A restaurant owner can reply to a bad review with "Sorry your steak was overdone, Mark. Next one's on us." A dentist who writes "Sorry your crown was uncomfortable, Mark" may have just disclosed health information about a patient.
That's the whole difference, and it changes how healthcare practices should handle reviews from the ground up.
This isn't legal advice. Rules vary by country, and in the US by state as well as federally. Talk to your compliance lead or lawyer about your setup. But the patterns below hold up in most places.
The case that made it real
In 2019, the US Department of Health and Human Services' Office for Civil Rights announced a settlement with Elite Dental Associates, a Dallas practice. The practice had replied to patients' reviews on Yelp with details like names and treatment information. It agreed to pay $10,000 and adopt a corrective action plan.
Ten thousand dollars is not a huge sum for a federal settlement. The point was the message: replying to a review is a disclosure like any other, and HIPAA applies to it. Other practices have since faced similar actions.
What counts as a disclosure
Under HIPAA in the US, and under similar rules in many other countries, the following can all be problems in a public reply:
- Confirming that the reviewer is or was a patient.
- Mentioning their treatment, diagnosis, appointment dates or what happened in the room.
- Correcting their version of events with clinical detail, even if they shared it first.
- Using their name in a way that confirms they visited.
That last point catches people out. The patient may have posted under their full name and described their whole treatment. That's their choice. It doesn't give you permission to confirm or add to it.
Safe reply patterns
The trick is to reply about your practice and your policies, not about the person.
For a negative review
Thank you for sharing this. Our privacy obligations mean we can't discuss anyone's care in public, but we take every concern seriously. Please call our practice manager, Helen, on 0113 000 0000, and she'll look into it personally.
You haven't confirmed they're a patient. You've shown readers you're responsive, and you've moved it somewhere private.
For a review about billing or wait times
We're sorry to hear about this experience. We aim to keep wait times under fifteen minutes and we review this every month. If you'd like to talk about anything specific, please contact our office directly.
You can talk about how the practice works in general. Just don't connect it to the reviewer.
For a positive review
Thank you for taking the time to write this. We'll pass your kind words on to the whole team.
Resist "So glad your implant went well, Susan!" It's warm, and it's a disclosure.
What to do with unfair or fake reviews
Healthcare gets its share of reviews that are confused, misdirected or fake. The usual approach, gathering evidence and reporting the review through the platform, works the same way. Our guide to spotting and removing fake reviews explains it. Just be careful that your evidence notes to the platform don't include patient information either. "No record matches this description" is enough.
Asking patients for reviews
Reviews matter for practices as much as anyone. Patients choosing a new dentist or GP lean on them heavily. You can ask, with a few adjustments:
- Ask everyone the same way, through your normal post-appointment message. No selective asking, which we explain is banned.
- Don't offer anything in return. No discounts on the next check-up. See the FTC rule for why.
- Don't suggest content. Don't ask them to mention the treatment they had.
- Give them choice. Some patients won't want a review tied to their name on a major platform. A neutral place where they can write without signing up to a big tech account can help. On Reputfy, patients can review a practice, and the practice can reply once it claims its page.
A process for the practice
- Agree a short set of approved reply templates with your compliance lead, then personalise the tone, not the facts.
- Decide who replies. Usually the practice manager, not clinicians.
- Never reply in the heat of the moment. Draft, wait, check against the rules, then post.
- Keep a log of replies and any follow-up contact.
- Review your profile weekly, not only when something goes wrong.
Speed still matters. Patients expect replies just like any other customer, and BrightLocal's 2026 survey found 89% of consumers expect businesses to respond. We look at what a sensible turnaround looks like in how fast you should reply to reviews.
Where software helps, and where it shouldn't
AI reply drafts can be a real time-saver for busy practices, but they have to be set up so they never pull in patient details. In Reputfy, practices can set a "no personal details" rule on drafts, and every draft goes to a person for approval before it's posted. A tool should make the safe reply easier, not tempt anyone into a risky one.
