You respond to a patient review without violating HIPAA by saying nothing about the patient: don't confirm they were a patient, don't mention their care, and don't correct their version of events. Thank them, state your general standards, and invite them to contact the office directly. That is the whole rule. Everything else in this post is how to apply it when a one-star review makes you want to say more.
Why a friendly reply can still be a violation
In most businesses, replying "we're sorry about your wait on Tuesday" is good practice. In a healthcare setting, that sentence can confirm that a specific person visited your clinic on a specific day. Under HIPAA, that confirmation is itself protected information, even if the reviewer posted their own name and complaint in public.
The reviewer waived nothing on your behalf. They can say whatever they like about you. You can't confirm or add to it.
This is not a theoretical risk. According to a Nixon Peabody alert, HHS's Office for Civil Rights settled with Manasa Health Center in 2023 over replies to Google reviews that allegedly disclosed details of patients' treatment, and a North Carolina dentist was reportedly fined $50,000 after responding to a negative review. Those figures come from search summaries of the alert, so read the original and check with your privacy counsel before you write a policy around them.
The rules for every reply
Four habits keep you on the safe side:
- Never confirm the relationship. Avoid "your visit," "your appointment," "when you came in," and "as a patient of ours."
- Never reference care. No treatment, diagnosis, medication, billing, or scheduling details, positive or negative.
- Never rebut. Even when the review is factually wrong, correcting it requires disclosing what actually happened.
- Take specifics offline. Give a phone number or email and stop there.
Positive reviews are lower risk but not risk-free. "So glad your root canal went well!" is a disclosure. "Thank you for the kind words, we appreciate it" is not.
Reply templates
Negative review, any complaint:
"Thank you for taking the time to share this. We take all feedback seriously and aim to give every person who walks in the same standard of care. Because of privacy rules we can't discuss any individual's situation here, but please call our office at [number] and ask for [role] so we can listen."
Negative review that names a staff member:
"We appreciate the feedback and we review every comment with our team. We can't discuss specific people or visits in a public forum, but we'd like to hear more directly. Please contact [name or role] at [number]."
Positive review:
"Thank you for the kind words. It means a lot to the whole team, and we're glad you took the time to post."
Notice what is missing from all three: any detail the reviewer didn't already control. These replies also read as calm and human to the next person scanning your profile, which is the audience that matters. The longer playbook for tone is in our guide to replying to a negative Google review.
Should you reply to every review?
Generally yes, and fast, because an unanswered complaint sits at the top of your profile as a statement in itself. The case for and against is covered in should you respond to every Google review. In healthcare, the answer comes with one extra step: give front-desk staff or a practice manager a short list of approved phrases, so nobody improvises a helpful but non-compliant sentence at the end of a long day.
If you run a dental practice specifically, the privacy-safe playbook for dental practices covers who does what across asking, monitoring, and replying.
Fewer risky replies start with a private channel
Every public complaint is a reply you have to write carefully. Some of them never needed to be public. If a patient is unhappy about parking, hold times, or a billing question, they will often tell you directly if there is an obvious, easy place to do it.
That is the logic behind private feedback versus public reviews. A rating prompt that gives every patient the same options, including a private note to the practice, means some frustration reaches your private feedback inbox instead of a public profile. This is not gating: nobody is screened by rating, every patient sees the same choice, and anyone who wants to post publicly still can. The point is to give people a direct way to reach you, not to stop them from posting.
A short policy to write down today
Put these four lines in your staff handbook:
- Only named staff may reply to reviews.
- Replies never confirm someone was a patient.
- Replies never mention care, billing, or scheduling.
- Anything specific moves to a phone call.
Replies are public, permanent, and searchable, and they are easy to get wrong when you are frustrated. A written rule beats good intentions. Starboard gives each location its own code and a private inbox so patients can reach you before they reach Google, but the policy above works with or without it.
This post is general information, not legal advice. Ask your privacy officer or counsel to review your reply policy.