How to Get More Patient Reviews Without Breaking the Rules

By the Expert Reputation team · Updated October 26, 2026

The most reliable way to get more patient reviews is to ask every patient, soon after the visit, with a direct link to the right site. That's allowed on Google and on most healthcare directories. What gets practices in trouble is everything around the ask: rewarding reviews, asking only happy patients, putting health details in a text, or texting people who never agreed to texts. This guide walks through a review request process that stays inside the FTC, Google, HIPAA and FCC rules.

Is it allowed to ask patients for reviews?

Yes, with one big exception. Google's policy says it allows merchants to "solicit or encourage the posting of content that does represent a genuine experience, without offering incentives to do so or attempting to influence the rating or the contents of the review."

The FTC's Trade Regulation Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465, in effect since October 21, 2024) doesn't ban asking either. It bans fake reviews, incentives conditioned on a review's sentiment, undisclosed reviews by officers and managers, and review suppression. The FTC enforces it; patients can't sue under it.

The exception is Yelp. Its business help center says, "Don't ask anyone to review your business, be it customers, mailing list subscribers, friends, family, etc.," and warns that asking may hurt your Yelp rating. Leave Yelp out of your requests entirely. Our Yelp guide explains why.

Mental health practices face extra limits from professional ethics codes. See reviews for therapists and mental health practices before you set up any requests.

The rules every review request must follow

Two of these surprise most office managers. First, Google says merchants "should not require or pressure users to leave ratings or write reviews while on the premises, nor should they request that specific content be included." Handing a patient a tablet at the front desk and waiting while they type crosses that line. Second, Google lists "merchants requesting that staff solicit reviews that include specific content, including content that identifies a staff member" as a violation. "Please mention Dr. [Name]!" doesn't belong in your script.

On gating, the FTC rule doesn't name the practice, but the FTC's guide for marketers is plain: "Don't ask for reviews only from customers you think will leave positive ones." The guide frames its tips as ways to avoid conduct that may violate the FTC Act. Google bans gating outright. The safe process is simple: everyone who had a visit gets the same request.

When to ask: the best moments in the patient journey

Timing matters more than wording. Ask while the visit is fresh, but after the patient has left.

• Same day, a few hours after the visit. This is the default for most clinics, dental offices and med spas. The patient is home, the experience is fresh, and nobody is watching them type.
• After a milestone, for longer treatments. For orthodontics, physical therapy or a surgical package, ask after a meaningful point (end of active treatment, a final follow-up) rather than after every appointment.
• Once per patient per period. Decide on a frequency, such as no more than one request per patient every few months, so regular patients don't get a request after every visit.

At checkout, a verbal mention is fine as long as it's low-pressure: "You'll get a short text from us later today with a link if you'd like to share feedback." That tells the patient what's coming and gets consent-to-text questions out in the open.

How to ask: text, email and in-office

Get your direct Google review link

Google gives every verified Business Profile a review link and QR code. Its help center says to go to your Business Profile, select Read reviews, then Get more reviews, and copy the link or download the QR code (QR codes can be generated on a computer, not a phone). Google suggests sharing it by email, WhatsApp or a Facebook post.

Text messages

Texts get seen fastest, which is why most practices use them. Keep the text short, name the practice, and leave out anything about the patient's care:

Hi [First Name], thanks for visiting [Practice Name] today. If you have a minute, we'd appreciate an honest review: [link]. Reply STOP to opt out.

Don't write "thanks for your root canal" or "how's your recovery from surgery?" Texts often show on a lock screen where family or coworkers can see them.

Email

Email has room for a little more context, plus a second link for patients who prefer another site. Use a neutral subject line such as "Thanks for visiting [Practice Name]," not one that reveals a specialty or procedure.

In the office

Signs, a QR code on the checkout counter, or a card in the discharge folder are fine. They invite rather than pressure. What to avoid is the "can you do it right now?" moment at the desk.

Which review sites to send patients to

Point most patients to Google, because that's where your practice shows up in search and Maps. Then add one specialty site where it makes sense:

Healthgrades encourages practices to invite patients to complete its surveys. Its help center says "the best strategy to improve your overall survey score is to encourage more of your patients to complete Patient Satisfaction Surveys." Rotating the second link over time also helps, so one site doesn't get all the attention.

HIPAA and review requests

Sending a review request isn't the same as disclosing a patient's information publicly, but it still involves protected health information. A patient list held by a provider, linked to the fact that someone received care, is PHI. A few points to settle with your compliance officer:

• We found no HHS guidance aimed specifically at review requests. Under the Privacy Rule, "marketing" means a communication that encourages someone to buy or use a product or service. A plain request for feedback doesn't seem to fit that definition, and "health care operations" includes quality assessment and customer service. Still, how your practice classifies these messages is a compliance decision, not a marketing one.
• Vendors need a business associate agreement. HIPAA defines a business associate as someone who creates, receives, maintains or transmits PHI on your behalf. A review-request platform that receives patient names and phone numbers fits that description, so sign a BAA before you upload anything.
• Keep health details out of the message. No procedure, no condition, no provider specialty if it reveals the reason for the visit.
• Honor communication preferences that patients set at intake, such as "email only" or "no texts."

The bigger HIPAA risk comes after the review is posted, when someone at the practice replies. See HIPAA and online reviews and our HIPAA-safe reply templates.

TCPA consent for review texts

The Telephone Consumer Protection Act and the FCC's rules apply to texts as well as calls. The FCC's consumer guide puts it simply: autodialed texts to a cell phone are banned unless the owner gave consent, "commercial texts require written consent; for informational texts, your consent may be oral."

Two details matter for practices:

• The healthcare-message exemption doesn't cover review requests. FCC rules exempt certain free healthcare texts, but only for listed purposes such as appointment confirmations and reminders, lab results, prescription notifications and post-discharge follow-up, and they "must not include any telemarketing, solicitation, or advertising." A review request isn't on that list, so don't rely on the exemption.
• Opt-outs must be honored quickly. FCC rules treat a reply of "stop," "quit," "end," "revoke," "opt out," "cancel" or "unsubscribe" as revoking consent. Opt-outs must be honored within a reasonable time, no more than ten business days.

Practical steps: add a texting consent line to your intake forms that mentions feedback and review requests, keep a record of it, include opt-out instructions in every text, and make sure an opt-out in your review tool also reaches your scheduling system. Whether your platform counts as an autodialer, and whether a review request is "commercial," are legal questions. Ask a healthcare attorney.

Staff scripts that work

Short, honest scripts keep the ask consistent and keep staff away from the problems above.

At checkout:

"Thanks for coming in today. We send a short text after visits asking for feedback. If you're happy to share an honest review, it really helps other patients find us."

On a follow-up call:

"Before I let you go, we'll be sending a link to leave a review. Only if you'd like to, and any honest feedback is welcome."

If a patient raises a complaint at the desk:

"I'm sorry that happened. Let me get [Office Manager] so we can fix it." Then still send the same review request as everyone else. Don't hold it back.

What staff should never say: "Only leave a review if it's five stars," "Mention Dr. [Name] by name," or "We'll take [amount] off your next visit if you post one."

If you'd rather automate requests, Expert Reputation's Review IQ sends patients a direct link to the review sites you select and alerts you when new reviews appear.

What to do when a patient says no

Some patients don't want to review a doctor publicly, especially for sensitive care. Respect it.

• Take "no" the first time. Mark the patient as declined so they don't get repeat requests.
• Process opt-outs everywhere. A STOP reply or an email unsubscribe should stop all review requests, not only that one campaign.
• Offer a private option. "If you'd ever like to tell us how we did, you can reply to this email." Offer private feedback alongside a review request, never in place of one for unhappy patients.
• Don't follow up more than once. One reminder a few days later is plenty; after that, stop.

Common mistakes that cost practices reviews

• Asking only patients who seemed happy, or only those who scored you highly on a survey.
• Running "review us and win" giveaways.
• Having staff or relatives post reviews.
• Texting patients without documented consent.
• Putting the procedure or condition in the request.
• Asking for Yelp reviews.
• Stopping requests after a bad review. More recent, honest reviews are the best context for a negative one.