How Can My Practice Ask Patients for Google Reviews Without HIPAA Trouble?
Last updated: November 13, 2026 · By Kayce Sadler, Founder & CEO, Abode Marketing
Yes, you can ask patients for Google reviews. Keep the request generic, send it through a channel the patient already agreed to, and make sure any vendor that sends requests on your behalf has signed a business associate agreement. The HIPAA risk isn’t in asking. It’s in what the message reveals, who sends it, and how you reply once the review is posted.
Key takeaways
- A review request is a communication with a patient, so keep health details out of it: no diagnosis, procedure or provider-specific treatment info.
- Any software that uses your patient list to send requests usually needs a business associate agreement.
- Ask every patient the same way. Google’s policy forbids only inviting happy patients.
- Don’t offer discounts, gifts or drawings for reviews.
- Your public replies to reviews must not confirm someone is a patient or discuss their care.
Is asking a patient for a review allowed under HIPAA?
Yes. Contacting your own patients about their experience is generally part of normal operations, and many practices do it. Where practices get into trouble is in the details: a text that says “Thanks for your colonoscopy with Dr. Smith, please review us” reveals health information to anyone who sees the phone, and a reply to a review that mentions the patient’s treatment discloses protected health information publicly. HHS has fined practices for exactly that kind of review reply.
I’m not a lawyer, and your compliance officer should sign off on your process. But the pattern below is how most practices ask safely.
What should a patient review request say?
| Include | Leave out |
|---|---|
| Your practice name | The reason for the visit or any diagnosis |
| A thank-you for choosing the practice | The procedure, test or treatment |
| A direct link to your Google review page | Specialty details that imply a condition |
| A note that reviews are optional | Any offer, discount or entry into a drawing |
| How to opt out of future messages | Pressure or follow-up reminders that feel insistent |
Example: “Thank you for choosing [Practice Name]. If you have a moment, we’d be grateful for a Google review: [link]. Reply STOP to opt out.” That’s it.
Do review platforms need a business associate agreement?
Usually, yes. If a vendor receives your patient names, phone numbers or emails tied to visits so it can send review requests, it’s handling protected health information on your behalf. That makes it a business associate under HIPAA, and you need a signed business associate agreement before connecting it to your practice management system. Many reputation platforms built for healthcare offer one. If a vendor won’t sign, don’t send it patient data.
What does Google allow when asking for reviews?
Google’s contribution policy prohibits incentives for reviews and “selectively soliciting positive reviews,” which is the practice of asking “how was your visit?” first and only sending happy patients to Google. Here’s my take: that rule is good for practices anyway. A steady flow of honest reviews from every patient reads as more trustworthy than a wall of perfect fives, and it protects you from having reviews removed.
It’s fine to also give patients a private way to share feedback, as long as it’s offered alongside the review link, not instead of it.
How do we reply to reviews safely once they come in?
- Don’t confirm the reviewer is a patient, even if they say so.
- Don’t mention dates, providers, treatments or anything from the chart.
- Thank positive reviewers in general terms.
- For negative reviews, invite them to call the office manager and take it offline.
- Have one trained person, or a reviewed template, handle replies.
What we’d check first
We’d review the wording of your current review requests, check whether your review tool has a signed business associate agreement, and look at your past review replies for anything that confirms a patient relationship.
If you’d like a second set of eyes, our free visibility audit covers this and shows where you stand on Google, Maps and AI search.
More owner questions we’ve answered: Responding to negative reviews under HIPAA · Why patients choose the clinic down the street · Tracking pixels and HIPAA
Frequently asked questions
Can we text patients asking for reviews?
Yes, if they’ve agreed to receive texts from your practice and the message contains no health details. Include a way to opt out.
Can we offer a gift card for leaving a review?
No. Google’s policy prohibits incentives for reviews, whether the review is positive or negative.
Can we ask only patients who had a good experience?
No. Google prohibits selectively soliciting positive reviews. Ask every patient the same way.
Do we need patient consent to ask for a review?
Contacting patients about their experience is generally part of operations, but follow the communication preferences they’ve given you and your own policies.
Can staff ask patients for reviews at checkout?
A friendly mention is fine, but Google’s policy discourages pressuring people to review while they’re on the premises, so send the link afterward.
Sources
- Google Maps Help: Maps user-contributed content policy — Rules on incentives and selective soliciting
- HHS: Sample business associate agreement provisions — What a business associate agreement covers
- HHS OCR: Settlement over PHI disclosed in review responses (2023) — Enforcement over online review replies
