Patient Reviews for Doctors, Therapists, and Clinicians: Replying Without Breaking Privacy Rules

Why clinicians are different

Most business owners can reply to a review with a few facts: "We arrived at 10:15, not noon." Health care providers usually cannot. Under HIPAA, covered entities such as most doctors, dentists, therapists, and practices must protect patients' health information. Confirming that someone is a patient, describing their visit, or discussing their treatment in a public reply can be a disclosure of protected health information.

Many clinicians are surprised that the patient's own public post does not change this. A patient choosing to share their story does not authorize you to share yours.

What HHS enforcement shows

The HHS Office for Civil Rights has announced settlements with practices that disclosed patient information while responding to online reviews.

Manasa Health Center. HHS announced an agreement with Manasa Health Center, a psychiatric practice in New Jersey, after an investigation found the practice had disclosed patient information in responses to online reviews. The practice paid $30,000 to HHS and agreed to a corrective action plan.

New Vision Dental. HHS announced an agreement with New Vision Dental after finding it had disclosed patient information in response to online reviews. The practice paid $23,000 and agreed to a corrective action plan.

These are real cases involving small practices, not large hospital systems. The amounts and corrective plans show that HHS treats review replies as a serious privacy matter.

What a safe reply looks like

A safe reply does not confirm the relationship and does not describe anything about care. It speaks about your practice in general.

A generic template:

"Thank you for your feedback. Our practice takes patient concerns seriously and is committed to providing respectful, high-quality care. Because of privacy rules, we cannot discuss any individual's situation online. If you'd like to talk, please contact our office manager at [phone]."

For a review about wait times or scheduling:

"Thank you for sharing this. We work hard to keep appointments on schedule and know how frustrating delays can be. We welcome feedback directly at [phone] so we can keep improving."

For a review about billing:

"Thank you for your review. We want billing to be clear and fair. Anyone with a billing question is welcome to call our billing office at [phone]."

Notice what these replies avoid: no "we're sorry your treatment didn't work," no "as we discussed at your appointment," no mention of dates, diagnoses, medications, or insurance.

What not to say

Avoid replies that:

Even a reply meant to be kind can disclose information. "We're glad your surgery went well despite the delay" confirms a patient relationship and a procedure.

• Confirm the person is a patient: "We remember your visit."
• Describe care: "We prescribed the standard treatment for your condition."
• Correct the patient's account with clinical details: "You missed three follow-up appointments."
• Mention other people involved: family members, staff, or other providers.
• Suggest the patient is difficult, noncompliant, or dishonest.

Should you reply at all?

Some practices choose not to reply to individual reviews and instead post a general statement on their profile. Others use a consistent generic reply. Either approach can work. What matters is consistency, a written policy, and that whoever replies on behalf of the practice has been trained.

If a review is extremely detailed or emotional, a reply may draw more attention to it. Sometimes the best response is a private outreach through normal patient communication channels, with no public reply at all.

Deciding case by case

Not every review needs the same treatment. A short complaint about parking or phone wait times is easy to answer generically. A long, emotional account of a diagnosis or a family member's care is different, and a public reply may only keep it at the top of your profile. For a general framework on weighing whether a public reply helps, see should you respond to negative posts? The privacy rules in this article still apply to any reply you do post.

Following up privately

If you know who the reviewer is, you can reach out through the same secure channels you would normally use to communicate with that patient. Listen to the concern. Resolve billing or scheduling problems if you can. Do not ask the patient to remove or change their review as a condition of anything.

Reporting reviews that break rules

Platforms remove reviews that violate their policies. On Google, prohibited content includes harassment, hate speech, threats, certain personal information, and unsubstantiated allegations of crimes. A review that disagrees with your care is not a violation. A review that contains threats against staff or reveals another person's private information may be.

See how to report a fake Google review for the process. Reporting does not involve any public statement, so it does not raise the same privacy issues as replying.

Encouraging balanced reviews

A few negative reviews look very different next to many recent, genuine ones. You can encourage reviews in a compliant way:

Check with your compliance officer before setting up any review request process, since it involves patient contact information.

• Ask all patients, not just happy ones. Google's policy prohibits selectively soliciting positive reviews.
• Do not offer incentives tied to reviews.
• Use general reminders, such as a sign or a link in a post-visit message, instead of singling out particular patients.
• Avoid revealing health information in the request itself. A text that says "How was your visit for [condition]?" is a disclosure.

Professional profiles that help

Your search results include more than reviews. Profiles you control can add accurate context:

For a more complete search presence, see knowledge panels for yourself and responding to reviews about you personally.

• Your practice or hospital bio with training, specialties, and languages.
• A Google Business Profile as an individual practitioner. Google's guidelines name doctors and dentists as examples of individual practitioners who may have their own profile.
• Professional directory listings, kept up to date.
• Speaking, teaching, or publications that reflect your expertise.

Writing a simple review policy

Both HHS agreements included corrective action plans, which typically require written policies and training. You do not need to wait for an investigation to put the basics in writing. A one-page review policy for a small practice can cover:

Keep the policy short enough that people actually read it. The goal is that nobody, on a busy afternoon, types a well-meant reply that confirms a patient's visit.

• Who may reply. Name the one or two people allowed to post replies on behalf of the practice, and the person they check with before posting.
• The approved wording. Include two or three generic replies that have been reviewed, and require that any new wording be approved before use.
• What never appears in a reply. List it plainly: names, dates of service, conditions, treatments, medications, insurance, billing amounts, family members, and any confirmation of a patient relationship.
• How private follow-up works. Describe which secure channels staff may use to contact a patient who posted a review, and who makes that decision.
• When to escalate. Reviews that include threats, mention staff by name in a harassing way, or make allegations of crimes go to the practice manager or compliance contact.
• Training. Everyone who can access your review profiles reviews the policy once a year and signs off.

Personal accounts

Clinicians are sometimes reviewed or discussed on their own social media accounts, not just the practice's profile. The same rule applies there: do not discuss or confirm any patient's care, even in a private-looking reply or a comment that seems minor. Consider keeping personal accounts private and separate from your professional presence.

Therapists and mental health providers

Mental health providers face extra sensitivity. A public reply can confirm that someone sought mental health care, which can be especially harmful to the patient. The Manasa case involved a psychiatric practice. Many therapists choose not to reply to reviews at all, or to use a single generic statement. Professional ethics codes for counselors and psychologists may also address client confidentiality online, so check the code that applies to your license.

If a review includes false claims

Sometimes a review claims something that did not happen, such as a statement that you were intoxicated or that you committed fraud. You still cannot respond with clinical details. Options include:

Legal action over reviews is complicated and can draw more attention. Get advice before taking that step.

• Reporting the review for unsubstantiated allegations.
• Posting a generic reply that does not engage with specifics.
• Talking with a health care attorney about whether further action is appropriate.

Common questions

Sources

1. HHS Office for Civil Rights Reaches Agreement with Health Care Provider in New Jersey (Manasa Health Center) (U.S. Department of Health and Human Services)
2. New Vision Dental resolution agreement (U.S. Department of Health and Human Services)
3. Prohibited and restricted content (Google Maps User Generated Content Policy)
4. Guidelines for representing your business on Google (Google Business Profile Help)
5. Report inappropriate reviews on your Business Profile (Google Business Profile Help)