Can a practice sue or use HIPAA to make a patient delete a negative review?

HIPAA does not restrict what patients say about their own care, and using groundless legal threats or intimidation to get a review removed is unlawful under the FTC's reviews rule. Defamation claims remain possible in principle, but this guide does not assess them. [F-033, F-007, F-032]

Can we ask patients to sign an agreement not to post negative reviews?

Generally no. A form-contract term that restricts or penalizes reviews is void under the Consumer Review Fairness Act, and the FTC and state attorneys general can enforce it. [F-032]

If a patient reveals their own procedure in a review, can we discuss it in our reply?

Not for a HIPAA covered practice: the patient's own disclosure does not give the practice permission to disclose health information. OCR has resolved several matters over exactly this kind of reply. [F-007, F-024]

Can a practice make a review site take a review down?

Generally not by the practice. Review sites are generally not liable for users' reviews and decide removals under their own policies, which you can ask them to apply. Nothing in this guide promises that any review will be removed. [F-034, F-032]

Responding to a negative patient review

This guide is general educational information, not legal advice, and it does not create a lawyer-client relationship. Laws change and their application depends on specific facts. It does not promise any outcome, including removal of any review, any settlement, fine or successful claim. Consult a qualified lawyer licensed in your state before acting.

Responding to a review: an illustrative example

Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]

† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.

Bracketed codes are reference numbers for the sources listed in the research claim register; "research gap" codes point to logged open research issues.

The disclosure limit

Provider disclosure duties. HIPAA covered entities may not use or disclose protected health information except as the Privacy Rule permits. A patient's public review does not by itself permit the practice to reveal that person's health information in a reply. The federal Office for Civil Rights (OCR) has resolved several matters against practices over review replies, including Elite Dental Associates ($10,000, 2019) and Manasa Health Center ($30,000, 2023). State confidentiality statutes and licensing-board rules add duties that often apply whether or not HIPAA does. [F-007, F-024, TX-012, CA-001, NY-001]

HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]

Frequently asked questions

Can a practice sue or use HIPAA to make a patient delete a negative review?: HIPAA does not restrict what patients say about their own care, and using groundless legal threats or intimidation to get a review removed is unlawful under the FTC's reviews rule. Defamation claims remain possible in principle, but this guide does not assess them. [F-033, F-007, F-032]
Can we ask patients to sign an agreement not to post negative reviews?: Generally no. A form-contract term that restricts or penalizes reviews is void under the Consumer Review Fairness Act, and the FTC and state attorneys general can enforce it. [F-032]
If a patient reveals their own procedure in a review, can we discuss it in our reply?: Not for a HIPAA covered practice: the patient's own disclosure does not give the practice permission to disclose health information. OCR has resolved several matters over exactly this kind of reply. [F-007, F-024]
Can a practice make a review site take a review down?: Generally not by the practice. Review sites are generally not liable for users' reviews and decide removals under their own policies, which you can ask them to apply. Nothing in this guide promises that any review will be removed. [F-034, F-032]

† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.

Sources

F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
TX-012. HHS OCR
Elite Dental Associates (Dallas) paid $10,000 to OCR over Yelp replies disclosing patient information.
Enforcement (federal resolution agreement) · Explicit · High · Federal OCR action, not Texas state enforcement.
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/elite/index.html
CA-001. Cal. Civ. Code 56.10(a)
CMIA prohibits a provider of health care from disclosing medical information without authorization except as compelled or permitted by 56.10(b)-(c).
Statute · Explicit · High · Official text from the California Legislative Counsel bulk database (pubinfo, data as of 2026-10-18), read 2026-10-22 (U-11 closed for this section). [Audit D 2026-10-22: reader link changed from the official bulk-data zip (where the text was read) to the official section page]
https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=56.10
NY-001. N.Y. Educ. Law 6530(23)
Professional misconduct for physicians (and PAs/specialist assistants): revealing personally identifiable facts, data, or information obtained in a professional capacity without the patient's prior consent, except as authorized or required by law.
Statute · Explicit · High · Applies to licensees regardless of HIPAA status.
https://legislation.nysenate.gov/pdf/laws/EDN6530
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
F-033. 16 CFR 465.7; 465.4 (89 FR 68034, Aug. 22, 2024)
FTC Consumer Reviews and Testimonials Rule: it is unlawful (a) to use an unfounded or groundless legal threat, a physical threat, intimidation, or a knowingly or recklessly false public accusation in an attempt to prevent a review or have one removed, and (b) for a business to misrepresent that the reviews it displays represent most or all reviews while suppressing reviews because of rating or negative sentiment (neutral content criteria are allowed). The rule also bars buying reviews conditioned on positive or negative sentiment.
Regulation · Explicit · High · Med spa pass, final phase part 2 (2026-10-22). Read on eCFR (V-072). Civil penalties attach to knowing violations of trade regulation rules; amounts not stated here.
https://www.ecfr.gov/current/title-16/chapter-I/subchapter-D/part-465
F-032. 15 U.S.C. 45b
Consumer Review Fairness Act: a provision of a form contract is void if it prohibits or restricts an individual's ability to post a review, imposes a penalty or fee for doing so, or takes the reviewer's intellectual property in the review (other than a non-exclusive license). It does not affect legal duties of confidentiality, defamation claims, or a business's right to remove from its own website content that contains another person's personal information, is unlawful or abusive, unrelated, or clearly false. The FTC and state attorneys general enforce it.
Statute · Explicit · High · Med spa pass, final phase part 2 (2026-10-22). Read on GovInfo U.S. Code (2024 ed.) (V-071). Bars patient 'gag clauses' in form contracts; does not authorize removal of reviews on third-party platforms.
https://www.govinfo.gov/link/uscode/15/45b?type=usc&year=mostrecent&link-type=html
F-034. 47 U.S.C. 230(c)(1)-(2)
Section 230: no provider or user of an interactive computer service may be treated as the publisher or speaker of information provided by another information content provider, and platforms are protected for good-faith moderation decisions. Review sites generally decide removal under their own policies; they are generally not liable for patients' reviews.
Statute · Explicit (text); 'generally decide under their own policies' is an inference · High · Med spa pass, final phase part 2 (2026-10-22). Read on GovInfo (V-073). Exceptions in 230(e) (federal criminal law, IP, etc.) not analyzed. Statements about platform policies are inference, not law.
https://www.govinfo.gov/link/uscode/47/230?type=usc&year=mostrecent&link-type=html

Review removal under platform rules

Reputation Medics has removed 14,000+ reviews by reporting them under the platforms' own content policies. That work is separate from HIPAA and from the state privacy rules on this page. HIPAA is not a way to get criticism or a review taken down.

Advance-payment removal fees are refunded in full if a Google review is not removed within 30 days of payment, or a review or item on any other platform is not removed within 90 days of payment. Refunds are automatic: no claim, form, email or request needed. We issue the full refund to your original payment method within 5 business days after the applicable refund window ends.

Google, Yelp, and the sites we file with make the final removal decision. For advance payments, what we guarantee is the refund of the removal fee if the item remains live past the applicable 30-day or 90-day deadline. Refunds are automatic: no claim, form, email or request needed. We issue the full refund to your original payment method within 5 business days after the applicable refund window ends.

Talk with Reputation Medics Google review removal 888-391-7099

Responding to a negative patient review

Responding to a review: an illustrative example

The disclosure limit

Frequently asked questions

Related pages

States

Topics

Reference

Healthcare industry

Sources