What can you say
Can practices respond to Google reviews?
You can reply. You just cannot confirm they were ever here.
Yes, but carefully. You can thank reviewers, invite them to call, and address a complaint in general terms. You cannot confirm the person is a patient or mention their care, because that discloses protected health information even when they posted first. OCR has fined practices for it. Keep the reply generic and take details offline.
Under 45 CFR 164.502(a), resting on the identifiability definition in 160.103, a covered entity may not disclose protected health information except as the rules allow, and the fact that a person received care from you is itself protected. A reply confirming the reviewer is a patient, or referencing their visit, diagnosis, bill, or treatment, discloses PHI. A patient's own post waives nothing and does not become yours to confirm, and no treatment, payment, or operations permission covers firing back. Without authorization, treat any specific public response as a disclosure.
A covered entity may not use or disclose protected health information except as the Privacy Rule permits; the fact that a person is a patient is itself identifiable health information.
In June 2023 the HHS Office for Civil Rights settled with Manasa Health Center, a New Jersey psychiatric practice, for 30,000 dollars after it answered negative Google reviews with patients' diagnoses and treatment, finding impermissible disclosures affecting more than one patient and imposing a corrective action plan. The theory is the same for any specialty. OCR earlier settled with Elite Dental Associates in Texas for 10,000 dollars over a Yelp reply that named a patient and aired her condition, treatment, and costs, and with New Vision Dental in California for 23,000 dollars for similar responses, some attaching real names to pseudonymous reviewers. Responding with specifics turns a bad review into a reportable disclosure.
A psychiatric practice paid 30,000 dollars and adopted a corrective action plan after disclosing patient information in responses to negative online reviews.
Answer without ever confirming a treatment relationship. Thank the reviewer, state your general commitment to patient care, and point them to a name and number so you can talk privately. That reply works whether or not the person is a patient, which is why it is safe: it neither confirms nor denies, and discloses nothing. Keep specifics offline and documented. Publishing a patient's story later is an authorization conversation, not a comment-box one, so when in doubt, say less in public.
The scanner reads a drafted review response the same way a regulator would: does the wording admit this person is a patient.
We are sorry you were unhappy. Our records show you missed two follow-up visits after your procedure here, which affects recovery.
The reply confirms the reviewer was treated at the practice and discloses details of their care, which is a PHI disclosure under HIPAA even though the patient posted first. This is the conduct OCR has penalized in review responses.
HIPAA Privacy Rule, impermissible disclosure · 45 CFR 164.502(a); OCR enforcement
Thank you for the feedback. We take every concern seriously and want to make things right. Please call our office manager at the number on our site so we can discuss it directly.
Answers the reviewer without confirming or denying a treatment relationship and without revealing any care details, so it holds up whether or not the person was ever a patient.
Sources
Pre-Trip is a rigorous screen, not legal advice. Counsel decides; we help you arrive prepared.