To respond to a negative review without breaking HIPAA, keep the reply short and general, never confirm the person was your patient, and invite them to call the office. Leave out their visit, treatment, condition and bill, even if they mentioned them first. Four practices have paid HHS between $10,000 and $50,000 over review replies that crossed that line. HIPAA is the federal law that protects patients' health information, and HHS is the agency that enforces it.
A bad review stings, and the urge to set the record straight is strong. The safe reply is also the one that reads best to the next patient scrolling your listing. For practices on our managed marketing plans, we set replies up this way: a drafted reply, a human approval and a private follow-up path. See how our reputation management for medical practices works.
Why Can't You Just Answer the Review?
Because HIPAA protects more than diagnoses. Protected health information (PHI) is health information tied to a specific person, and that includes the fact that someone received care from your practice. A reviewer can tell their own story in public. Your practice cannot confirm it, correct it or add to it, because each of those discloses that person's information.
That is why "We're sorry your crown didn't fit" is a problem and "We're sorry to hear you're unhappy" is not. The first confirms a patient and a treatment. The second responds to what the reviewer said without confirming anything.
What Happened to Practices That Replied With Details
HHS has published four cases where a practice's public replies led to a settlement or penalty:
| Practice | Year | What HHS found | Amount |
|---|---|---|---|
| Dental practice, Texas | 2019 | Disclosed patients' information on social media | $10,000 settlement and a corrective action plan |
| Dental practice, North Carolina | 2022 | Disclosed a patient's information on a webpage in response to a negative online review | $50,000 civil money penalty |
| Dental practice, California | 2022 | Disclosed patients' information in social media replies to reviews | $23,000 settlement |
| Psychiatric practice, New Jersey | 2023 | Disclosed a patient's information in a reply to a negative online review; also lacked required privacy policies | $30,000 settlement and a corrective action plan |
None of those replies needed the details to do their job. A two-sentence reply and a phone number would have protected the practice and still shown future patients that someone is listening.
The HIPAA-Safe Reply Formula
- Thank them. Thank the reviewer for taking the time to share.
- Acknowledge without confirming. Respond to the feeling, not the facts: "We're sorry to hear you're unhappy."
- State your standard. One general line about how your practice works, such as keeping appointments on time or explaining costs clearly.
- Move it private. Give the office phone number and a role to ask for, never the person's name.
Keep it to three or four sentences. A long reply invites detail, and detail is where practices get into trouble.
Five Reply Templates for Common Complaints
Swap in your office phone number and the right role. Each one follows the formula and confirms nothing.
A long wait: Thank you for taking the time to share this. We work hard to keep appointments on schedule, and we know waiting is frustrating. Please call our office manager at [office phone] so we can hear more.
A billing complaint: Thank you for the feedback. Billing questions deserve a complete answer, and we can't give one here. Please call our billing team at [office phone] and we'll look into it with you.
Unhappy with care or results: We're sorry to hear you're unhappy. We take every concern seriously and would like to talk with you directly. Please call [office phone] and ask for our practice manager.
A rude staff member: Thank you for letting us know. Courtesy matters to everyone on our team, and we want to understand what happened. Please reach us at [office phone].
A reviewer you don't recognize: Thank you for the feedback. We want to understand every concern raised about our practice. Please contact our office at [office phone]. Do not write that you have no record of them; confirming or denying is the same problem in reverse. If you believe the review breaks Google's content policies, flag it.
What Never to Say in a Public Reply
- The person's name, or anything that shows they were seen: a date, a provider, a room, "at your visit"
- Any treatment, procedure, medication, test or diagnosis, even one they named
- Insurance, balances, payments or anything from their bill
- "Our records show" or "we have no record of you"
- Corrections of their account, however wrong it is
- Anything you would not say to the reviewer's employer
Who Should Write and Approve Replies
Give one person the job of drafting replies and a second person the job of approving them. The approver checks one thing above all: does this confirm a visit, a treatment, a date or a bill? If it does, it does not post.
Take the concern seriously in private. The phone call is where you can actually fix things, and what you hear across reviews tells you what to fix in the office. Asking for reviews is the other half of the job; done fairly, it means one bad review sits among many honest ones. See how to get more Google reviews the HIPAA-safe way. Our Google Maps ranking checklist covers how reviews affect where you show up.
Responding to Negative Reviews at a Glance
| Do | Don't |
|---|---|
| Thank the reviewer | Argue or correct their account |
| Respond to how they feel | Confirm they were a patient |
| Give one general line about your standards | Mention a treatment, date, provider or bill |
| Offer the office phone number and a role | Use their name or say you have no record of them |
| Have a second person approve the reply | Post while you are still upset |
| Flag reviews that break Google's policies | Offer anything in exchange for removing a review |
Common Questions About Responding to Negative Reviews
Can a doctor respond to a negative review?
Yes, as long as the reply does not confirm the person was a patient or add any detail about their care. A short thank-you, a general line about your standards and an invitation to call the office is a safe reply.
What if the patient already shared their own health information in the review?
You still cannot confirm it or add to it. Patients can tell their own story, but HIPAA limits what your practice discloses, and repeating, correcting or explaining their details in a public reply is a disclosure by your practice.
Can I get a negative review removed from Google?
You can flag a review you believe breaks Google's content policies, and Google decides whether it comes down. Plan to reply either way, because a calm, general reply is something every future patient will read.
Should I respond to every negative review?
Reply to most of them. Google says helpful replies show you're responsive to your customers. Skip a public reply only when the review could not be answered without details, and handle that person privately.
Who should write review replies at a medical practice?
One named person drafts them and a second person approves them before they post. The approver checks one thing above all: that the reply does not confirm a visit, a treatment, a date or a bill.
What to Do This Week
Open your Google Business Profile and read your last ten replies to reviews. Mark any that name a treatment, a date, a provider, a bill or the person. Edit those down to the formula above, or delete them. Then pick the person who drafts and the person who approves from now on.
This article is general information, not legal advice. Your compliance advisor has the final word on your practice's policies.
Sources
- U.S. Department of Health and Human Services. Dental Practice Pays $10,000 to Settle Social Media Disclosures of Patients' Protected Health Information, October 2, 2019.
- U.S. Department of Health and Human Services. Civil money penalty against a North Carolina dental practice for disclosing a patient's information in response to a negative online review, March 28, 2022.
- U.S. Department of Health and Human Services. Settlement with a California dental practice over disclosures of patients' protected health information, December 14, 2022.
- U.S. Department of Health and Human Services. Settlement with a New Jersey psychiatric practice for disclosing a patient's information in response to a negative online review, June 5, 2023.
- U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule (what counts as protected health information). Content last reviewed March 14, 2025.
- Google Business Profile Help. Manage customer reviews (replying to and flagging reviews), accessed October 2026.