Reply without confirming the reviewer is a patient or mentioning any care, visit, diagnosis, bill or date. Thank them, state your general commitment, and invite them to contact the practice directly. HHS OCR has settled with or penalized at least four practices whose replies disclosed patient information, with amounts from $10,000 to $50,000.
Last verified: November 9, 2026.
General information, not legal advice. HIPAA obligations depend on your facts, your state's law and your agreements. Confirm your review-reply policy with qualified counsel or your compliance officer. Nothing here guarantees compliance.
Why a reply can be a disclosure
A negative review invites a defense: "We have no record of a two-hour wait; you arrived 40 minutes late." The trouble is that a defense almost always reveals something only the practice knows. Once you confirm that the reviewer was seen, describe their visit or correct their account of their treatment, you may be disclosing protected health information (PHI) without authorization.
Two points that practices often miss:
The patient posting first does not give you permission to reply in kind. A patient can say whatever they like about their own care. Your practice is a covered entity bound by the HIPAA Privacy Rule, and nothing in the OCR case pages below suggests a review opens the door to a detailed response.
Confirming the relationship can itself be the problem. HIPAA protects individually identifiable information that relates to the provision of health care to a person. Many compliance advisers therefore treat "we're sorry your visit last Tuesday..." as risky even without clinical details, because it confirms the person received care from you. This is an interpretation, not a rule OCR has spelled out for reviews specifically, but it is the conservative reading and the one the templates below follow.
What OCR enforcement shows
These are the HHS Office for Civil Rights actions we found where the conduct was a response to an online review. Each summary is limited to what the hhs.gov case page says.
| Practice | Year announced | Outcome | What hhs.gov says |
|---|---|---|---|
| Elite Dental Associates, Dallas, Texas | October 2019 | $10,000 settlement plus corrective action plan | Settled potential Privacy Rule violations described as "social media disclosures of patients' protected health information." |
| Dr. U. Phillip Igbinadolor, D.M.D. & Associates (UPI), Charlotte and Monroe, North Carolina | March 2022 | $50,000 civil money penalty | The practice "impermissibly disclosed a patient's PHI on a webpage in response to a negative online review," did not respond to OCR's data request or subpoena, and did not contest the findings. |
| New Vision Dental (B. Brandon Au, DDS, Inc.), California | December 2022 | $23,000 settlement plus corrective action plan | "Inappropriate use of social media to respond to patient reviews, disclosing protected health information." OCR's page adds: "This practice is illegal under HIPAA." |
| Manasa Health Center, LLC, New Jersey (adult and child psychiatry) | June 2023 | $30,000 settlement plus corrective action plan | Resolved an April 2020 complaint that the practice disclosed a patient's PHI "when the entity posted a response to the patient's negative online review," plus a failure to implement policies and procedures for PHI. |
What the pattern shows:
Small practices are not exempt. Three of the four are dental offices; one is a psychiatric practice.
One reply can be enough. UPI and Manasa each involved a reply to a single patient's review.
Policy gaps get added on. Manasa's agreement also cited missing policies and procedures. A written review-reply policy is part of the fix OCR expects.
Ignoring OCR makes it worse. UPI's penalty followed a failure to respond to OCR's data request and subpoena.
Corrective action plans were part of the Elite, New Vision and Manasa resolutions, meaning ongoing obligations beyond the payment.
OCR's full list of resolution agreements and penalties is on its resolution agreements index. Check it periodically; the list we reviewed was last updated by HHS on October 30, 2026.
The safe reply pattern: thank, do not confirm, move offline
Every template below follows four rules:
Do not confirm the person is or was a patient. Avoid "your visit," "your appointment," "your treatment," "your bill," "when we saw you."
Do not mention any detail from records, scheduling, billing, or your memory: dates, providers seen, procedures, diagnoses, insurance, balances.
Speak about the practice in general terms. Your policies, your standards, your commitment.
Offer a private channel that does not require the reviewer to identify themselves publicly: a phone number or a named role such as "our practice manager."
Keep replies short. Long replies invite follow-up debate in public.
Reply templates by review type
Adapt the wording, but keep the four rules. Have counsel or your compliance officer approve the final set before staff use them.
Five-star or positive review
Thank you for taking the time to share this. We appreciate your kind words and will pass them along to our team.
Even positive replies should avoid "We loved seeing you for your cleaning" or naming the procedure.
One-star review about clinical care
We take every concern about care seriously. Because of privacy laws, we can't discuss any individual's situation online. Please call our practice manager at [phone] so we can listen and look into this directly.
Do not dispute the clinical account, even if it is inaccurate.
Billing or insurance complaint
We're sorry to hear about this frustration. Our billing team is happy to review any account questions privately. Please call [phone] and ask for [role], and we'll work through it with you.
Never mention balances, collections, insurers or payment history.
Wait-time or front-desk complaint
Thank you for the feedback. We work to keep wait times short and to treat everyone with courtesy, and comments like this help us improve. If you'd like to talk with us directly, please call [phone].
Do not say "Our records show you arrived late."
Review you believe is fake or not a patient
We take all feedback seriously, but we're unable to discuss anyone's care online. If you'd like to speak with us, please contact [role] at [phone].
Avoid "We have no record of you as a patient." That statement can also confirm or deny a patient relationship, and if the reviewer was in fact seen under a different name, it may be wrong. Report the review to Google instead (next section).
When to flag a review to Google instead of replying
Google lets profile owners report reviews from the Business Profile ("Read reviews," then "Report") or through its Reviews Management Tool. As of November 9, 2026, Google's help page says:
Only reviews that violate Google's policies are eligible for removal. Google says not to report a review "just because you disagree with it or dislike it."
Evaluation "typically takes several days," and you can check status in the Reviews Management Tool.
If a report is rejected, you can submit a one-time appeal.
Google's Maps content policy covers fake engagement (content "not based on a real experience"), posts by competitors, conflicts of interest, harassment and other categories. Reasonable candidates to report include a review posted by a competitor or former employee, spam, content that is not about your practice, or a review that is part of an extortion attempt (Google has a separate reporting path for review extortion scams).
Reporting is private and does not create the disclosure risk that a public reply does. You can report and still post a short, neutral reply.
Building a reply routine
A routine is what prevents the 9 p.m. angry reply from a provider's phone.
Write a short policy: who may reply (a named role, not every provider), which templates are approved, what never goes in a reply, and when to escalate.
Restrict access. Limit Google Business Profile manager access to the people in that policy.
Set a response window, for example within two business days, so replies are timely but never rushed.
Escalate clinical or legal threats to the practice manager and, when needed, counsel before anything is posted.
Train staff once a year and when someone new gets profile access. Manasa's agreement cited missing policies and procedures, so documentation matters.
Keep a log of reviews, replies and reports. It helps with follow-up and shows the policy is followed.
Tracking rating and reply rate over time
A reply routine works best when you can see whether it is being followed. Track, monthly:
Average rating and total review count.
New reviews in the period.
Share of new reviews with an owner reply, and median time to reply.
Reports filed to Google and their outcomes.
Google's local ranking guidance says that "positive reviews and helpful replies can help your business stand out," so a consistent routine has value beyond compliance. To set realistic review targets against nearby clinics, see how many Google reviews a medical practice needs. For profile basics, see our Google Business Profile guide.
ClinicStats' free scan checks your Google rating and review count as one of its 20 checks. If you want weekly re-scans and a monthly competitor report that compares reviews with nearby clinics, the Live Ops plan on our pricing page covers that; it does not write or post replies for you. You can start with a free scan.