A one-star review lands on your Google profile. It’s unfair, it’s public, and it gets a detail wrong. Every instinct says to set the record straight. That instinct is exactly what has cost medical practices tens of thousands of dollars in federal penalties.
Responding to patient reviews is not like responding to a restaurant review. A restaurant can name the customer and describe what happened. A medical practice that does the same thing is disclosing Protected Health Information, and the rules do not bend just because the patient posted first. This guide covers the one rule that trips everyone up, what it has actually cost practices, and a safe, repeatable way to respond that protects both your reputation and your patients.
The One Rule That Trips Everyone Up
Here is the part that surprises most practice owners: you cannot even confirm that the reviewer is your patient. The moment your reply acknowledges a treatment relationship, you have disclosed PHI, and the patient never authorized that disclosure. It does not matter that they voluntarily shared their own information in the review. Their choice to reveal it does not give you permission to confirm it.
This catches people because the “obvious” defensive moves are all violations. Correcting a clinical detail discloses PHI. Explaining what really happened at the visit discloses PHI. Even writing “you were never actually a patient here” confirms information about a specific person. Regulators have been explicit that this rule applies even to friendly replies to positive reviews, and even to the smallest solo practice.
What This Has Actually Cost Practices
These are not hypothetical risks. The federal Office for Civil Rights, which enforces HIPAA, has repeatedly penalized providers for exactly this:
- A New Jersey psychiatric practice paid $30,000 after its owner responded to four patients’ negative Google reviews with details about their mental health diagnoses and treatment.
- A North Carolina dental practice was hit with a $50,000 penalty for rebutting a pseudonymous Google review with specifics about the patient’s visits.
- A California dental practice paid $23,000 for responding to Yelp reviews with patient names, treatment, and insurance information the reviewers had not themselves disclosed.
- An earlier case in Texas settled for $10,000 over similar review responses.
The dollar figure is often the smaller problem. These settlements come with multi-year corrective action plans: rewriting policies, retraining staff, and formally notifying every affected patient that their information was disclosed, a breach letter that does far more reputational damage than the original review ever could.
How to Respond Safely
The safe path is a response that neither confirms nor denies that the reviewer is a patient and contains no specifics about any individual. In practice, that means keeping replies generic, professional, and short, and deciding in advance what you will say, because the riskiest responses are the ones typed in the heat of the moment.
Build two or three pre-approved templates and have your privacy officer or counsel sign off on them once, so no one is improvising. A few that stay on the right side of the line:
"Thank you for taking the time to share feedback. We take all concerns about our care and service seriously and welcome the chance to speak with anyone directly. Please reach our office at [phone] and ask for our Patient Experience Coordinator."
"We're committed to providing every person who visits our practice with respectful, high-quality care. We'd genuinely like to understand and address any concern. Please get in touch with us at [phone/email] so we can help."
Notice what these do not do: they never say “our patient,” never reference a visit, condition, or treatment, and never argue. Some privacy experts take an even more conservative view (i.e., that inviting someone to “resolve your complaint” can itself imply they were a patient) so the safest wording keeps the invitation fully general (“we welcome the chance to speak with anyone”). When in doubt, run the exact wording past your privacy officer before it goes live.
Quick Guide by Scenario
- An angry review with clinical detail: respond with a generic template only. Do not engage with the specifics, however tempting.
- A factual service complaint (wait times, billing, front desk): a neutral template plus a private path to resolve it. Handle the actual issue offline.
- A review you believe is fake: do not rebut it publicly. See below.
- A “positive” review naming your provider: a simple, generic thank-you with no confirmation of a treatment relationship, or no public reply at all.
When the Review Is Fake or Defamatory
If you suspect a review is fraudulent, from a competitor, or from someone who was never treated at your practice, resist the urge to prove it publicly. Doing so almost always means disclosing PHI to make your case. Instead, flag the review to the platform for removal under its policies (fake reviews, conflicts of interest, and content that violates terms are removable), document everything internally, and involve counsel if it rises to defamation. Winning the argument in the comments is not worth the breach.
The Real Fix Happens Before the Review Is Ever Posted
Every public complaint is a patient who reached the review stage because no one caught them earlier. The most effective reputation strategy is to make sure unhappy patients tell you first. A well-timed survey after each visit surfaces frustration privately, while there’s still time to fix it — the foundation of closed-loop feedback. Once a concern surfaces, your team follows the resolution process in our guide to handling negative patient feedback offline, where you can actually help.
The same system works in your favor on the positive side: identify happy patients and invite them to share their experience publicly, the right way. Our guide on increasing healthcare Google reviews ethically covers that workflow, and it depends on getting enough responses in the first place; see our benchmarks for a good survey response rate. Over six to twelve months, a steady flow of genuine positive reviews does far more for your rating than any single reply ever could.
Extra Caution for Behavioral Health and Sensitive Specialties
The stakes rise sharply in some fields. The $30,000 psychiatry case is a warning specific to behavioral health: confirming that someone is a mental health patient is itself deeply sensitive, and substance use disorder records carry additional federal protections under 42 CFR Part 2, which now has its own civil enforcement program. If your practice touches this space, your review policy needs to be airtight. For more context, see our guide to surveys for behavioral and mental health practices. Aesthetic and dermatology practices face a different flavor of the same risk: high review volume, cash-pay patients who research heavily, and a strong pull to defend results publicly. The rule doesn’t change. See our companion piece on surveys for dermatology and medical aesthetic practices.
Where ClearSurvey Fits
ClearSurvey helps medical practices catch dissatisfaction before it becomes a public review. We deliver short, well-timed surveys after visits, alert your team the moment feedback turns negative so you can follow up privately, and route happy patients toward leaving genuine reviews — all under a signed BAA with the PHI you collect kept to a minimum. It’s the upstream system that makes the whole review problem smaller. To see how it would work for your practice, schedule a personalized demo.
This article is for general information only and isn’t legal advice. HIPAA obligations vary by situation. Confirm your review-response policy with your practice’s privacy officer or legal counsel.
ClearSurvey is a best-in-class survey software focused on helping medical practices offer the best patient satisfaction in healthcare. We can help you develop a custom survey question-set based on your goals so you can gather data for useful insights. Learn more about how ClearSurvey can elevate your practice to stay ahead and schedule a demo today!
