Can You Reply to a Patient Review Without Breaking HIPAA?

The HHS Office for Civil Rights has repeatedly penalized healthcare providers for what they wrote in reply to online reviews.

A California dental practice paid $23,000 and accepted a two-year corrective action plan after responding to Yelp reviews with patient names, visit details and insurance information. Two other dental practices settled at $50,000 and $10,000. A psychiatric practice was penalized over a reply to a single Google review that referenced the patient’s diagnosis and treatment.

None of these were malicious. They were practices defending their reputation against a review they felt was unfair.

The two things almost everyone gets wrong

1. Confirming someone was a patient is itself a disclosure

This is the one that catches careful people. “Thank you for trusting us with your mother’s care” feels warm and harmless. It also confirms a treatment relationship, which is protected health information. You don’t have to mention a diagnosis to have made a disclosure.

2. A patient identifying themselves publicly does not authorize you to respond in kind

This feels deeply unfair, and it’s the trap that caught several of the practices above. The patient posted first. The patient named themselves. The patient described their treatment. The practice replied with detail, and the practice was fined.

Their waiver of their own privacy is not your authorization to disclose. The obligation sits with you regardless of what they’ve already said.

The test that keeps you safe

Here’s the simplest rule we’ve found.

A compliant reply never

• Confirms or denies that the person, or their relative, received services
• Names a condition, treatment, service, visit date or staff member in a care context
• Corrects factual claims about the care, however wrong the review is
• Reveals anything not already public, even if the reviewer revealed it first

Templates that work

That’s the whole reply. Nothing else.

We know how unsatisfying that is when the review is unfair. The urge to add context is exactly what produced every settlement listed above. Move it offline, where you can say what you like.

A review that appears fake: use the same wording as the negative template. Do not write “you were never our patient,” because that is itself a statement about who is and isn’t a patient. Report it to the platform privately and say nothing publicly.

You should still ask for reviews

None of this means avoid reviews. The opposite.

The Google patent describing local ranking counts documents carrying reviews of your practice as one of five prominence factors. Documents, not star rating. Being reviewed in five places beats being reviewed brilliantly in one.

Asking is fine. Google explicitly permits it. What’s prohibited is offering anything of value in exchange, asking only the patients you expect to be happy, or telling someone what to write.

The question worth asking this week

Who currently replies to your patient reviews? A receptionist, a practice manager, a marketing agency, an automated reputation tool?

And do they have a compliance rail, or are they writing whatever feels right?

If it’s the second one, that’s worth ten minutes of your time today.