How to reply to a bad review without breaking HIPAA

A one-star review appears. It is unfair, it misrepresents what happened, and you have the chart open in front of you proving it.

Everything about that situation pushes you toward writing a reply that sets the record straight. Do not.

The one rule

A public reply must never confirm that the person is a patient, and must never mention anything about their care, their visit, their balance or their behaviour in your office.

Not to correct an inaccuracy. Not to defend a team member. Not even if the reviewer disclosed the details themselves first.

That last part surprises people. A patient waiving their own privacy in public does not give the practice permission to discuss their information. The obligation is yours and it does not switch off.

New Vision Dental, a California practice, settled with the HHS Office for Civil Rights for $23,000 after responding to Yelp reviews with patient details. The dentist was defending the practice. That was the problem.

Three replies that cover almost everything

A complaint about clinical care or outcome

Thank you for taking the time to share this. We take concerns about care seriously and would like to understand what happened. Please call the office and ask for the practice manager.

A complaint about billing or insurance

We appreciate the feedback. Billing questions are often easier to resolve directly, and we would like the chance to look into this. Please call the office and ask for the practice manager.

A complaint about staff or wait times

Thank you for the feedback. This is not the experience we aim to provide, and we would like to hear more. Please call the office and ask for the practice manager.

Notice what all three have in common. No confirmation that the person was ever there. No detail. No defence. One route to a private conversation.

They are deliberately a little bland. Blandness is the feature.

What about a review you believe is fake

It happens. A competitor, a disgruntled former employee, someone who has confused you with another practice.

Still do not engage on the facts. Report it to Google instead. Their policy prohibits content that is not based on a real experience, as well as reviews posted by a competitor or by someone with a conflict of interest, and they do remove them.

If you must reply publicly while it is under review, say only that you have no record matching the account and have asked the platform to look at it. “No record matching this account” is safe because it confirms nothing about any identifiable person.

Positive reviews need care too

This is the one practices never think about.

Thanks Mrs Henderson! So glad the implant is feeling better.

That reply confirms a named individual is a patient and discloses what treatment she had. It is the same violation as the angry one, just cheerful.

Keep it generic. “Thank you, we appreciate you taking the time.” That is enough, and it still signals to future readers that the practice is attentive.

Build it into the process

Put the three templates in a shared document. Decide who is allowed to reply and make sure it is one or two named people, not whoever notices first. Set a rule that nothing gets posted the same hour it is read, because the worst replies are written angry.

And make sure your review requests themselves are compliant, because several common tactics became explicit violations in April 2026. The current rules are here.

If this is a process you would rather not maintain, drafting HIPAA-safe replies for your approval is part of what the review manager does. You still approve every one.

Not legal advice

A practical guide, not legal guidance. If you have received a complaint that looks like it may become a formal matter, talk to your attorney before you post anything at all.