How to Reply to Google Reviews Without Violating HIPAA

A patient leaves a one-star review, it's unfair, and you want to answer. The worry that replying could break HIPAA is justified: OCR has settled with dental practices over their replies to online reviews. A safe HIPAA review response is still possible. It never confirms the person is a patient and never mentions anything about their care, and it can thank them, restate a general policy and invite them to call.

This applies to every practice that handles patient information: dentists, doctors, chiropractors, therapists, recovery centers and pharmacies. I went through what the regulators published and what clinicians and office managers say in their own forums, and the mistakes repeat.

Below is why replies get practices in trouble, the wording I'd use, the process I'd put in place, and what's different for therapy and addiction treatment.

Why a review reply can be a HIPAA violation

This isn't a theoretical risk. One dental practice agreed to a $10,000 OCR settlement over replies to online reviews, and another paid $23,000 under the HHS resolution agreement with a second dental practice. Both came from the practice's own replies.

Most breaches in a reply aren't dramatic. The common one is simply confirming that the reviewer was a patient. In a Reddit thread from chiropractors about a receptionist's review reply, a front desk team member answered an anonymous review in a way that confirmed the person had been treated there. Nobody meant any harm. It was still a disclosure.

The rule I work to is simple: the patient choosing to talk about their visit in public doesn't give you permission to talk about it too. They can say what they like about their own care. You can't add a single detail, including the fact that you know who they are.

What a HIPAA review response can and can't say

That last row catches people out. "You were never our patient" tells the reader you checked your records, and it's still a statement about who is or isn't a patient. If a review looks fake, report it to Google. Don't argue it in the reply.

HIPAA review response wording you can adapt

These are the patterns I'd start from. Each one works whether or not the reviewer was ever a patient, which is the point.

• Cost or billing complaint: "Thank you for the feedback. We aim to explain costs and insurance coverage clearly before any treatment. If you'd like to talk about a bill, please call our office manager on our main number."
• Wait time or scheduling: "We're sorry to hear about a long wait. We review our scheduling regularly, and we'd welcome a call from you so we can look into it."
• Staff attitude: "We expect every person who contacts us to be treated with respect. Please call and ask for the practice manager so we can follow up."
• Treatment outcome: "Privacy law doesn't allow us to discuss anyone's care in public. We'd genuinely like to hear from you directly. Please call the office and ask for the practice manager."
• Positive review: "Thank you for taking the time to write this. It means a lot to our team." Don't mention the procedure, even when the patient did.

Short is fine. Future patients read replies to see whether you stay calm, not whether you win the argument. My general thinking on when to reply to a negative review applies on top of the privacy rules.

How to set up review replies safely in your practice

1. Decide who is allowed to reply. One or two named people, trained on this, not whoever is at the front desk when the notification arrives. The chiropractic receptionist case is exactly what happens without that rule.
2. Write a short approved template library. Five or six replies like the ones above, checked by whoever handles privacy compliance in your practice. Replies should be adapted from the library, never written from scratch in the moment.
3. Never confirm or deny that someone is a patient. No "thanks for visiting", no "we have no record of you". Every reply should read the same whether the reviewer was a patient or a stranger.
4. Move the conversation offline by invitation only. Put the office number in the reply and let them call you. Don't phone the reviewer because you've worked out who they are; that turns a review into a complaint about how you used their contact details.
5. Report reviews that break Google's rules separately. A review from someone who was never a patient, or from a competitor, goes through Google's reporting process. The reply stays neutral either way.
6. Keep a record. Screenshot each review and your reply with the date. If a complaint ever reaches a regulator or your board, you'll want to show exactly what was said.

Therapy practices: when saying less is the answer

For a therapist, the bare fact that someone is a client is more sensitive than it is for a dentist. In a Reddit discussion among therapists about a one-star over free consultations, the working rule was that you may respond, as long as there's no protected information, and that restating your policy is fine. For that review, a reply like "We don't offer free consultations, and our fees and booking policy are listed on our website" is safe, because it's true for everyone.

What therapists must not do is contact the client about it. In a Reddit thread where a client describes their therapist phoning them over a review, the therapist called and threatened to sue. Read from the client's side, it's the worst possible outcome for trust, whatever happened to the review afterward.

Many therapists choose not to reply to reviews at all, and I think that's a reasonable position. If you do reply, keep it to policy. Check your licensing board's and professional association's guidance too, because it can be stricter than HIPAA. It's something I raise at the start of any therapist SEO project, before we touch the profile.

Recovery centers: when your board limits replies

Addiction treatment is where replying is hardest. A mental health facility on the Local Search Forum described watching its review count fall from 210 to 176 in weeks while its competitors' counts rose, and its state board effectively forbade replying at all, as laid out in a Local Search Forum thread about a mental health facility's missing reviews.

If you're in that position, the reply isn't your tool. What's left:

• Report reviews that break Google's rules, with the facts laid out, and never with patient details.
• Check your state's rules in writing before anyone replies, and keep that guidance on file.
• Put your answers on your website instead. A clear page on your admissions process, costs, insurance and family contact policy answers most complaints without touching any individual.

Anonymity is part of what patients are buying in treatment, so a quiet profile doesn't read as a bad one. It's a normal trade-off in addiction treatment SEO.

Dental, chiropractic, medical and pharmacy replies

Dental and medical practices get the most billing and insurance complaints, often from family members rather than patients. Keep replies to how your billing works in general, never what this person was charged. Chiropractic offices most often go wrong through front desk replies, so the "who replies" rule matters most there. Pharmacies mostly get reviews about wait times and staffing, and pharmacists in their own forums say they'd like to be able to answer. They can, because a reply about how the pharmacy handles busy periods says nothing about anyone's prescription.

And a note on getting more reviews in the first place: the privacy line applies to the ask as well as the reply. I cover how and when asking patients for reviews fits professional ethics separately.

What not to do

• Don't correct the patient's version of events. Every correction is a detail from their care.
• Don't name the provider who saw them. It confirms the visit and who treated them.
• Don't ask the reviewer to take it down in the reply. It reads as pressure and adds nothing.
• Don't let a marketing agency reply without the template library. Whoever types the reply, the practice is responsible for it.

Questions practices ask

Is it safer not to reply at all?

Not replying is always HIPAA-safe, and it's a reasonable choice for therapy and addiction treatment. For most dental and medical practices, a calm, generic reply looks better to future patients than silence, as long as it follows the table above.

What if the review is obviously fake?

Report it to Google with your evidence, and reply with the same neutral wording you'd use for anyone. Never write "this person was never a patient".

Does this apply to positive reviews?

Yes. "Glad your root canal went well" confirms a patient and a procedure. "Thank you for the kind words" doesn't.

Getting replies right across your locations

Most practices I talk to aren't worried about writing a good reply. They're worried about the one bad reply someone writes on a busy Friday. Setting up the template library, the reply rules and the reporting is part of our Google Business Profile management, and it's standard in the dental SEO work we do.