing a plan is one of them (Code of Federal Regulations, 45 CFR 160.103). A covered practice may not use or share patient details unless the rule allows it (45 CFR 164.502). Sharing without a valid written permission, called an authorization, is generally not allowed (45 CFR 164.508).

HIPAA is not the only rule. A state law can protect health privacy more strictly than the Privacy Rule. That state law still applies (45 CFR 160.203). The American Dental Association (ADA) has a note for dental practices. A dental practice not covered by HIPAA must still follow state privacy laws (ADA guidance). Professional ethics codes can add rules too (American Counseling Association (ACA) tip sheet).

What counts as patient information in a reply?

Patient information (this guide also calls it patient details) is anything about a person’s health or care. It also covers the payment for their care. It counts if it names them or could reasonably point to them (45 CFR 160.103). The ADA warns that even confirming the person was at the practice might bring fines (ADA guidance).

Keep all of these out of a reply:

• That the reviewer is a patient, or that they visited.
• A patient’s name, or any detail that could point to one person.
• Visit dates, times and the clinician they saw.
• Symptoms, diagnoses, treatments and test results.
• Bills, balances, payments, insurance plans and claims.

The list is short on purpose. Some details only make sense to someone who knows the person was seen. Those do not belong in a reply.

What happened in three cases from the US health department?

The US Department of Health and Human Services (HHS) has acted against practices for review replies. Its Office for Civil Rights (OCR) enforces the Privacy Rule (HHS agreement page). A corrective action plan is a list of fixes a practice agrees to make while OCR checks on it. A civil money penalty is a fine that HHS imposes. Here are three of its actions.

The 2023 plan was strict. It required written privacy policies and training for all workers, including owners and managers. It required notices within 30 days. The notices had to go to everyone whose details were disclosed without a valid authorization. That covered disclosures on Google Reviews or any other internet platform. It also required reports to HHS and a revised Notice of Privacy Practices. That notice tells patients how the practice uses and shares their health details (HHS agreement page).

The OCR Director said in 2019: “Doctors and dentists must think carefully about patient privacy before responding to online reviews.” (2019 press release)

In 2023 the Director said OCR “continues to receive complaints”. These are about providers sharing patients’ health details online in reply to negative reviews. The Director added: “Simply put, this is not allowed.” (2023 press release)

If the reviewer shares their own details, can you reply to them?

You can reply, but not in kind. A patient who names themselves in a review has not given up their privacy. A reply must not confirm that the person is a patient. That holds even if they post under their real name (ADA guidance).

The ADA warns that fines might apply. This is true even if a reply only confirms that the reviewer was at the practice. It suggests broad “all patient” wording and an invitation to contact the office. A reply may state office policies, such as parking or booking online (ADA guidance).

So the reviewer’s own words give you no extra room. Treat every reply as if the reviewer had said nothing about themselves.

What are safe replies for common reviews?

Short and general. Thank the person, say the office cares, and move the talk to the phone. Never repeat what the reviewer wrote.

If a practice asked me for three rules for replying, they would be: reply quickly, be generous, and aim to solve the problem. Each rule has a limit here. Quickly means run the test first. Generous means warm thanks and goodwill, never extra details and never a reward. Solving the problem means moving it to a private call.

Run every reply through this five-point test before you post it:

1. No name for the reviewer.
2. No visit or “thanks for coming in”.
3. No date or time.
4. No care detail, such as a symptom or treatment.
5. No bill or insurance detail.

Illustrative examples, in a “say this, not that” form. The names, dates and details are made up.

The “say this” replies don’t answer the review point by point. That is on purpose. They say nothing about whether the person is a patient, and nothing about what happened.

When is it better not to reply at all?

When you can’t reply without sharing details, or when you’re not sure. The ADA says sometimes the right option is not to respond. It also says legal action should be a last resort (ADA guidance).

Some professions add their own rules. The American Counseling Association’s tip sheet tells counselors not to share confidential information on social media. That holds even in closed or private settings. It cites the 2014 Code of Ethics (ACA tip sheet). If you are a counselor or a therapist, check your own board and association before you reply to anything.

If you are unsure, wait and ask your privacy contact. A late, safe reply costs less than a quick, wrong one.

Which reviews can you report to Google?

Only reviews that break Google’s rules. Google says not to report a review just because you disagree with it. If a report is rejected, Google offers a one-time appeal through its Reviews Management Tool (Google Business Profile help).

Google’s content policy bans posting another person’s personal information, including medical information, without consent. It also bans content based on a conflict of interest. One example is a review from a competitor (Google content policy). Google’s help pages can change, so check the current page before you report.

What should you never do about a review?

Never threaten, never pay and never silence. Each of these can cause more harm than the review itself.

• Threats. The Federal Trade Commission (FTC) has a rule on consumer reviews. It is unlawful to answer a review with an unfounded legal threat. It is also unlawful to use a physical threat, intimidation, or a false public accusation. The accusation part covers one made knowing it is false, or with reckless disregard for the truth. That means not caring whether it is true. All four count when the aim is to stop the review or get it removed (16 CFR Part 465). The FTC says a business may reply in public but should watch what it says. It may threaten legal action only with a legitimate basis. The rule took effect October 21, 2024 (FTC questions and answers).
• Rewards. Google prohibits offering incentives in exchange for posting, changing or removing a review (Google reply tips).
• Gag clauses. The Consumer Review Fairness Act makes some form contract terms illegal. A form contract is a contract with standard terms that the customer has no real chance to negotiate (15 U.S.C. 45b). Some banned terms bar or restrict honest reviews. Others penalize a reviewer, or take rights to the review’s content (FTC guidance).
• Picking who may review. Google’s content policy does not let a business discourage or prohibit negative reviews. It also bars asking only happy customers for reviews (Google content policy).

Who should reply? A short reply policy for your office

One or two named people, trained, using a written test. The Privacy Rule requires written policies and procedures. It also requires training for all workers (45 CFR 164.530). In the 2019 case above, HHS pointed to the lack of a policy for social media replies (HHS press release).

On Google, a business must be verified before it can reply. A reply is public under the review. The reviewer is notified, and can still change their review. A business can edit or delete its own reply (Google Business Profile help). So write every reply as if the reviewer and the public will read it, because they will.

Template: review reply policy. This is a practical template, not legal advice. Change it to fit your office.

1. Who may reply. Name one or two people, such as the owner or the office manager, and one backup. No one else replies.
2. The test. Before posting, the writer checks the five points above and a second person reads the reply when possible.
3. Pass it on. Send some reviews to the privacy contact before you reply. These are reviews that mention care, a bill or insurance, and any you are unsure about.
4. When not to reply. If a safe reply isn’t possible, don’t reply. Report the review to Google if it breaks Google’s rules.
5. Keep a log. Write the date, who replied or why no one did, and the topic. Never put patient information in the log.
6. Train. Anyone who may reply reads this policy. Train new staff when they start.

Where does generic review advice go wrong for practices?

It tells you to be personal and specific. For a practice, that is the risk. Google’s own reply tips are written for every business, so each tip needs a practice version.

Next step

Clear answers before a bill or a call help patients. Start with which insurance plans you accept. Add the Good Faith Estimate notice. Then answer the routine questions patients ask. A new website from ClinicBuilds includes a Google Business Profile link-up.

This is general information, not legal advice. For help with your own site and listing, ask for a free presence review.