How to Respond to Negative Patient Reviews Without Violating HIPAA

By the Expert Reputation team · Updated September 30, 2026

Healthcare practices can respond to negative online reviews, but not the way other businesses do. A reply that confirms the reviewer is a patient, or mentions their visit, condition, treatment, or bill, can be an impermissible disclosure under the HIPAA Privacy Rule, and HHS has taken enforcement action against practices for exactly that. This guide covers what not to say, the real enforcement cases, reply templates that stay general, and when to report a review instead.

This is general information, not legal advice. For a specific situation, talk to a healthcare attorney or your compliance officer.

Why patient reviews are different

Most businesses are told to reply with specifics: "We checked your order and..." A healthcare practice can't do that.

Under the HIPAA rules, health information includes information that relates to "the provision of health care to an individual" or payment for that care, and it becomes individually identifiable when it identifies the person or could reasonably be used to identify them (45 CFR 160.103). A public reply under someone's review is attached to their name or profile. So a sentence like "We're sorry your crown didn't fit" or "As we discussed at your appointment last week" ties that person to your practice and their care.

The practical rule: reply as if you have no idea whether the reviewer was ever your patient.

What not to say in a reply

Never include any of the following, even if the reviewer already mentioned it:

• Anything that confirms a patient relationship: "We're sorry about your visit," "Thanks for being our patient," "We've reviewed your chart."
• Dates, appointments, or scheduling details: "You arrived 30 minutes late," "You canceled twice."
• Diagnoses, symptoms, procedures, or medications, including correcting the reviewer's account of their own treatment.
• Billing, balances, insurance, or collections: "Your insurance denied the claim," "You have an outstanding balance."
• Anything from communications with the patient: what they said on the phone, in the portal, or in the exam room.
• Their name, if they posted under a nickname, or any other detail that helps identify them.
• Arguments, sarcasm, or accusations. Beyond HIPAA, the FTC's consumer review rule prohibits unfounded legal threats, intimidation, and knowingly or recklessly false public accusations aimed at getting a review removed.

A common trap: the patient posts detailed, one-sided claims about their care, and the practice feels it has to "set the record straight." That instinct is exactly what led to the enforcement actions below. The patient telling their own story does not give the practice permission to tell its side with health details.

General reply advice from platforms sometimes conflicts with HIPAA. Google's tips, for example, suggest addressing the reviewer by name and acknowledging their specific feedback. For a healthcare practice, the safer approach is to skip the name and keep the reply general.

HHS enforcement actions over review replies

The HHS Office for Civil Rights (OCR) enforces the HIPAA Privacy Rule. It has announced four enforcement actions that involved practices disclosing patient information in response to online reviews:

What OCR has said about it:

• "Social media is not the place for providers to discuss a patient's care," said OCR Director Roger Severino in 2019. "Doctors and dentists must think carefully about patient privacy before responding to online reviews."
• "Providers cannot disclose protected health information of their patients when responding to negative online reviews. This is a clear NO," said OCR Director Melanie Fontes Rainer in 2022.
• In 2023, announcing the Manasa settlement, she said OCR "continues to receive complaints" about providers disclosing patient information in response to negative reviews: "Simply put, this is not allowed."

Two patterns stand out. First, the amounts were modest compared with large HIPAA cases, but each settling practice also agreed to a corrective action plan monitored by OCR for two years. Manasa's plan, for example, required written policies, workforce training (including owners and managers), breach notices to affected patients, and a breach report to HHS. Second, in the UPI case, a practice that ignored OCR ended up with a civil money penalty. Take any OCR inquiry seriously and involve counsel early.

Safe reply templates

These templates don't confirm a patient relationship or mention any care. Adapt the tone, but don't add specifics.

General negative review

Thank you for taking the time to share your feedback. We take all comments seriously and want every person who contacts our office to have a positive experience. Because we're committed to protecting patient privacy, we can't discuss any details here. Please call our office manager, [Name], at [Phone] so we can talk directly. — [Practice Name]

Complaint about wait times, staff, or the front desk

We appreciate you letting us know. Courtesy and respect for people's time matter to us, and we share feedback like this with our team. We'd welcome the chance to talk with you. Please contact [Name] at [Phone]. — [Practice Name]

Complaint about a bill or insurance

Thank you for reaching out. Privacy laws prevent us from discussing any account details online, but our billing team is glad to help. Please call [Phone] and ask for [Name]. — [Practice Name]

A review you suspect isn't from a patient

Don't say "We have no record of you as a patient." That statement is itself information about whether someone is or isn't a patient. Use the general template instead, and report the review if you have evidence it breaks platform rules (see below).

A positive review

Keep it equally general: "Thank you so much for the kind words. We're glad to hear it!" Avoid "We loved seeing you at your cleaning" or "Glad your knee is healing well."

Before anyone posts, have one person approve all review replies, and keep a short written policy. The Elite and Manasa cases both cited missing policies and procedures. For more wording ideas, see our negative review response templates, then remove anything that touches on care.

Take it offline, then follow HIPAA there too

Once the reviewer calls, you're in a normal patient conversation: verify identity the way you usually would, then discuss their concerns privately. Don't ask the patient to remove or change their review in exchange for anything. Google's policy prohibits offering incentives for the revision or removal of a negative review, and the FTC's rule (16 CFR Part 465) bans buying reviews that express a particular sentiment. You can resolve a complaint, waive a fee, or refund a charge on its own merits, never as a condition of changing a review.

For a step-by-step plan for the first day, see what to do in the first 24 hours after a bad review.

When to flag a review instead of responding

Platforms remove reviews that break their content policies, not reviews that are negative or that a practice considers inaccurate. Google says not to report a review just because you disagree with it. Yelp says it doesn't take sides in factual disputes.

Reviews that may be worth reporting include:

• Conflicts of interest. Google's policy lists current or former employment, industry competitors, and family relationships. Yelp removes reviews it can clearly identify as coming from current or former employees, competitors, or peers, and asks for specific evidence. See reviews from competitors, employees and non-customers.
• Content not based on a real experience, or a review meant for a different practice.
• Harassment, threats, hate speech, or private information about your staff.

When you report a review, use the platform's reporting form and explain the policy issue. Don't include patient information in the report either. Even a report to Google or Yelp shouldn't include chart details.

Physician review sites such as Healthgrades, Vitals, Zocdoc, and WebMD have their own rules; start with our Healthgrades guide, and see can you remove a review? for what platforms will and won't take down. No one, including a reputation company, can guarantee a platform will remove a review.

State law and licensing boards

HIPAA sets a federal floor. HHS explains that state laws that are contrary to the Privacy Rule are generally preempted, but state laws that provide greater privacy protection are an exception and still apply. Some states have their own medical confidentiality laws, and state licensing boards regulate professional conduct, including confidentiality. Rules vary by state and by profession, so check with your board's guidance and a healthcare attorney before adopting a review-response policy.

Building a steadier review profile

The best protection against one bad review is a steady stream of honest ones. Ask every patient for feedback in the same way, not only the ones you expect to be happy. Google prohibits selectively soliciting positive reviews, and the FTC has said that asking only customers you think are happy could violate the FTC Act. Keep any review request free of health details, and don't ask staff or relatives to post reviews. Tools like Survey HUB can send the same post-visit survey to every patient, which also surfaces complaints privately before they turn into reviews, as long as every patient still gets the same chance to post a public review.