How to respond to patient reviews without violating HIPAA
Review volume is a top-three local ranking signal, but a careless response is a reportable disclosure. Here is the line, and how to stay on the right side of it.
Reviews matter enormously for local ranking, and urology is a specialty where patients read them closely before picking up the phone. So practices are rightly encouraged to ask for reviews and respond to them.
The problem is that the obvious way to respond is also a HIPAA violation.
This is a marketing article, not legal advice. Run your review policy past your compliance counsel.
The core rule
Under HIPAA, the fact that someone is your patient is itself protected health information. You do not need to mention a diagnosis or a procedure to make a disclosure — confirming the treatment relationship is enough.
The Office for Civil Rights has fined practices over exactly this. In several enforcement actions, the violation was a practice responding to a negative online review by describing the patient’s visit in order to correct the record.
So this response, which feels helpful and reasonable, is a disclosure:
“We’re sorry your wait was long on the 14th. Dr. Reyes was running behind after an emergency, and we did explain that before your vasectomy consult.”
Three separate disclosures in one sentence, published permanently, in public.
What you can safely say
The safe pattern is to respond warmly, say nothing that confirms or denies a relationship, and move the specifics off the public page.
For a positive review:
“Thank you for the kind words — we appreciate you taking the time to share them.”
For a negative review:
“We take this feedback seriously and we’d like to understand more. Please contact our practice manager at (555) 014-8827 so we can look into it properly.”
Notice what is missing: no name, no acknowledgement that the reviewer was seen, no detail about any visit, no defence of the specific facts. It reads as responsive without conceding anything.
Practical guardrails
Never confirm the relationship. Not “thank you for choosing us,” not “we’re glad your procedure went well.” Both confirm treatment.
Never correct the factual record publicly. Even when the review is wrong — especially then. The urge to defend your team is exactly what the enforcement actions punished.
Use one template set, and train to it. The risk goes up sharply when a frustrated staff member responds in the moment. Pre-approved language removes that decision from the moment.
Route escalations to one person. Anything beyond a thank-you should go through your practice manager or compliance lead.
Do not gate reviews. Filtering so only happy patients get asked violates Google’s policies and, in healthcare, invites scrutiny you do not want. Ask everyone.
Getting the volume without the risk
Since responses are constrained, the growth lever is asking well:
- Ask at checkout, in person, while the visit is fresh
- Send a text with a direct link — every extra tap costs you responses
- Ask consistently rather than in campaigns; steady recency beats bursts
- Make it a front-desk habit, not a marketing project
A practice that asks every patient and responds with two safe templates will comfortably outperform one that responds thoughtfully to a trickle — and it will not end up in an OCR settlement.
We build review workflows and response templates into every engagement, reviewed against current OCR guidance. If reviews are where your practice is losing to the competitor down the road, the free audit will show you the gap.