How to reply to patient reviews without disclosing anything
Why review replies matter for your Google profile, the one rule that protects patient privacy, four reply templates you can use as written, what to do with false reviews and when to escalate.
Roger de OcaFounder, DEOCAs7 min readIn this article
A physician reads a one-star review on a Friday afternoon. It describes a visit that, from the physician’s side, went completely differently. The instinct is to reply with the facts: the patient was late, the test was ordered, the prescription was sent. Every one of those facts is a disclosure, and replying with them is how practices end up in the news for something other than medicine.
This article covers why replies matter, the single rule that keeps every reply safe, four templates written to be used as they are, what to do when a review is false or was never written by a patient, and when a review should leave the front desk and go to someone else.
Why replies matter for your Google profile
Reviews are the most visible part of your Google Business Profile, and replies are the part of it you control completely. Google encourages owners to respond, and a profile with recent, answered reviews reads as an active practice both to Google and to the patient comparing three offices on the map. More important, the audience for your reply is not the person who wrote the review. It is every future patient who reads it. They are judging how you handle complaints, not whether you won the argument.
An unanswered negative review says the practice did not notice or did not care. A defensive one says the practice argues with patients. A short, calm, private-by-design reply says the practice is run by adults. That is the whole objective.
The rule: never confirm that anyone is a patient
Federal privacy law treats the fact that a person received care from you as protected information, in the same category as the diagnosis itself. A reviewer publishing their own story does not release you to discuss it. When they write “Dr. Lee dismissed my back pain”, you cannot reply “we ordered an MRI at your visit”; you cannot reply “you were seen on the 12th”; you cannot even reply “we are sorry your visit went badly”, because that confirms there was a visit.
Federal regulators have taken enforcement action against practices for review replies that confirmed patient status or described care, and a single reply is enough. The rule is simple, and it applies to five-star reviews too: reply as if you do not know whether the reviewer has ever set foot in your office.
Four reply templates you can use as written
Each template is written to say something and disclose nothing. Adjust the tone to your practice; do not add specifics.
1. Positive review
“Thank you for taking the time to write this. Kind words like these mean a great deal to our whole team, and we appreciate you sharing them.”
2. Negative review about care or outcome
“Thank you for sharing this. We take every comment seriously, and we want to understand what happened. Privacy rules do not allow us to discuss any individual’s care here, but our practice manager would welcome a direct conversation at the office number listed on this page.”
3. Negative review about wait times, billing or the front desk
“We appreciate the feedback. Wait times and scheduling are things we work on constantly, and comments like this help us see where we fall short. If you would like to discuss your experience, our office manager is available at the number on this page.”
4. Review that appears to be false or mistaken
“Thank you for your comment. We are unable to locate any record matching this description, and we take every concern seriously. If you believe you have reached us in error or would like to discuss this directly, please contact our office manager at the number on this page.”
Notice what none of the four contains: the word “your” attached to a visit, a diagnosis, a doctor’s name, a date, or any sentence that starts with “actually”.
What to do with false reviews
Some reviews are not from patients: a former employee, a competitor, someone who confused two practices with similar names, or a bot. Google removes reviews only when they violate its policies, which cover spam, fake accounts, conflicts of interest, off-topic content and harassment. “It is unfair” or “it did not happen that way” are not grounds.
- Flag the review from the profile using the report option, choose the policy it violates and describe it in one or two factual sentences.
- Reply publicly with template four while the report is pending. A false review left unanswered looks true.
- Do not accuse the reviewer of lying in public, and do not name who you think wrote it.
- If the review is defamatory or part of a pattern, keep screenshots with dates and bring them to counsel.
- Never ask staff, family or friends to post reviews to bury it. Google detects clusters, and a suspended profile is far worse than one bad review.
When to escalate, and to whom
One person at the practice should own review replies, with a second person as backup. Everyone else should know that they do not reply. Beyond that, some reviews should not be answered from the front desk at all.
Do
- Send any review that mentions a specific clinical error or harm to the physician and to whoever handles risk or compliance before replying
- Send any threat of a lawsuit, a licensing board complaint or media contact to counsel
- Send any review that names an employee to the practice manager
- Reply to everything else within a few business days using the templates
Don’t
- Let a physician reply to their own negative review in the heat of the moment
- Reply from a personal account
- Offer refunds, discounts or free visits in a public reply
- Try to turn off reviews or delete the profile, which Google does not allow and which would hide the positive ones anyway
Written like this, the process fits on one page taped near the front desk. Most practices need it exactly once, the day the first bad review arrives and everyone wants to answer it.
A note on asking for reviews
The best defense against a single negative review is a steady flow of honest positive ones. Ask patients at checkout, with a card or a text that links directly to the profile, and ask everyone, not only the ones who seem happy. Google’s rules prohibit offering anything in exchange and prohibit asking only satisfied patients. Federal consumer rules point the same way. A simple, consistent ask does the work.
If reviews, the profile and the website feel like three separate problems, they are one problem seen from three sides. Our healthcare digital consulting covers the reply process, the ask-for-reviews routine and the profile together, and we reply to every inquiry within one business day. Start by telling us where it hurts.
Frequently asked questions
Can I reply to a positive review by thanking the patient by name?
Reply, but do not use their name, do not confirm they were a patient and do not mention what they came in for. “Thank you for the kind words” is safe. “Glad your knee is doing better” is a disclosure.
Is it a privacy violation if the patient already described their own care in the review?
The patient can share whatever they want about themselves. That does not release the practice. Repeating, confirming or correcting anything they wrote is still a disclosure by you.
Should I reply to every review, even the old ones?
Yes. Work backward through the unanswered ones with the templates, oldest last. A profile where every review has a reply, including the bad ones, reads as well-run.
Can I get a review removed because it is negative?
No. Google removes reviews only for policy violations such as spam, fake accounts, conflicts of interest or harassment. A negative but genuine review stays. The public reply is your response.
Who should write the replies, the physician or the staff?
A designated staff member, usually the practice or office manager, with the templates and a short escalation list. Physicians should review anything that mentions clinical care before it is answered and should not reply directly in the moment.
Article written by
Roger de Oca
Web designer, developer, and founder of DEOCAs. Roger builds and maintains web platforms for physicians and medical organizations, including the 2025-2026 president of a national medical society, and writes about what actually works for practices online.
This article is general information for physicians and practice managers, not legal, medical or financial advice. Rules and prices change; confirm anything that affects your practice with your own advisors.
Keep reading
Ready for a website that works as hard as you do?
We design, build, and maintain web platforms exclusively for physicians and healthcare institutions.