Posted By: Dr. Kyle Fagala, DDS, MDS
Last updated: November 6, 2026
Key Takeaways
- You can respond to patient reviews, but your reply can’t confirm the reviewer is a patient or mention any treatment, appointment, billing or insurance detail.
- That’s true even when the patient shared those details first. Their post is their choice; your reply is a disclosure by your practice.
- HHS has settled with practices over review replies, including New Vision Dental ($23,000) and Manasa Health Center ($30,000).
- The safe pattern: thank, speak to your general standards, and invite the person to call the office. Then handle the real conversation privately.
- This is educational, not legal advice. Confirm your review policy with your attorney or compliance advisor.
To respond to patient reviews without violating HIPAA, keep every reply general: thank the reviewer, describe your practice’s standards, and invite them to contact the office directly. Never confirm they’re a patient, and never mention treatment, appointments, billing or insurance, even if the reviewer already did.
That sounds simple until a parent posts a one-star review at 11 PM claiming you overcharged them, and you know the account notes say otherwise. That’s when practices get into trouble.
Not legal advice: this post explains the federal HIPAA Privacy Rule and published HHS settlements in plain language. Confirm your review response policy with your attorney or compliance advisor.
Can you respond to patient reviews under HIPAA?
Yes. HIPAA doesn’t prohibit replying to reviews. It prohibits disclosing protected health information, and a review reply is a public disclosure by your practice.
The trap is that replying can itself reveal information. “We’re sorry your aligner refinement took longer than expected” confirms the reviewer is your patient and what treatment they had. None of that is yours to share.
Replies still matter for your business. On Google, the Business Profile help page on managing reviews notes that approved replies are “publicly posted under the customer’s review” and that the person who wrote the review is notified when you reply. Every prospective patient comparing practices can read what you wrote, which makes replies one of the most visible parts of your orthodontic marketing. So the goal isn’t silence. It’s replies that show your culture without revealing anything about the patient.
What happens if a practice discloses patient information in a review reply?
HHS’s Office for Civil Rights (OCR) can investigate, and it has reached paid settlements with practices over exactly this. Three published cases are worth knowing:
| Practice | What HHS describes | Resolution |
|---|---|---|
| New Vision Dental (South Pasadena and Glendora, CA) | Disclosed patient information in responses to Yelp reviews | $23,000 and a corrective action plan |
| Manasa Health Center (New Jersey) | Disclosed patient information in response to negative online reviews | $30,000 and a corrective action plan |
| Elite Dental Associates (Dallas, TX), 2019 | “Social Media Disclosures of Patients’ Protected Health Information,” per the HHS Elite Dental Associates settlement page | $10,000 and a corrective action plan |
In the New Vision Dental case, HHS’s settlement summary describes “the provider’s inappropriate use of social media to respond to patient reviews, disclosing protected health information,” and states plainly: “This practice is illegal under HIPAA.” The resolution agreement says the complaint alleged the practice responded to posts “sometimes providing full names where only Yelp monikers were used by the patients and including detailed information about patient visits and insurance.” OCR also cited a deficient Notice of Privacy Practices and missing policies for “releasing PHI on social media/public platforms.”
Manasa Health Center, a psychiatric practice in New Jersey, paid $30,000 after a complaint that it disclosed a patient’s information “when the entity posted a response to the patient’s negative online review,” according to the HHS summary of the Manasa settlement. OCR also cited a failure to implement policies and procedures for protected health information.
In two of the three, OCR also cited missing policies behind the replies. A written review policy is part of the fix.
What can you say in a HIPAA-compliant review response?
You can thank the reviewer, talk about your practice’s general standards and values, and invite them to reach out privately. You can’t confirm they’re a patient or reference anything about their care or account.
Here’s how that plays out with real-world phrasing:
| Instead of this | Write this |
|---|---|
| “Thanks! We loved seeing your smile at your debond last week.” | “Thank you so much for the kind words! Our team loves what we do, and reviews like this make our day.” |
| “Your insurance only covered part of your son’s treatment, which we explained at the consult.” | “We take billing questions seriously and want every family to feel clear about costs. Please call our office manager so we can talk directly.” |
| “We have no record of you missing three appointments…” | “We’d like to understand your concerns. Please contact our office at your convenience.” |
The examples in that table are illustrations, not real patients. The right column works because it would read the same whether or not the reviewer ever set foot in your office.
Should you respond to positive reviews differently?
No. Positive reviews need the same discipline, because that’s where teams relax. A parent writes “The doctor fixed my daughter’s overbite!” and the instinct is to reply “We loved treating her!” That confirms a patient relationship. “Thank you! We’re so glad you shared this” is enough.
How should you handle negative or false reviews?
Respond calmly, generally and once, then move the conversation offline. Public arguments are where most disclosures happen.
If a review looks fake, violates platform rules or comes from someone who was never a patient, don’t try to prove that in your reply. Use the platform’s reporting tools instead. Google’s help page on how to report inappropriate reviews explains that only reviews violating Google’s policies are eligible for removal, and adds: “Do not report a review just because you disagree with it or dislike it.”
Then call the family, fix what can be fixed, and let new happy reviews do the talking. We cover building that stream in our guide to orthodontic reputation management and review generation.
How do you make review replies sound like your practice?
Compliant doesn’t have to mean robotic. Replies can carry your team’s warmth, as long as they stay general about patients.
Your review replies are one of the most public places families see your culture, so keep them warm and on-brand while staying general about patients. That consistency is something our clients notice. Dr. Ali Tahbaz of Luv Braces said it on our dental marketing page: “Neon does a great job on delivering up-to-date marketing and content. They do a great job managing our online presence and make sure our story is consistent and on-brand.”
A 6-step HIPAA-safe review response system
Don’t rely on whoever checks Google that night. Use a written process:
- Assign an owner. One trained person responds, with a backup. Nobody replies from a personal account.
- Write a policy. Two or three sentences: never confirm patient status, never mention care, billing or insurance, and route complaints to a phone call.
- Build a small template library. Four or five approved replies for positive, neutral, negative and suspicious reviews. Personalize the tone, never the patient details.
- Use a 24-hour cool-off for negative reviews. Draft, wait, reread. Angry replies are where disclosures happen.
- Take it offline fast. Call the family, or invite them to call you. Document the outcome in your system, not online.
- Train and review. Cover the policy in onboarding and at least yearly, and spot-check recent replies each quarter.
Front-office habits like these are exactly what our orthodontic practice coaching program helps client teams build and keep.
Reviews also feed your local visibility, so this process sits right next to your local SEO services work. If you’re building the bigger picture, our framework for growing an orthodontic practice shows where reviews fit, and our post on building a referral system that generates word-of-mouth covers turning happy families into new patients. See also how reviews shape the orthodontic patient journey from awareness to start.
Frequently Asked Questions
Is it a HIPAA violation to respond to a patient review?
Responding is not a violation by itself. Disclosing protected health information in the response is. A reply that confirms the reviewer is your patient, or mentions their treatment, appointments, billing or insurance, can be an impermissible disclosure. HHS has settled with practices, including New Vision Dental, over this. Keep replies general and move specifics to a private phone call.
What if the patient already shared their treatment details in the review?
Your reply still can’t repeat or add to them. A patient can share their own health information publicly, but that doesn’t authorize your practice to discuss it. In the New Vision Dental case, the complaint described replies that added full names, visit details and insurance information. Respond as if you can’t see the details at all.
How do you professionally respond to a bad review?
Stay calm, thank them for the feedback, state your commitment to your patients in general terms, and invite them to call the office so you can talk directly. Don’t argue, don’t correct their facts publicly, and don’t confirm they’re a patient. Wait a few hours before posting, and reply once. The follow-up call is where you actually solve the problem.
Can you ask Google to remove a negative review?
You can report it, but Google only removes reviews that violate its content policies, such as spam or offensive content. Google’s own help page says not to report a review just because you disagree with it. If a review is simply unflattering, a calm, general reply and a steady flow of new reviews from happy patients is your best response.
Want a review strategy you don’t have to worry about?
If you’d like help building a reputation system that grows reviews and keeps replies compliant, request a free marketing audit. We’ll look at your reviews, replies and local visibility, and show you what to tighten up.