Short answer: You can and should reply to patient reviews, but never in a way that reveals protected health information. Don’t confirm the person is a patient, don’t mention any detail of their visit or treatment, even if they posted it themselves, and move any real discussion offline. A short, general, professional reply is both safe and good for your reputation.
Online reviews decide which dentist, doctor or clinic a new patient calls, and replying to them shows prospective patients that you care. For healthcare practices, though, replies carry a risk most businesses don’t face: the HIPAA Privacy Rule.
This guide explains what HIPAA means for review responses, what has gone wrong for other practices, and how to reply safely, with templates you can adapt.
Why review replies are a HIPAA issue
Under HIPAA, a practice may not disclose a patient’s protected health information without authorization, except in specific circumstances. Protected health information includes far more than medical records. The fact that someone is your patient, and any detail of their visit, is protected.
The key point: a patient posting about their own care does not give you permission to discuss it. They can share their information; you still can’t share it back.
What happened to practices that got it wrong
The HHS Office for Civil Rights (OCR), which enforces HIPAA, has acted against dental practices over review replies:
- Elite Dental Associates (Dallas) paid $10,000 after OCR found it had disclosed patients’ protected health information in replies to Yelp reviews, including a patient’s last name and details of their condition. It also agreed to a corrective action plan.
- New Vision Dental (California) settled with OCR for $23,000 over patient information disclosed in responses to online reviews.
In both cases the replies were attempts to defend the practice. That is the most common way practices get into trouble: a frustrated reply to a negative review that explains “what really happened”.
What not to include in a reply
- The reviewer’s name, or any confirmation that they are or were a patient.
- Dates of visits, appointments or treatment.
- Any treatment, diagnosis, condition, medication or insurance detail.
- Billing amounts or payment history.
- Anything from the patient’s chart or your conversations with them.
- Details from staff who “remember the case”.
Also avoid phrasing that confirms care indirectly, such as “we’re sorry your crown didn’t fit” or “as we explained at your appointment”.
How to reply safely
Good replies are short, general and would make sense whether or not the reviewer was ever a patient. They:
- Thank the person, or acknowledge their feedback.
- State your practice’s standards or values in general terms.
- Invite them to contact the office directly, with a phone number or the office manager’s name.
Templates you can adapt
Positive review
Thank you for taking the time to share this. Our team works hard to make every visit comfortable, and we appreciate the kind words.
Neutral or mixed review
Thank you for your feedback. We’re always looking for ways to improve, and we’d welcome the chance to hear more. Please call our office manager at [phone].
Negative review
We take all feedback seriously and are committed to providing excellent care and service. We can’t discuss specifics online, but we’d like to talk with you directly. Please call our office manager at [phone].
Review you believe is fake or from someone who was never a patient
We take all feedback seriously. We would like to understand this better, so please contact our office manager at [phone].
Notice what these replies don’t say: none of them confirm a visit, and none of them argue the facts.
Handling unfair or false reviews
- Don’t argue publicly. Correcting the record almost always means discussing care.
- Report rule-breaking reviews to the platform. Google, Yelp and others remove reviews that are fake, abusive, off-topic or posted by competitors.
- Respond offline. If the person calls, resolve the issue privately, following your normal privacy procedures.
- Let your other reviews speak. A steady flow of genuine reviews puts any single negative one in context.
Getting more reviews, the compliant way
The best answer to a negative review is many genuine positive ones:
- Ask every patient after their visit, with a direct link to your Google profile, by text or email.
- Don’t offer discounts, gifts or entries into prize draws for reviews.
- Don’t ask only patients you expect to be happy, and don’t filter who gets the request.
- Never write, edit or post reviews on a patient’s behalf.
These rules come from Google’s review policy and the FTC’s rule on consumer reviews and testimonials, which took effect in October 2024 and lets the FTC seek civil penalties for fake reviews.
If you use software to send review requests or manage replies, make sure the vendor will sign a business associate agreement (BAA) if it handles patient information.
Put it in writing for your team
Whoever replies to reviews, whether the dentist, office manager or an agency, should follow a written policy:
- Who is allowed to reply, and who approves replies to negative reviews.
- The approved templates.
- The list of things never to mention.
- What to do with fake or abusive reviews.
- Staff training, refreshed regularly.
The bottom line
Reply to every review, briefly and kindly, and never reveal anything about the person’s care, not even that they are a patient. Take real conversations offline, report reviews that break platform rules, and keep genuine reviews coming. It protects your patients, your license and your reputation at the same time.
This guide is general information, not legal advice. For questions about your specific situation, speak with your compliance advisor or a healthcare attorney.
Want help building a review program that is effective and compliant? See our dental marketing service and our dental SEO guide.