The rule: say nothing that shows they are your patient
Under HIPAA, a dental or medical practice may not disclose protected health information except where the Privacy Rule allows it. HHS has made clear a review reply isn't one of those cases.
"A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart..." (45 CFR 164.502(a))
Health information is covered when it relates to someone's condition, "the provision of health care to an individual", or payment for it, and identifies them (45 CFR 160.103). A reply under someone's review is tied to their name or profile, so a reply that discusses their visit identifies them.
HHS's Office for Civil Rights (OCR) put it plainly when it settled with a California dental practice:
"Providers cannot disclose protected health information of their patients when responding to negative online reviews. This is a clear NO." (HHS press release, December 14, 2022)
So a reply should not include:
- that the person is or was a patient ("we checked your chart", "when you came in")
- dates, procedures, diagnoses or what was said in the chair
- insurance, balances, payment plans or collections
- the person's real name, if they posted under a nickname
What practices paid HHS to settle
Each case started with a complaint about a reply.
| Practice | Year | Where | What the reply disclosed | Paid |
|---|---|---|---|---|
| Elite Dental Associates, Dallas | 2019 | Yelp | A patient's last name and details of their health condition; other patients too | $10,000 |
| New Vision Dental, California | 2022 | Yelp | Patient names, treatment and insurance information | $23,000 |
| Manasa Health Center, New Jersey (psychiatry) | 2023 | Google Reviews | Information of four patients, including a diagnosis and treatment | $30,000 |
Each practice also agreed to a two-year corrective action plan. Every case also cited missing privacy policies and procedures. Elite had no policy to make sure "its social media interactions protect the PHI of its patients" (HHS press release, October 2, 2019). New Vision and Manasa also had to send breach notices to the patients whose information they had posted (New Vision and Manasa resolution agreements).
In the New Vision case, the complaint said the dentist used full names "where only Yelp monikers were used by the patients" and added visit and insurance details the reviews had not mentioned (HHS resolution agreement).
HIPAA compliant Google review responses: what to write
Write one reply that would be true whether or not the person was ever your patient. Google's own advice fits: keep it short, and "Never share a reviewer's private information or engage in personal attacks" (Google Business Profile Help). Google also suggests asking the reviewer to contact you by phone or email when a situation is complex.
| Instead of | Write |
|---|---|
| "You missed two appointments, so we charged the fee." | "Our cancellation policy is posted at the front desk and on our website." |
| "Your insurance denied the crown, not us." | "Billing questions are best handled privately. Please call our office manager." |
| "Mrs. Lee, we're sorry your extraction hurt." | "We're sorry to hear this. We want every visit to be comfortable." |
| "We have no record of you." | Leave this out. Saying who is not a patient is still a statement about who is. |
A reply that works for most bad reviews:
"Thank you for the feedback. Privacy law keeps us from discussing anyone's care online. We take every concern seriously, and we'd welcome a call to [office phone] so we can talk directly."
Good reviews follow the same rule. "Thanks for the kind words!" is safe. "Glad your implant healed well, John!" names a treatment.
Can I get a bad review removed?
Only if it breaks Google's content policies. Google says "only those that violate Google policies are eligible for removal", and it will not remove a review because you disagree with it (Google Business Profile Help). Report a violating review with Google's Reviews Management Tool; don't answer it with chart details to prove it wrong.
Canada: Ontario's health privacy law
In Ontario, the Personal Health Information Protection Act (PHIPA) covers health care practitioners who belong to a regulated health college, such as dentists (PHIPA s. 2 and 3). Its definition of personal health information includes information that relates to providing health care to someone, "including the identification of a person as a provider of health care to the individual" (PHIPA s. 4(1)(b)). A custodian "shall not collect, use or disclose personal health information about an individual" without consent unless the Act permits it (PHIPA s. 29). So in Ontario, even "you were seen by Dr. Smith" names the patient-provider link the law protects. The Royal College of Dental Surgeons of Ontario tells dentists: "Do not post identifiable patient information online" (RCDSO practice advisory: Professional Use of Social Media). Its own example is a dentist who answered a bad review with photos of the patient's mouth; the patient had agreed to photos on the dentist's website, not elsewhere (RCDSO: Use of social media). This section covers Ontario only; other provinces have their own laws.
Example
A one-star review about a bill
A reviewer writes that the practice "overcharged" them $400. The front desk drafts "Your plan only covered 50% of the filling." That names the treatment, the insurance and the balance. The safe version says billing questions are handled privately and gives the office number.
A fake review from a non-patient
Someone who was never seen posts that the dentist was rude. Replying "We have no record of you" is still a statement about who is a patient. Report it to Google as a possible policy violation and post the same general reply you use for every review.
A staff member replies from their phone
A hygienist answers a review and names the patient. This is how the cases above started. A short written policy, one approved reply, and one person who posts replies make it hard to repeat.
Different for you?
- Asking patients for reviews by text or email has its own rules: asking for reviews.
- Lawyers face a similar rule under bar ethics: lawyer responding to a negative review.
- Using reviews or testimonials on your own site as a therapist: therapist testimonials.
- An Ontario dentist using reviews in ads or on the website: RCDSO advertising rules.
- Want more good reviews to outweigh the bad: see the SEO & GEO Agent.