How to reply to patient reviews without disclosing anything
For physicians and staff who own the Google profile: the one rule that keeps a reply safe under HIPAA, four templates to use as written and when to escalate.
Roger de OcaFounder, DEOCAsPublished Updated 7 min readAdded a direct answer, a weekly action list and primary sources including the OCR enforcement case; split the densest paragraphs.
In short
To respond to patient reviews without violating HIPAA, reply as if you do not know whether the reviewer has ever been a patient: no confirmation of a visit, no diagnosis, treatment, test, date or bill, and no correction of details they wrote. Thank them, explain that privacy rules prevent discussing individual care, and offer a direct call.
In this article
How to respond to patient reviews without a HIPAA problem comes down to one rule: never confirm that the reviewer is or was a patient. No diagnosis, no date, no correction of what they wrote. Thank them, say privacy rules keep you from discussing care, and offer a direct call. Four templates below do exactly that.
A physician reads a one-star review on a Friday afternoon. It describes a visit that, from the physician’s side, went completely differently, and the instinct is to reply with the facts. Every one of those facts is a disclosure. This article covers why replies matter, the templates, what to do when a review is false, and when to escalate.
Why do replies matter for your Google profile?
Reviews are the most visible part of your Google Business Profile, and replies are the part of it you control completely. Google encourages owners to respond, and a profile with recent, answered reviews reads as an active practice both to Google and to the patient comparing three offices on the map.
More important, the audience for your reply is not the person who wrote the review. It is every future patient who reads it. They are judging how you handle complaints, not whether you won the argument.
An unanswered negative review says the practice did not notice or did not care. A defensive one says the practice argues with patients. A short, calm, private-by-design reply says the practice is run by adults. That is the whole objective. Answered reviews are also an asset the website can carry: see how we show Google reviews on a physician site.
The rule: never confirm that anyone is a patient
Federal privacy law treats the fact that a person received care from you as protected information, in the same category as the diagnosis itself. A reviewer publishing their own story does not release you to discuss it.
When they write “Dr. Lee dismissed my back pain”, you cannot reply “we ordered an MRI at your visit”; you cannot reply “you were seen on the 12th”; you cannot even reply “we are sorry your visit went badly”, because that confirms there was a visit.
Federal regulators have taken enforcement action against practices for review replies that confirmed patient status or described care. In 2023 a New Jersey psychiatric practice paid $30,000 to the Office for Civil Rights over its replies to Google reviews, and a single reply is enough.
The rule is simple, and it applies to five-star reviews too: reply as if you do not know whether the reviewer has ever set foot in your office.
Four reply templates you can use as written
Each template is written to say something and disclose nothing. Adjust the tone to your practice; do not add specifics.
1. Positive review
“Thank you for taking the time to write this. Kind words like these mean a great deal to our whole team, and we appreciate you sharing them.”
2. Negative review about care or outcome
“Thank you for sharing this. We take every comment seriously, and we want to understand what happened. Privacy rules do not allow us to discuss any individual’s care here, but our practice manager would welcome a direct conversation at the office number listed on this page.”
3. Negative review about wait times, billing or the front desk
“We appreciate the feedback. Wait times and scheduling are things we work on constantly, and comments like this help us see where we fall short. If you would like to discuss your experience, our office manager is available at the number on this page.”
4. Review that appears to be false or mistaken
“Thank you for your comment. We are unable to locate any record matching this description, and we take every concern seriously. If you believe you have reached us in error or would like to discuss this directly, please contact our office manager at the number on this page.”
Notice what none of the four contains: the word “your” attached to a visit, a diagnosis, a doctor’s name, a date, or any sentence that starts with “actually”.
What should you do with a false review?
Some reviews are not from patients: a former employee, a competitor, someone who confused two practices with similar names, or a bot. Google removes reviews only when they violate its policies, which cover spam, fake accounts, conflicts of interest, off-topic content and harassment. “It is unfair” or “it did not happen that way” are not grounds.
- Flag the review from the profile using the report option, choose the policy it violates and describe it in one or two factual sentences.
- Reply publicly with template four while the report is pending. A false review left unanswered looks true.
- Do not accuse the reviewer of lying in public, and do not name who you think wrote it.
- If the review is defamatory or part of a pattern, keep screenshots with dates and bring them to counsel.
- Never ask staff, family or friends to post reviews to bury it. Google detects clusters, and a suspended profile is far worse than one bad review.
When should a review be escalated, and to whom?
One person at the practice should own review replies, with a second person as backup. Everyone else should know that they do not reply. Beyond that, some reviews should not be answered from the front desk at all.
Do
- Send any review that mentions a specific clinical error or harm to the physician and to whoever handles risk or compliance before replying
- Send any threat of a lawsuit, a licensing board complaint or media contact to counsel
- Send any review that names an employee to the practice manager
- Reply to everything else within a few business days using the templates
Don’t
- Let a physician reply to their own negative review in the heat of the moment
- Reply from a personal account
- Offer refunds, discounts or free visits in a public reply
- Try to turn off reviews or delete the profile, which Google does not allow and which would hide the positive ones anyway
Written like this, the process fits on one page taped near the front desk. Most practices need it exactly once, the day the first bad review arrives and everyone wants to answer it.
A note on asking for reviews
The best defense against a single negative review is a steady flow of honest positive ones. Ask patients at checkout, with a card, or with a text if the patient has agreed in writing to receive texts from the practice, that links directly to the profile. Ask everyone, not only the ones who seem happy.
Google’s rules prohibit offering anything in exchange and prohibit asking only satisfied patients. Federal consumer rules point the same way. A simple, consistent ask does the work.
Once they exist, the website can carry them too: public Google reviews shown on your site, described as such, never a testimonial quoted without a signed authorization.
If reviews, the profile and the website feel like three separate problems, they are one problem seen from three sides. Our healthcare digital consulting covers the reply process, the ask-for-reviews routine and the profile together, and we reply to every inquiry within one business day. Start by telling us where it hurts.
What to do this week
- Answer every unanswered review on your profile with the matching template, oldest last.
- Name one person who owns replies and one backup, and tell everyone else they do not reply.
- Write a one-page escalation list: clinical harm to the physician, legal threats to counsel.
Frequently asked questions
Can I reply to a positive review by thanking the patient by name?
Reply, but do not use their name, do not confirm they were a patient and do not mention what they came in for. “Thank you for the kind words” is safe. “Glad your knee is doing better” is a disclosure.
Is it a privacy violation if the patient already described their own care in the review?
The patient can share whatever they want about themselves. That does not release the practice. Repeating, confirming or correcting anything they wrote is still a disclosure by you.
Should I reply to every review, even the old ones?
Yes. Work backward through the unanswered ones with the templates, oldest last. A profile where every review has a reply, including the bad ones, reads as well-run.
Can I get a review removed because it is negative?
No. Google removes reviews only for policy violations such as spam, fake accounts, conflicts of interest or harassment. A negative but genuine review stays. The public reply is your response.
Who should write the replies, the physician or the staff?
A designated staff member, usually the practice or office manager, with the templates and a short escalation list. Physicians should review anything that mentions clinical care before it is answered and should not reply directly in the moment.
Sources
- 1.Summary of the HIPAA Privacy Rule , U.S. Department of Health and Human Services, Office for Civil Rights (2026)
- 2.Resolution agreement with Manasa Health Center (disclosures in response to online reviews) , U.S. Department of Health and Human Services, Office for Civil Rights (2023)
- 3.Manage customer reviews , Google Business Profile Help (2026)
- 4.Prohibited and restricted content , Google Maps user generated content policy (2026)
- 5.Tips to get more reviews , Google Business Profile Help (2026)
- 6.Final rule banning fake reviews and testimonials , Federal Trade Commission (2024)
- 7.FTC’s Endorsement Guides: what people are asking , Federal Trade Commission (2023)
Article written by
Roger de Oca
Web designer, developer, and founder of DEOCAs. Roger builds and maintains web platforms for physicians and medical organizations, including the 2025-2026 president of a national medical society, and writes about what actually works for practices online.
This article is general information for physicians and practice managers, not legal, medical or financial advice. Rules and prices change; confirm anything that affects your practice with your own advisors.
Keep reading
Ready for a website that works as hard as you do?
We design, build, and maintain web platforms exclusively for physicians and healthcare institutions.