HIPAA and Online Reviews: What a Practice Can and Can't Say

By the Expert Reputation team · Updated October 26, 2026

A healthcare practice can reply to online reviews, but HIPAA limits what the reply can say. Anything that confirms the reviewer is your patient, or mentions their visit, condition, treatment, bill or insurance, can be an impermissible disclosure of protected health information, and HHS has settled with or penalized practices for exactly that. This guide explains where the line is, the enforcement cases behind it, and the rules for staff posts and testimonials.

This is general information, not legal advice. Talk with a healthcare attorney or your privacy official about your situation.

Why confirming someone is a patient is a disclosure

HIPAA's definitions are broader than most people expect. Under 45 CFR 160.103, health information includes information that relates to a person's health or condition, "the provision of health care to an individual," or payment for that care. It becomes individually identifiable (and protected) when it identifies the person or could reasonably be used to identify them.

A public review sits under the reviewer's name or profile. So when a practice replies "Thanks for coming in" or "We're sorry your appointment ran late," it ties an identifiable person to the practice and to the care they received. The fact of being a patient is the disclosure. For a psychiatry, fertility or addiction practice, the specialty alone reveals something about the person's health.

That is why the safe rule for every reply is simple: write as if you don't know whether the reviewer was ever your patient.

Who HIPAA applies to

HIPAA's Privacy Rule applies to covered entities. For providers, that means a health care provider "who transmits any health information in electronic form in connection with" a standard HIPAA transaction, such as billing insurance electronically. Most medical, dental, chiropractic and therapy practices qualify. Some cash-only wellness or aesthetic businesses may not, but state privacy laws and licensing-board ethics rules can still restrict what they say about clients. Treat the guidance here as the default unless your attorney tells you otherwise.

HHS enforcement actions over review replies and testimonials

The HHS Office for Civil Rights (OCR) enforces the Privacy Rule. These are the actions HHS has announced that involve online reviews or testimonials:

OCR's own words leave little room for interpretation. "Social media is not the place for providers to discuss a patient's care," said OCR Director Roger Severino in 2019. In 2022, Director Melanie Fontes Rainer said: "Providers cannot disclose protected health information of their patients when responding to negative online reviews. This is a clear NO." Announcing the Manasa settlement in 2023, she added that OCR "continues to receive complaints" about these disclosures: "Simply put, this is not allowed."

The dollar amounts were small compared with large data-breach cases, but the Elite, New Vision and Manasa settlements each came with two years of OCR monitoring. Manasa's corrective action plan required written policies, training for all workforce members including owners and managers, breach notices to affected patients, and a breach report to HHS. In the North Carolina case, ignoring OCR turned a complaint into a penalty. For a step-by-step response plan for bad reviews, see our guide to negative patient reviews.

The patient posting their own details doesn't waive HIPAA

This is the trap behind most of the cases above: a patient posts a detailed, one-sided account, and the practice replies with the "real" story.

HIPAA restricts what the practice discloses. It has no exception for information the patient already made public, and the reviewer's post is not a HIPAA authorization (a valid one must be a signed, dated document with specific elements under 45 CFR 164.508). In the Elite, New Vision and Manasa cases, the patients had posted reviews first. OCR still treated the replies as impermissible disclosures. The Manasa press release said the Privacy Rule "expressly protects patients from this type of activity."

So even if the reviewer names their procedure, their diagnosis, or the date of their visit, your reply should not repeat, confirm, or correct any of it.

What a practice CAN say

HIPAA does not require silence. These are generally safe:

• Generic thanks: "Thank you for your feedback" or "Thank you for the kind words." No reference to a visit.
• An invitation to talk privately: "We'd welcome the chance to talk. Please call [Office Manager Name] at [Phone]." Once the person calls, you can verify identity and discuss their concerns the way you normally would.
• General policy statements: "Our policy is to see every patient as close to their scheduled time as we can" describes the practice, not a person.
• A privacy explanation: "Privacy laws prevent us from discussing anyone's care online." Readers usually understand this, and it explains why you aren't arguing.
• No reply at all. Not replying is always HIPAA-safe and is sometimes the best choice.

Use the same wording for everyone, including reviewers you think are not patients. A different reply for "people we've never seen" reveals who is and isn't in your records. Our HIPAA-safe reply templates give 20 ready-to-copy versions by scenario.

If a bad reply is already posted

Remove or edit it right away. On Google, the business can edit or delete its reply from the Business Profile's reviews screen, according to Google's help page. Then bring in your privacy official and counsel. Under 45 CFR 164.402, a disclosure the Privacy Rule doesn't permit is presumed to be a breach unless a documented risk assessment shows a low probability that the information was compromised. That can mean notifying the patient and reporting the breach to HHS, as Manasa was required to do.

Staff social media and personal accounts

Many problem posts come from people who aren't the practice's official voice: a front-desk employee defending the office from their personal account, a hygienist replying in a local Facebook group, or a provider posting a "you won't believe the case I saw today" story.

The Privacy Rule's administrative requirements cover this. Under 45 CFR 164.530, a covered entity must train its workforce on its privacy policies, have and apply sanctions against workforce members who violate them, and implement reasonable safeguards. "Workforce" includes employees, volunteers and trainees under the practice's direct control, whether or not they are paid.

A practical staff social media policy should say:

• Only designated people reply to reviews or post on the practice's accounts.
• Staff never reply to, "like," or comment on reviews about the practice from personal accounts.
• No photos, stories or details about patients, even with names removed, if the person could still be recognized.
• Staff never confirm to friends, neighbors or online groups that someone is a patient.
• What happens if someone breaks the policy, consistent with your sanctions policy.

Elite, New Vision and Manasa were each faulted for missing or inadequate privacy policies, so put this in writing.

Using reviews and testimonials in marketing

Publishing a patient's review or testimonial on your own website, in an ad, or on social media is different from replying to a review. It is the practice choosing to tell the public that this person is a patient, often along with what was treated.

HIPAA's general rule (45 CFR 164.508(a)(1)) is that a covered entity may not use or disclose protected health information without a valid authorization unless the Privacy Rule otherwise permits it, and 164.508(a)(3) requires an authorization for any use or disclosure of protected health information for marketing, with narrow exceptions. In the Complete P.T. settlement, OCR Director Jocelyn Samuels said covered entities need policies to obtain authorization "including for posting on a website and/or social media pages, and a valid authorization form."

Before using any testimonial that identifies a patient:

1. Get a written HIPAA authorization that meets 164.508(c): what will be used, who will use it and where, the purpose, an expiration date or event, the patient's signature and date, and the required statements about the right to revoke and that treatment doesn't depend on signing.
2. Give the patient a copy of the signed form, as 164.508(c)(4) requires.
3. Honor revocations. A patient can revoke an authorization in writing. Remove the testimonial when they do.
4. Treat reposted public reviews the same way. A review the patient posted on Google is their disclosure; copying it onto your homepage with their name is yours. Get authorization or leave it where it is.

A general photo release or a line buried in intake paperwork is unlikely to meet these requirements. Have counsel review your form.

Where the FTC's rules overlap

Federal Trade Commission rules apply to healthcare practices the same way they apply to any business that markets to consumers. Two matter here:

• The Consumer Reviews and Testimonials Rule (16 CFR Part 465). It bans fake reviews, buying reviews that express a particular sentiment, undisclosed reviews by owners and employees, and review suppression. Section 465.7 makes it a violation to use unfounded legal threats, intimidation, or knowingly false public accusations to get a review removed. Section 465.4 means you can't offer a discount or gift in exchange for a positive review. See our explainer on review incentives and FTC compliance.
• The Endorsement Guides (16 CFR Part 255). A testimonial about results is read as a claim that the treatment works and that the patient's experience is typical. Under 255.2, if you can't substantiate that the experience is representative, the ad should clearly disclose what patients can generally expect. Testimonials are not scientific evidence. Under 255.5, connections such as a discount or free treatment given to the endorser must be disclosed.

So a testimonial can need HIPAA authorization, an FTC typical-results disclosure, and a material-connection disclosure all at once.

Who in the office should reply

HIPAA requires every covered entity to designate a privacy official responsible for its privacy policies (45 CFR 164.530(a)). Review replies are a natural part of that role. A workable setup for a small practice:

• One or two trained people post all replies, usually the office manager, with the privacy official approving anything unusual.
• Providers don't reply themselves, especially to complaints about their own care. The urge to defend clinical decisions is exactly what led to the disclosures above.
• Anything threatening legal action goes to counsel before any reply.
• Approved templates cover most situations, so nobody is writing from scratch while upset.
• A short log records who replied, when, and what was said.

Tools like Review IQ can alert you to new reviews so your designated person sees them quickly, but the reply itself should still follow your written policy.