By the MGMT Reputation team · Updated 28 October 2026
If you are wondering how to respond to negative reviews without violating HIPAA, the short answer is this: reply in general terms only, never confirm that the reviewer is or was a patient, never mention any visit, treatment or bill, and invite them to contact the practice directly. Even “We’re sorry your appointment went badly” can be a disclosure. When a review is fake, from a non-patient or breaks platform policy, it can be removed instead: MGMT Reputation removes qualifying Google reviews for $750 for an image review or $1,000 for a text review, removed within 14 days or your money back.
This guide is for doctors, dentists, therapists, chiropractors and clinic managers. It explains why ordinary customer-service replies are risky in healthcare, gives a reply you can adapt, lists what never to say, and covers when removal is the better route.
This is not legal advice. MGMT Reputation is not a law firm. HIPAA questions about your own practice should go to your compliance officer or healthcare counsel.
Why a review reply can be a HIPAA disclosure
The HIPAA Privacy Rule protects individually identifiable health information. The fact that a named person is a patient of a particular practice is itself health information, especially for a dentist, a psychiatrist, an addiction clinic or a fertility practice, where the specialty says a great deal on its own.
So a reply that confirms the relationship can be a disclosure, even if it shares nothing clinical. “We have no record of your visit on that date” confirms you checked a patient file. “As we discussed at your last appointment” confirms there was one. Responding to a review is not one of the purposes for which HIPAA permits disclosure without the patient’s written authorization.
Three common assumptions trip practices up:
- “The patient posted it publicly, so I can respond to the details.” A patient choosing to share their own information does not give the practice permission to share it.
- “The review is anonymous, so a reply is safe.” If the reviewer is identifiable to the people who know them, a detailed reply can still identify them.
- “I’m only repeating what they already said.” Repeating it, confirming it or correcting it all come from the practice, and that is what counts.
HHS has enforced this
This is not a theoretical risk. The HHS Office for Civil Rights (OCR), which enforces HIPAA, has brought enforcement actions against healthcare providers over the way they responded to online reviews. The cases have included small and mid-sized practices, including dental offices, where replies disclosed patient information, and they have led to settlements, monetary penalties and multi-year corrective action plans.
A common thread is that these cases often begin with a complaint from the patient who wrote the review. An unhappy patient who sees their care discussed in a public reply has a straightforward route to OCR. The corrective action plan that follows, with its policies, training and monitoring, can cost the practice more time and money than the penalty itself.
How to respond to negative reviews without violating HIPAA
Knowing how to respond to negative reviews without violating HIPAA mostly means using one safe pattern, and it is the same for almost every review.
- Speak about the practice, not the person. Describe your general standards and how you handle feedback.
- Confirm nothing. Do not confirm or deny that the reviewer is a patient, that a visit took place or that any detail in the review is accurate.
- Note that privacy rules limit what you can say, in neutral language, without implying anything about this person.
- Take it offline. Give a phone number or general office email and invite them to contact the office.
- Keep it short. Two to four sentences is plenty.
A reply you can adapt
Thank you for taking the time to share this feedback. We take every concern seriously and are committed to a respectful, high-quality experience for everyone who contacts our office. Privacy rules prevent us from discussing any individual’s care online, but we would welcome the chance to speak with you directly. Please call our office manager at [office phone number].
This reply confirms nothing. It would read the same if the reviewer had never set foot in the building, and that is the point.
For billing, wait-time or front-desk complaints, the same structure works: state your general policy (“we aim to see every patient within a short time of their scheduled appointment”) and invite contact, without referring to this person’s appointment or account. For sensitive specialties such as mental health, addiction treatment or reproductive care, use the most restrained version. Many practices in those fields choose not to reply publicly at all.
What never to say in a public reply
- The reviewer’s name, or any detail that identifies them
- That they are, or were, a patient (“we have treated you for years”)
- That they are not a patient, if you had to check records to say so
- Dates, appointments, procedures, diagnoses, prescriptions or test results
- Insurance, balances, payment history or collections
- What staff said happened in the room
- “Due to HIPAA we cannot discuss your treatment”, which implies there was treatment
Be careful with AI-drafted replies. Tools that suggest review responses often echo the details of the review back, which can confirm the relationship. The practice is responsible for what it posts, whoever drafted it. Private messages through the review platform carry the same risk; keep anything specific to a secure channel.
When a review can be removed instead
Because a practice cannot argue its side in public, removal is often the right answer, where the review qualifies. Google and the medical review sites remove reviews that break their own policies, including:
- Fake reviews from people who were never patients
- Reviews from non-patients, such as a competitor, a former employee or someone with a personal grudge
- Reviews that breach policy: harassment, threats, hate speech, profanity aimed at staff, or spam
- Reviews that disclose another patient’s information, or a staff member’s private details
- Reviews about the wrong practice
A review that is negative but genuine, and within policy, stays up. We will tell you that before you pay.
Removal has to be pursued without disclosing health information, including to the platform. That is where most self-filed reports go wrong. MGMT Reputation builds the case around the specific policy the review breaks, using information that does not expose any patient, and files through the platform’s official channels. We never contact the reviewer.
Google review removal is $750 for an image review and $1,000 for a text review, removed within 14 days or your money back. Fake review removal is priced the same. Reviews on Healthgrades, Vitals, Zocdoc and other medical review sites are quoted per job. Every job is paid upfront, by card, bunq, ACH or Zelle. Current prices for every service are on our pricing page.
Our reputation management for doctors service covers review removal and search results for physicians and medical practices. Dental practices have their own page: reputation management for dentists.
Building more genuine reviews, compliantly
The most reliable answer to one bad review is many honest ones. A practice with a large, steady flow of real reviews is not defined by any single post.
Ask every patient, the same way. A consistent request to every patient, not only the ones you expect to be pleased, is fair and in line with Google’s policies, which prohibit selectively asking only happy customers.
Keep requests clear of health details. A short message with a link to your review page is enough. Do not mention the visit, the treatment or the reason they came in. Check with your compliance officer how your practice may use patient contact details for these requests.
No incentives. No discounts, gift cards or prize draws in exchange for reviews. The FTC’s 2024 rule on consumer reviews bans incentives conditioned on positive reviews, and platforms remove incentivised reviews. Our guide on the legal risks of buying fake reviews covers why fabricated or staff-written reviews backfire.
Testimonials need authorization. Featuring a patient’s review or story on your website or in advertising is a different use from a reply, and generally needs the patient’s written HIPAA authorization.
Keep the profile accurate. Correct hours, phone numbers, providers and services cut down on the frustrated reviews that come from wrong information. Our Google Business Profile audit is $297, delivered within 48 hours, and credited toward Google review removal.
Put a simple policy in place
A written policy is the simplest way to make sure everyone at the practice knows how to respond to negative reviews without violating HIPAA. Most problem replies are written quickly, late at night, by someone who is upset. A one-page policy prevents that: one designated person replies, every reply follows the approved template, anyone with access to the practice’s review accounts is trained, and replies are logged. If a reply already posted shares too much, take it down promptly and speak to your compliance officer about whether it needs to be assessed as a possible breach.
Frequently asked questions
Can a doctor respond to a negative review at all?
Yes, as long as the reply is general and confirms nothing about the reviewer, their care or their relationship with the practice. A short, neutral reply that invites direct contact is the safe pattern.
Is saying “we can’t discuss this because of HIPAA” safe?
It can imply the reviewer is a patient. A more neutral line is that privacy rules prevent the practice from discussing any individual’s care online.
If the patient shared their own details in the review, can I respond to them?
No. The patient’s choice to share does not authorize the practice to confirm or discuss those details. Check with your compliance officer or counsel before responding to anything specific.
Can a fake or non-patient review be removed?
Often, yes, when it breaks the platform’s policy. MGMT Reputation removes qualifying Google reviews for $750 for an image review or $1,000 for a text review, removed within 14 days or your money back.
Does HIPAA apply to every healthcare business?
It applies to covered entities, such as most providers who bill insurance electronically, and to their business associates. Whether it applies to your practice is a question for your compliance officer or counsel.
We remove it for you
If a review is hurting your practice and you cannot answer it publicly without risk, that is what the consultation is for. Book a free, confidential consultation and we will tell you plainly whether the review can be removed, how to handle it if it cannot, what it costs and how long it takes. This guide is not legal advice; please check any HIPAA question with your compliance officer or counsel.
