HIPAA-Safe Review Reply Templates for Healthcare Practices

By the Expert Reputation team · Updated October 26, 2026

These 20 replies are ready to copy for the reviews healthcare practices see most, from 5-star praise to billing complaints and legal threats. Every one is written so it never confirms the reviewer is a patient or mentions any visit, treatment, condition, bill or insurance detail, because under HIPAA even "thanks for coming in" can be a disclosure. Swap in your own [Practice Name], [Phone] and [Office Manager Name], and keep the rest general.

For the rules behind these templates and the HHS enforcement cases, read HIPAA and online reviews. This is general information, not legal advice.

Four rules every reply follows

1. No confirmation of a patient relationship. No "visit," "appointment," "treatment," "your care," "seeing you," or "welcome to the practice."
2. No details, even ones the reviewer posted. If the review mentions a procedure, a diagnosis, a date or a bill, the reply does not repeat, confirm or correct it.
3. No names. Don't address the reviewer by name, and don't name the provider they mention in a way that links them to care.
4. Same wording for everyone. Use these templates for reviewers you know, reviewers you don't, and reviews you suspect are fake. A special reply for "people we've never seen" reveals who is in your records.

5-star reviews

Short and warm

Thank you so much for the kind words! Our team works hard to make [Practice Name] a welcoming place, and feedback like this means a lot to all of us. — [Practice Name]

Sharing it with the team

We really appreciate you taking the time to share this. We'll pass your kind words along to our whole team. Thank you! — [Office Manager Name], [Practice Name]

Avoid "We loved seeing you," "Glad your smile turned out great," or "See you at your next cleaning." They read as friendly but confirm a patient relationship and, often, a treatment.

4-star reviews

Appreciative, with an open door

Thank you for the thoughtful feedback. We're always looking for ways to do better, and if there's anything you'd like to share with us directly, we'd welcome the chance to talk. Please call [Office Manager Name] at [Phone]. — [Practice Name]

Short version

Thank you for your feedback! We appreciate it and are always working to improve. — [Practice Name]

Mixed reviews (some praise, some complaints)

Acknowledge both sides without specifics

Thank you for sharing both the positives and the concerns. We take all feedback seriously and use it to improve. Privacy rules keep us from discussing specifics online, but we'd welcome the chance to talk. Please call [Office Manager Name] at [Phone]. — [Practice Name]

When the complaint is about a process

We appreciate you taking the time to write this. Feedback like yours helps us review how we do things across the office. If you'd like to talk further, please reach [Office Manager Name] at [Phone]. — [Practice Name]

1-star reviews about wait times

General policy, no person-specific detail

We're sorry to hear about this experience. We know everyone's time is valuable, and our goal is to keep wait times as short as we can, though they can sometimes run long when care takes longer than expected. We'd welcome the chance to talk. Please call [Office Manager Name] at [Phone]. — [Practice Name]

Short version

Thank you for letting us know. Respecting people's time matters to us, and we're sharing this feedback with our team. Please call [Phone] if you'd like to talk with [Office Manager Name] directly. — [Practice Name]

Don't write "You arrived 20 minutes late" or "The doctor was handling an emergency that morning." Both describe a specific person's appointment.

Billing and insurance complaints

Privacy explanation and a direct contact

Thank you for reaching out. Privacy laws prevent us from discussing any account or insurance details online, but our billing team is glad to help. Please call [Phone] and ask for [Office Manager Name]. — [Practice Name]

General policy statement

We understand that billing and insurance questions can be frustrating. Our team is happy to walk anyone through how billing works at our office and answer questions privately. Please contact [Office Manager Name] at [Phone]. — [Practice Name]

Never mention a balance, a denied claim, a collections account, or a payment plan, even to defend a charge.

Complaints about rude or unhelpful staff

Take it seriously, take it offline

We're sorry to read this. Everyone who contacts our office deserves to be treated with courtesy and respect, and we take concerns about how our team communicates very seriously. Please call [Office Manager Name] at [Phone] so we can talk directly. — [Practice Name]

Short version

Thank you for this feedback. Courtesy is a core expectation for our whole team, and we'd like to hear more. Please reach [Office Manager Name] at [Phone]. — [Practice Name]

Don't name the staff member, describe the phone call, or explain what the person said at the front desk.

Complaints about a clinical outcome

These are the replies most likely to go wrong, because the instinct is to defend the care. Have the office manager or privacy official post them, not the provider.

Concern without discussion

We're sorry to hear you're unhappy, and we take every concern seriously. Because of patient privacy laws, we never discuss anyone's health or care online. We'd welcome the chance to talk privately. Please call [Office Manager Name] at [Phone]. — [Practice Name]

Short version

Thank you for sharing your concerns. Privacy laws keep us from responding to specifics here, but we'd like to talk. Please contact [Office Manager Name] at [Phone]. — [Practice Name]

Never correct the reviewer's account ("Actually, we recommended a different procedure"), explain the risks they "agreed to," or say what the chart shows. That is the pattern in the HHS cases against New Vision Dental and Manasa Health Center.

A review about the wrong practice

Talk about your practice, not the reviewer.

Thank you for your feedback. To help readers, [Practice Name] is located at [Address] and offers [type of services]. If you have any questions about our office, please call [Office Manager Name] at [Phone]. — [Practice Name]

Don't write "You were never our patient" or "You must be thinking of the practice down the street." If the review is clearly about another business, report it through the platform. See can you remove a review? for what platforms will and won't take down.

Suspected fake or non-patient reviews

Same general reply as anyone else

Thank you for your feedback. We take every concern seriously. Because of privacy laws, we can't discuss anyone's care online, but we'd welcome the chance to talk. Please call [Office Manager Name] at [Phone]. — [Practice Name]

Alternate

We're sorry to read this and would like to understand more. Please contact [Office Manager Name] at [Phone] so we can talk directly. — [Practice Name]

Then report the review to the platform if you have evidence it breaks the platform's rules, such as a competitor or former employee posting it. Our guides to fake reviews and competitor and employee reviews cover what evidence helps. No one can guarantee removal; platforms decide.

A review that includes the patient's own health details

The reviewer has shared their diagnosis, procedure or medication. Your reply must not repeat or respond to any of it. Some practices choose not to reply at all to these.

Privacy-first reply

Thank you for your feedback. To protect everyone's privacy, we never discuss health information online, even when it's shared in a review. We'd welcome the chance to talk privately. Please call [Office Manager Name] at [Phone]. — [Practice Name]

Short version

We appreciate you reaching out. Privacy laws keep us from discussing anyone's care here, but we're glad to talk by phone at [Phone]. — [Practice Name]

A review threatening legal action

Before posting anything, send the review to your attorney and your privacy official. Saying nothing publicly until counsel weighs in is a sound choice. If counsel approves a reply, keep it this short:

Thank you. We take all concerns seriously. Please contact our office at [Phone]. — [Practice Name]

Don't threaten the reviewer back. The FTC's review rule (16 CFR 465.7) prohibits unfounded legal threats, intimidation, and knowingly false public accusations aimed at getting a review removed. And don't point to a "no negative reviews" clause in your intake paperwork: the Consumer Review Fairness Act bars form-contract provisions that penalize customers for honest reviews. For the legal background, see defamation vs. opinion.

What never to write: bad and good versions

Before you click "Post"

• Read the reply as a stranger would. Could they learn that this person is your patient, or anything about their health or bill? If yes, rewrite it.
• Check that nothing repeats a detail from the review.
• Make sure only your designated replier is posting, from the practice account.
• If something slips through, edit or delete the reply right away (Google lets the business edit or delete its reply from the reviews screen of the Business Profile) and tell your privacy official.

When the reviewer calls, you're in a normal private conversation: verify identity as you usually would, then address their concerns. For the full playbook on handling a bad review, see negative patient reviews and HIPAA.