Healthcare reputation management comes down to three jobs: ask every patient for a review the same way, reply to reviews without revealing anything about anyone's care, and stay inside Google's review policy and the FTC's rules on fake and incentivized reviews. The reply is where practices get hurt. A reply that confirms someone is a patient, or mentions their treatment, can be a HIPAA disclosure, and the HHS Office for Civil Rights has settled with practices over exactly that.
The upside is large. Patients read reviews before they book, and Google uses review count and rating as part of local ranking. This guide covers what the rules say, reply templates that stay compliant, and a review program you can run every week.
Why reviews carry so much weight for a practice
Choosing a doctor or dentist is a trust decision made by a stranger, usually on a phone, usually from the Google local pack. Reviews are the closest thing that patient has to a referral.
BrightLocal's Local Consumer Review Survey 2026, a survey of 1,002 US adults, found:
| Finding | Share of consumers |
|---|---|
| Read online reviews for local businesses | 97% |
| Expect the business owner to respond to reviews | 89% |
| Likely to use a business that responds to all of its reviews | 80% |
| Will only use a business rated 4 stars or higher | 68% |
| Trust online reviews as much as recommendations from people they know | 49% |
You will often see the claim that 84% of patients trust online reviews as much as personal recommendations. That figure circulates from older consumer surveys and is not specific to healthcare. The current BrightLocal number is 49%, which is still half of all consumers treating strangers' reviews like advice from a friend.
Reviews also feed rankings. Google lists prominence as one of the three factors behind local results and says review count and score count toward it (Google Business Profile Help). If you want the full picture of how practices rank on Maps, see Google Maps for healthcare.
What HIPAA allows in a review reply
HIPAA's Privacy Rule limits how a covered provider uses or discloses protected health information (PHI). A patient's name combined with the fact that they were treated at your practice is PHI. A patient posting about their own care does not give you permission to talk about it. Their review is their disclosure; your reply is yours.
The HHS Office for Civil Rights (OCR) has brought this point home in three published settlements:
| Practice | Announced | Payment | What the reply disclosed |
|---|---|---|---|
| Elite Dental Associates, Dallas | October 2019 | $10,000 | A patient's last name and details of their condition, in Yelp replies; OCR found disclosures for multiple patients |
| New Vision Dental, California | December 2022 | $23,000 | Patient names, treatment and insurance details in replies to Yelp reviews |
| Manasa Health Center, New Jersey | June 2023 | $30,000 | Mental health information about patients in replies to Google reviews |
Each settlement also came with a two-year corrective action plan, and OCR found the practices had no written policy on social media disclosures. When announcing the Manasa settlement, OCR said it continues to receive complaints about providers disclosing PHI in response to negative reviews, and that this is not allowed.
The safe rule for every reply: do not confirm or deny that the reviewer is a patient, and never mention a date, a procedure, a diagnosis, a bill or anything said in the room. This applies to positive reviews too. "So glad your implant healed well, Maria!" is a disclosure.
This is a summary of what the rule and OCR's published cases say. It is not legal advice. Your privacy officer or a healthcare attorney should sign off on your reply policy. For the wider set of HIPAA rules that apply to marketing content, see HIPAA-compliant content.
Reply templates that stay compliant
Write a short library of replies, get it approved once, and let the person who handles reviews choose from it. Personalize the tone, never the facts.
Positive review
Thank you for taking the time to share this. Our team works hard to make every visit a good one, and it means a lot to hear it.
Negative review about service or wait times
We take every piece of feedback seriously. Patient privacy rules prevent us from discussing anyone's care here. Please call our office manager at (555) 010-0100 so we can talk this through directly.
Negative review about clinical care
We are sorry to read this. Because of privacy laws we cannot respond to details about any individual's care online. We would welcome a call to our practice manager at (555) 010-0100.
Review you believe is fake or from a non-patient
Do not say "we have no record of you." That statement itself reveals who is and is not a patient. Flag the review through Google (Report inappropriate reviews) and post a neutral reply such as:
We take all feedback seriously and would like to understand more. Please contact our office directly at (555) 010-0100.
What to avoid in any reply
- The reviewer's name if they posted under a nickname
- Any confirmation of a visit, appointment or procedure
- Insurance, billing or balance details
- Arguing about what happened
- Copying the same reply onto every review (BrightLocal found 50% of consumers are put off by templated replies, so vary the wording)
Google's review rules for practices
Google's prohibited and restricted content policy applies to every review on your Business Profile. For a practice, four rules matter most:
- No incentives. You cannot offer anything (a discount, a gift card, entry into a drawing) in exchange for a review, or for changing or removing one.
- No conflicts of interest. Reviews from current or former employees, or anyone with a contractual relationship with the practice, are not allowed. Do not ask staff to review the practice.
- No review gating. Google says businesses may not "discourage or prohibit negative reviews, or selectively solicit positive reviews from customers." Sending a satisfaction survey first and only sending happy patients to Google breaks this rule.
- No quotas. Staff cannot be required to collect a set number of reviews or reviews with specific content.
Reviews that break these rules can be removed. Reviews that are merely negative cannot. Google's Manage customer reviews page explains how to reply and report.
The FTC rule on fake reviews and testimonials
On August 14, 2024, the Federal Trade Commission announced a final rule banning fake and manipulated reviews. It is codified at 16 CFR Part 465 and took effect in October 2024. The FTC can seek civil penalties for knowing violations.
| What the rule prohibits | What it means for a practice |
|---|---|
| Fake reviews and testimonials, including AI-generated ones or ones that misstate the writer's experience | No reviews written by staff, agencies or tools on behalf of "patients" |
| Paying for reviews of a particular sentiment | You cannot reward positive reviews. Asking every patient for an honest review is fine |
| Undisclosed insider reviews | Reviews by owners, managers or staff need a clear disclosure, and managers face limits on soliciting reviews from relatives and employees |
| Company-controlled "independent" review sites | A "best dentists in town" site you own cannot pose as neutral |
| Review suppression through threats, intimidation or false accusations | No legal threats to get a negative review removed |
| Buying fake followers or views | No purchased social proof |
The FTC's Endorsement Guides, revised in June 2023, add a broader principle: in procuring, suppressing, boosting or editing reviews, advertisers should not distort what consumers think of their products (16 CFR 255.2(d)). Showcasing only five-star reviews on your website while hiding the rest can cross that line. Our guide to patient testimonials covers how the Endorsement Guides apply when you put patient stories in your marketing.
How to get more reviews ethically
Volume is what moves both your rating and your rank. A practice with 400 reviews barely notices a one-star review; a practice with 12 feels it for a year. The steps below are what Google itself recommends in Tips to get more reviews, adapted for a practice.
- Get your review link. Generate a short link that opens the review box directly. Our free Google review link generator builds one from your profile.
- Ask everyone, the same way. Send the request to every patient after every visit, by text or email, with no screening. Equal treatment is what keeps you inside Google's gating rule.
- Time it well. Same day or next day, while the visit is fresh. For procedures with a recovery period, ask after the follow-up.
- Keep the message neutral. "Would you share your experience on Google?" is fine. "Would you leave us 5 stars?" is not.
- Make it part of checkout. A sign at the front desk and a QR code on the discharge sheet add a second prompt.
- Reply to every review within a week. BrightLocal found 81% of consumers expect a reply within a week.
- Check the numbers monthly. Track new reviews per month, average rating and reply rate per location.
Keep PHI out of the request itself. The text should not name the procedure or the provider in a way that reveals care to anyone reading over the patient's shoulder. Our full playbook is how to get more Google reviews.
Monitoring your reputation beyond Google
Google reviews carry the most weight for local search, but patients also read Healthgrades, Vitals, Zocdoc, Yelp and Facebook. The same reply rules apply on every platform. Set up alerts for each, and assign one owner so nothing sits unanswered.
AI assistants now answer questions like "best pediatric dentist in Austin" by summarizing reviews and directory listings. Rank.ai's free AI grade asks ChatGPT, Claude and Gemini the questions patients ask and shows whether your practice is named and which competitors are. A Google Business Profile audit checks the profile those answers often draw from.
| Task | Why | How often |
|---|---|---|
| Send review requests | Steady volume protects your rating | After every visit |
| Reply to new reviews | Patients and Google both see replies | Within a week |
| Flag policy-violating reviews | Removes fake and conflict-of-interest reviews | As they appear |
| Review your reply library with your privacy officer | Keeps replies HIPAA-safe | Once a year |
| Compare rating and count to the top 3 competitors | Shows where you stand in the local pack | Monthly |
FAQ
Can a doctor respond to a negative review?
Yes, as long as the reply does not confirm the reviewer is a patient or reveal anything about their care. A short, general reply that invites them to call the office is the standard approach. OCR has settled with practices whose replies included names, treatment details or insurance information.
Is it a HIPAA violation to thank a patient for a review?
A generic thank-you is fine. Adding details, such as their name, the procedure, or how their recovery went, discloses PHI and is the kind of reply OCR has acted on. Keep the thanks about their feedback.
Can a practice offer a discount or gift for leaving a review?
No. Google's policy bans reviews posted because of an incentive, and the FTC's rule bans compensation conditioned on a positive or negative review. Ask every patient for an honest review with nothing attached.
How do I get a fake review removed from Google?
Flag it from your Business Profile using Google's "Report review" option, citing the policy it breaks (fake engagement, conflict of interest, off-topic). Google removes reviews that break its policies; it does not remove reviews only because they are negative. Do not reply with "we have no record of you," because that statement reveals who is and is not a patient.
Is it legal to only ask happy patients for reviews?
Google's policy forbids selectively soliciting positive reviews, so a profile that does this risks having reviews removed. The FTC's Endorsement Guides also warn against procuring reviews in ways that distort what consumers think. Send the same request to every patient.
Should we post patient reviews on our website?
You can, with care. Show a representative mix of ratings, keep the reviewer's name off unless they agreed to it in writing, and know that Google does not show star ratings in search for reviews a business publishes about itself. See patient testimonials for the consent and FTC rules.
