Responding to Patient Reviews Without Violating HIPAA

The safest rule for answering online reviews is simple: never confirm that the reviewer is your patient, and never mention anything about their care. That holds even when the patient posted their own name, their own treatment details and a photo of their crown. The review is their disclosure. Your reply is yours.

Where dental reviews and HIPAA meet, most practices get in trouble the same way. Someone posts an unfair one-star review, the doctor or office manager feels attacked, and the reply "corrects the record" with appointment dates, treatment notes or a balance owed. The HHS Office for Civil Rights has taken enforcement action against dental practices for exactly this kind of reply, so it's not a theoretical risk.

This guide covers what counts as a disclosure, how to answer common review types safely, and how to set a written policy so nobody at the front desk has to improvise. It's general information, not legal advice. Have your healthcare attorney or compliance advisor review your policy before you adopt it.

Why a review reply can be a HIPAA disclosure

HIPAA protects identifiable health information that your practice holds. The fact that a specific person is your patient is itself protected information. So a reply that says "We're sorry you were unhappy with your visit last Tuesday" has already confirmed a patient relationship, a visit and a date.

Many dentists assume that once a patient goes public, the information is fair game. It isn't. The patient can say whatever they like about themselves. Your practice is still bound by its obligations, and a public review doesn't count as the patient's authorization for you to discuss their care.

What counts as protected information in a reply

Watch for any of these in a draft response:

Confirming the person is or was a patient ("Thanks for being with us since 2019")
Visit details: dates, times, which provider they saw, which operatory
Treatment details: procedures, diagnoses, x-rays, medications, sedation
Financial details: balances, insurance plan, claim status, payment plans
Behavioral details: missed appointments, late arrivals, how they acted at the desk
Anything that combines with the review to identify them further

A good test: if a stranger read only your reply, could they learn anything about this person's relationship with your office that they didn't already know from the review? If yes, rewrite it.

The do and don't table for HIPAA-safe review responses

Situation	Risky reply	Safer reply
Five-star review	"So glad your implant healed well, Maria!"	"Thank you for the kind words. Our team works hard to make every visit comfortable."
Billing complaint	"Your insurance denied the claim, which we explained at checkout."	"We take billing questions seriously. Please call our office manager so we can look into this directly."
Pain or outcome complaint	"Post-op sensitivity is normal after a root canal, as we told you."	"We're sorry to hear this. We'd like to talk with you directly. Please call us at your convenience."
Wait time complaint	"You arrived 20 minutes late, which pushed back your cleaning."	"We work to keep our schedule on time and appreciate the feedback. We'd welcome a call to discuss it."
Reviewer you can't find in the PMS	"We have no record of you as a patient."	"We take all feedback seriously but can't match these details to our records. Please contact our office so we can understand what happened."

Notice the last row. Even saying someone is not a patient can backfire, because it implies you checked and it suggests what you'd say about someone who is. Keep the reply neutral either way.

Templates for the reviews you'll actually get

Use these as starting points. Change a few words each time so your profile doesn't fill up with identical replies, which reads as canned to patients.

Positive review, general

"Thank you for taking the time to share this. Our whole team appreciates it, and we're glad to hear the experience was a good one."

Positive review that mentions a specific treatment

The patient may write "Dr. Lee did my veneers and I love them." Don't echo the treatment back.

"Thank you so much for the kind words. We'll pass them along to the team. Comments like this make our week."

Negative review about cost or insurance

"We're sorry for the frustration. Billing and insurance questions deserve a real conversation, and we can't have that here. Please call our office and ask for our office manager, who will be glad to help."

Negative review about clinical care

These are the ones that tempt doctors to explain. Resist it.

"We're concerned to read this and want to understand what happened. Please contact our office directly so we can speak with you privately."

Review you believe is fake or from a competitor

"We take every review seriously. We can't match these details to anything we're aware of, and we'd welcome a call so we can understand the concern."

Then flag the review through your Google Business Profile for removal if it breaks Google's content policies. Our guide to responding to negative dental reviews covers the tone and flagging side in more detail.

Take the conversation offline, then handle it properly

The public reply exists for future patients reading your profile. Its job is to show you're calm, professional and reachable. The real work happens on the phone.

When the reviewer calls:

Have the office manager or doctor take the call, not whoever answers first at 8:05 am.
Verify identity the way you would for any patient call before discussing anything.
Listen first. Many reviewers mostly want to be heard.
Document the conversation in the patient record according to your normal process.
If you resolve it, you may ask whether they'd consider updating their review. Don't make a refund or credit conditional on changing or removing the review.

That last point matters for more than HIPAA. Trading money for a review change creates its own problems under Google's policies and the FTC's rules on consumer reviews.

Write a review response policy before you need one

Most HIPAA review mistakes happen fast, at night, by someone who was upset. A short written policy prevents that.

What your policy should cover

Who can respond. Name one or two people. Associates, hygienists and front desk staff shouldn't reply from personal accounts or the practice account.
Response timing. Something like "within two business days" for most reviews. Waiting a day on an angry review is a feature, not a bug.
Approved templates. Keep the templates above (or your attorney's version) in a shared document.
Second-reader rule for negative reviews. Nobody posts a reply to a one- or two-star review without another person reading it first.
Escalation. Threats, legal language or claims of injury go to the doctor-owner and, if needed, your attorney or malpractice carrier before any public reply.
Training. Cover the policy at onboarding and revisit it at a team meeting once a year.

Put the policy in your HIPAA documentation binder alongside your other privacy policies. If your compliance advisor runs annual training, ask them to include review responses.

Other places this same mistake shows up

Review sites aren't the only exposure. The same principle applies anywhere the public can see your reply.

Facebook and Instagram comments. A patient comments "Thanks for fitting me in for that emergency!" Liking it is fine. Replying "Hope the tooth feels better, see you at your follow-up" is not.
Direct messages. DMs aren't a secure channel for treatment discussions. Move them to a phone call or your secure patient communication system.
Website testimonials. If you want to feature patient comments on your own site, get written authorization first. Our piece on showing reviews on your dental website walks through how to do it properly.
Staff personal accounts. A hygienist replying to a review from their personal profile is still a workforce member disclosing information. Your policy should say so.
Photos. Smile photos, even cropped, can identify people. See our guide to using before-and-after photos responsibly.

What to do if you already posted a risky reply

It happens. If you find an old reply that confirms a patient relationship or discusses treatment:

Edit or delete the reply now. Replace it with a neutral version if you want a public response to remain.
Write down what was posted, when, and when you removed it.
Talk to your compliance advisor or healthcare attorney about whether it needs to be assessed as a potential breach under your policies.
Use it as a training example (without names) at your next team meeting.

Don't panic and don't ignore it. A documented, prompt correction is far better than leaving the reply up.

Frequently asked questions

Can a dentist respond to a Google review at all under HIPAA?

Yes. HIPAA doesn't stop you from replying to reviews. It limits what you can say. A general, polite reply that doesn't confirm the person is a patient or mention their care is generally considered safe. Check your specific policy with your compliance advisor.

If the patient posted their own treatment details, can I reference them?

No. The patient's choice to share their own information doesn't authorize your practice to discuss it. Respond as if you know nothing about the reviewer beyond what any member of the public could see, and avoid repeating or confirming the details.

Is thanking a patient by name a HIPAA violation?

It can be, because it confirms they're your patient. The safer approach is a reply that thanks the reviewer without using their name or referencing their visit. Many practices simply open with "Thank you for the kind words."

Should we reply to every review?

Replying to most reviews shows prospective patients that someone is paying attention. You don't have to reply to every one, and some reviews (especially hostile ones with legal language) are better handled by your attorney first. Consistency matters more than replying within the hour.

Can we ask a patient to remove a negative review?

You can ask politely after you've resolved their concern, but don't pressure them and never tie a refund, discount or favor to removing or changing the review. That can run afoul of Google's review policies and the FTC's rules on consumer reviews, separate from any HIPAA question.