Can My Practice Respond to a Negative Patient Review Under HIPAA?
Last updated: November 12, 2026 · By Kayce Sadler, Founder & CEO, Abode Marketing
Yes. HIPAA doesn’t stop you from replying to a review; it stops you from disclosing protected health information in the reply, and that includes confirming the reviewer was ever your patient. A short, general response that speaks to your policies and invites them to call the office is safe. Anything about their visit, diagnosis, schedule, or bill is not, even if they posted those details first.
Key takeaways
- HHS’s Office for Civil Rights has taken at least four enforcement actions since 2019 against practices that disclosed patient information in review replies, ranging from $10,000 to $50,000.
- A patient sharing their own story publicly does not give you permission to share anything back.
- Safe structure: thank them, speak to your general standards, never confirm or deny they’re a patient, and give a name and number to call.
- Google only removes reviews that violate its policies, not ones you disagree with. Report the true violations, answer the rest calmly.
- In the New Vision Dental and Manasa cases, OCR also cited privacy policy failures, not just the replies. A written review-response policy is part of the fix.
Is it a HIPAA violation just to reply to a review?
No. Replying is allowed. What HIPAA prohibits is disclosing protected health information without authorization, and a public review reply is a disclosure like any other. The tricky part is how little it takes. Writing “we’re sorry your visit last Tuesday ran long” confirms the person is your patient and when they came in.
The American Medical Association’s guidance (from 2016, but still the standard advice) is blunt: “don’t even acknowledge the person is a patient in your office.” Back in 2013, OCR told a plastic surgery practice that a provider may not confirm or deny that someone is a patient when responding online. The patient’s own post doesn’t change that. They can share their health information; you still can’t.
What has HHS actually fined practices for?
These are real, public cases from HHS’s Office for Civil Rights. Every one started with an owner or staff member trying to set the record straight.
- Elite Dental Associates, Dallas (2019): $10,000. The practice’s replies to Yelp reviews included a patient’s last name, treatment plan, insurance, and cost information. OCR also found disclosures about other patients in replies to their reviews.
- Dr. U. Phillip Igbinadolor, D.M.D. & Associates, North Carolina (2022): $50,000 civil money penalty. A reply to a negative online review named the patient, described his care, and said he “never came back for his scheduled appointment.” The practice didn’t respond to OCR’s data request or subpoena.
- New Vision Dental, California (December 2022): $23,000. Replies to online reviews disclosed patients’ names, treatment details, and insurance information. The settlement includes two years of OCR monitoring.
- Manasa Health Center, New Jersey (June 2023): $30,000. A psychiatric practice posted details about a patient’s mental health diagnosis and treatment in reply to that patient’s negative review, and disclosed information about three other patients the same way. OCR found it hadn’t implemented HIPAA privacy policies.
Announcing the Manasa settlement, OCR Director Melanie Fontes Rainer said OCR keeps receiving complaints about this: “Simply put, this is not allowed.”
What does a safe response look like?
Keep it short, calm, and about your practice rather than the person. Here’s a structure that works for most negative reviews:
- Thank them for taking the time to share feedback.
- State a general standard: “We want every person who contacts our office to feel heard and respected.”
- Don’t confirm, deny, or describe any visit.
- Offer a direct line: “Please call our practice manager, [first name], at [office number] so we can talk this through.”
- Sign with a role, not a provider’s name tied to treatment.
Then actually call if you know who it is, and handle it privately. A calm phone call is where these get resolved. A public back-and-forth almost never is. Wait a few hours before replying so the response reads level, not defensive.
Positive reviews deserve the same care. “So glad your shoulder is feeling better after surgery!” discloses just as much as a defensive reply. “Thank you for the kind words; we’ll share them with the team” is enough.
Which phrases are safe, and which ones get practices in trouble?
| Avoid (discloses patient information) | Use instead |
|---|---|
| “We’re sorry your appointment on Tuesday ran behind.” | “We’re sorry to hear about this experience. We work hard to respect everyone’s time.” |
| “Our records show you missed two appointments.” | “We’d welcome the chance to talk through any scheduling concerns. Please call our office.” |
| “Your insurance denied the claim; that wasn’t our decision.” | “Billing questions can be frustrating. Our billing manager is happy to walk through any questions by phone.” |
| “As your surgeon, I explained the risks before the procedure.” | “Our providers take time to explain options and answer questions for everyone we see.” |
| “We have no record of you ever being a patient here.” | “We weren’t able to match this to anyone we can reach. Please call us so we can understand what happened.” |
| “Glad your back pain is gone after your injections!” | “Thank you for taking the time to leave a review.” |
Notice the fifth row. Even denying someone was a patient tells the public something about your records, so the safer move is the same neutral reply you’d give anyone.
When should I report a review to Google instead of replying?
Report it when it actually breaks a Google policy, such as spam, profanity, off-topic content, a conflict of interest like a competitor or ex-employee posting, or someone posting another person’s private information. Google’s help page is clear that only reviews that violate its policies are eligible for removal, and it says not to report a review “just because you disagree with it or dislike it.”
You can flag from your Business Profile or through Google’s Reviews Management Tool, which shows the status of each report. If a report is turned down, you get a one-time appeal, and you can select up to 10 reviews in that appeal. While you wait, it’s still fine to post a neutral reply.
Who on my team should be allowed to respond?
As few people as possible, with a written policy. In the New Vision and Manasa cases, OCR also pointed to missing or unimplemented privacy policies, not just the replies themselves. Pick one or two people, give them approved response language, and require a second look before anything goes up on a review that mentions care, billing, or a specific provider.
Make it part of HIPAA training for front-desk and clinical staff too, because a tech who replies from a personal account under the practice’s name creates the same problem.
What we’d check first
- Every existing reply on Google, Facebook, Yelp, Healthgrades, and any other site, looking for anything that confirms a patient relationship, a date, a treatment, or a bill. Those get edited or deleted first.
- Your response rate and review recency compared to the three practices in your map pack, so you know whether silence is costing you more than any single bad review.
- Reviews that may truly violate Google’s policies, ready to report through the Reviews Management Tool.
- Duplicate or old Google profiles where unanswered reviews are still sitting, and whether your listings are consistent across directories.
- How AI tools summarize your reviews. Ask ChatGPT or look at Google’s AI review summaries for your practice to see which complaints are being repeated.
- Your review request process, making sure every patient gets the same ask so your rating reflects the whole practice, not just the loudest voices.
For broader guidance on handling criticism, see how service businesses should respond to negative reviews, and for the ranking side, whether Google reviews affect ranking. Our reputation management page explains how we help practices build a steady review flow.
If you’d like a second set of eyes, our free visibility audit reviews your Google profile, your reviews and replies next to nearby practices, your listings, and what AI tools say about your practice, and flags anything in past replies that could raise a privacy concern.
More owner questions we’ve answered: Why Are Patients Choosing the Clinic Down the Street Instead of Mine? · How Do You Market a Cash-Based Physical Therapy Practice? · A Hurricane Closed Our Office. What Do We Do With Google Business Profile?
Frequently asked questions
Can I respond if the patient already shared their diagnosis in the review?
You can respond, but you still can’t add to or confirm what they shared. The patient’s choice to disclose their own health information doesn’t authorize your practice to disclose anything. Reply as you would to any review, with general language and an invitation to call.
Should I just not respond to negative reviews at all?
Not responding is HIPAA-safe, but it isn’t always the better business choice. Many patients read replies to judge how a practice treats people, and a calm, general response often reads better than silence. A practice-wide policy that answers every review the same careful way is easier to manage than deciding case by case.
Can I ask the patient to take down or change their review?
You can reach out privately to resolve the concern, and some patients choose to update their review afterward. The FTC’s guidance cautions that pressuring people to change or delete negative reviews can mislead other readers. Focus on fixing the problem and let the patient decide what to do.
Does HIPAA apply to chiropractors and physical therapists responding to reviews?
If your practice is a HIPAA covered entity, which generally means you bill health plans electronically, the same Privacy Rule applies regardless of specialty. Cash-only practices should confirm their status with a compliance advisor. Either way, keeping patient details out of public replies is the safe habit.
Can I sue a patient over a negative review instead?
That’s a legal question for your attorney, and it rarely helps a practice’s reputation. Lawsuits and legal threats can draw more attention to the review. The FTC’s consumer review rule also bars using unjustified legal threats to suppress reviews.
Sources
- HHS: OCR Reaches Agreement with New Jersey Provider That Disclosed Patient Information in Response to Negative Online Reviews (June 2023) — Manasa Health Center, $30,000; OCR Director quote
- HHS: OCR Settlement with Dental Practice over Disclosures of PHI (Dec 2022) — New Vision Dental, $23,000, names/treatment/insurance in review replies, two-year monitoring
- HHS: Dr. U. Phillip Igbinadolor, D.M.D. & Associates civil money penalty — $50,000 CMP, PHI disclosed in response to negative online review, March 2022
- HHS: Elite Dental Associates resolution agreement (2019) — $10,000 settlement over social media disclosures of PHI
- ArentFox Schiff: Disclosing Patient Information in Responses to Online Reviews — Case details: Elite Yelp disclosures, UPI Google review reply, 2013 OCR letter on confirming/denying patient status
- AMA: How to respond to bad online reviews (2016) — Don’t acknowledge the person is a patient; take it offline; speak to general policies
- Google Business Profile Help: Report inappropriate reviews — Only policy-violating reviews removed; Reviews Management Tool; one-time appeal up to 10 reviews
