How to Respond to a Negative Patient Review Without Violating HIPAA

The safest reply to a negative patient review says very little. It thanks the person, says the practice takes feedback seriously, and invites them to call. It does not confirm that the reviewer was ever a patient, and it does not mention a visit, a diagnosis, a treatment or a bill.

That restraint feels unsatisfying when a review is unfair. The alternative has a record, though, and the record is expensive.

What has gone wrong before

The HHS Office for Civil Rights has reached settlements with, or fined, at least four practices over replies to online reviews, as Nixon Peabody summarizes:

• A dental practice paid $10,000 in 2019 after its replies to patient reviews disclosed patients’ information.
• Another dental practice paid $50,000 in 2022 for disclosures made in reply to a patient’s online review.
• A California dental practice paid $23,000 in late 2022 after its Yelp replies included patients’ full names, details of their visits and insurance information.
• A psychiatric practice paid $30,000 in 2023 after its replies to Google reviews referred to patients’ diagnoses and treatment, and had to notify the patients involved of a breach.

In each case the reviewer had already told their side. The practice’s reply, meant to correct the record, became the disclosure. As the same summary notes, even confirming facts a patient has already posted can raise a compliance issue.

Why a reply can be a disclosure

Under HIPAA, the fact that a person is a patient of a particular practice is generally treated as protected health information. A reply that says “we’re sorry your procedure didn’t go as planned” confirms a patient relationship and a procedure in one sentence. So does “as we discussed at your appointment.” The reviewer’s own words do not give the practice permission to repeat them or add to them.

A reply that works

Keep one short approved reply and adapt the tone, never the facts. For example:

Thank you for taking the time to share this. We take every concern seriously and would welcome the chance to talk with you directly. Please call our office and ask for the practice manager.

It works because it is generic. Anyone reading it learns that the practice is calm and responsive, which is what a prospective patient is really judging. The details can then be handled privately, by phone.

What never to include

• Any confirmation that the reviewer was a patient.
• Dates, procedures, diagnoses, medications, test results or billing details, even ones the reviewer mentioned.
• An explanation of what happened clinically, however reasonable.
• Anything said to the patient privately.
• The names of staff involved in the patient’s care.

Who should be allowed to reply

Most of the cases above began with someone replying quickly and personally to a review that felt unfair. Decide in advance who may post replies, require a second read before anything goes out, and train the front desk and anyone handling marketing on the approved reply. If an agency or vendor manages reviews for you, the same rules bind them, the practice remains responsible, and a business associate agreement should be in place wherever they handle patient information.

What actually improves a rating

The answer to unfair reviews is more reviews. A steady, compliant habit of asking satisfied patients for feedback, through the platform’s own tools and without offering anything in return, does more for a practice’s standing than any reply. One unfair review among many good ones reads as an outlier. One unfair review among three reads as the truth.

How we approach it

Reputation is part of every engagement we hold, under the same rules. Here is how we work with physicians, and why reviews matter even more as patients turn to AI assistants for recommendations.