Responding to Patient Reviews Without Violating HIPAA

To respond to patient reviews without violating HIPAA, never confirm that the reviewer is your patient and never mention their visit, condition, treatment, billing or anything from their record, even if they shared it first. Reply with a short, general statement about your standards and invite them to contact the office directly. HHS has taken enforcement action against practices whose review replies disclosed patient information.

This article is general information, not legal advice. State laws and professional rules can add obligations, so consult a qualified lawyer in your jurisdiction or your privacy official before adopting a policy.

Why a review reply can be a HIPAA violation

The HHS Summary of the HIPAA Privacy Rule explains that the rule protects individually identifiable health information held or transmitted by a covered entity, in any form. That includes information about a person's past, present or future physical or mental health, the provision of health care to them, or payment for it, when it identifies the person or could reasonably be used to identify them. The rule calls this protected health information, or PHI.

The basic principle is that a covered entity may not use or disclose PHI except as the Privacy Rule permits or requires, or as the individual authorizes in writing. Every health care provider that electronically transmits health information in connection with certain standard transactions, such as claims, is a covered entity regardless of size.

A public reply to a review is a disclosure to anyone who reads it. Because PHI covers identifiable information about the provision of care, a reply that confirms the reviewer was treated, refers to an appointment or explains what happened clinically can disclose PHI. In the cases below, the disclosures were made in replies to reviews; in the New Jersey case, HHS describes them as responses to the patients' own negative reviews. The fact that a patient posted first did not stop HHS from acting.

What HHS enforcement shows

The HHS Office for Civil Rights (OCR) has published several cases involving replies to online reviews. Settlements resolve potential violations; the amounts below are as stated by HHS.

Sources for each row: the HHS enforcement page on the Dallas practice and HHS guidance that describes its Yelp replies, the HHS enforcement page on the North Carolina practice, the HHS settlement page on the California practice and, for the New Jersey practice, the HHS enforcement page and resolution agreement and corrective action plan. Dates are when HHS announced each case.

All four cases involved dental or psychiatric practices, not hospitals. The New Jersey resolution agreement shows what a corrective action plan can involve: revised privacy policies and procedures, training for all workforce members including owners and managers, and, within 30 calendar days, breach notices to the individuals whose PHI was disclosed on Google Reviews or any other internet platform, plus breach reports to HHS. Its compliance term runs for two years.

What a safe reply looks like

A safe reply says nothing that would be different depending on who the reviewer is. Use these principles:

• Do not confirm or deny the relationship. Avoid phrases such as "when you visited us" or "as your dentist."
• Leave out every clinical, scheduling and billing detail, even ones the reviewer already posted.
• Speak about your standards in general terms, not about this person's care.
• Move the conversation offline with a phone number or address that anyone can use.
• Apply the same care to positive reviews. Thanking someone for trusting you with their surgery discloses as much as a defensive reply.

Example (illustrative), negative review: Thank you for sharing your feedback. Privacy laws prevent us from discussing any individual's care online, including whether a person is a patient of our practice. We take every concern seriously and would welcome a conversation; please call our practice manager at [phone number] or write to [manager's email].

Example (illustrative), positive review: Thank you for taking the time to leave a review. We appreciate your kind words and will share them with our team.

Example (illustrative), review with claims you dispute: We are not able to respond to specifics online because of patient privacy rules. We hold ourselves to high standards and invite anyone with a concern to contact our office directly at [phone number] so we can look into it.

For more general wording ideas outside healthcare, see our collection of negative review response examples, and remove any line that refers to a specific visit before using it.

Phrases to keep out of replies

Each of these illustrative phrases ties the reviewer to the practice or to their care:

• We checked your chart and...
• You missed your last two appointments.
• As we explained before your procedure...
• Your insurance did not cover that treatment.
• We are sorry the medication did not agree with you.
• It was great to see you at your cleaning last week.

Build a simple internal policy

The HHS summary notes that covered entities must have written privacy policies and procedures and must train workforce members on them. Online reviews belong in both. A workable setup:

1. Decide who may reply. Limit public replies to one or two trained people and involve your privacy official in setting the rules.
2. Approve templates. Keep a small set of generic replies for negative, positive and disputed reviews, and do not improvise on health-related content.
3. Add a second check. Have a second person read every reply to a negative review before it is posted.
4. Train the whole team. Front desk staff, clinicians and owners all need to know that review sites are public.
5. Escalate complaints offline. Route the substance of a complaint to the person who handles patient concerns through your normal channels, not through the review site.
6. Plan for mistakes. If a reply disclosed PHI, remove or edit it promptly and involve your privacy official and counsel, who can assess any breach notification duties.
7. Check AI drafts. If you use AI tools to draft replies, never paste patient details into them and review every draft; see our guide to using AI review responses safely.

When reporting is better than replying

Some reviews contain false statements, abuse or content that breaks the platform's rules. A detailed public rebuttal is exactly where PHI tends to slip in, so use the platform's reporting tools instead and keep your public reply generic. Our guide on how to get a Google review removed explains what platforms will and will not remove; a negative opinion on its own is not a reason for removal.

Not replying at all is also an option for a single review, but a consistent, privacy-safe reply shows other patients that you read feedback. The general process in how to respond to negative Google reviews still applies, with the privacy limits above.