45 CFR 164.508
You cannot answer a false review by proving the person was never a patient
Confirming that someone was or was not treated, in public, is a disclosure of protected health information under the HIPAA Privacy Rule. A practice can post a neutral invitation to talk privately and nothing more, so the accusation stands on the profile until the platform acts on a policy report.
U.S. Department of Health and Human Services — HIPAA Privacy Rule: uses and disclosures for marketing (45 CFR 164.508(a)(3))
Third-party detail
A review that exposes another patient is a privacy violation on every major platform
Reviews that name or describe a different patient, or attach a photo of someone else's result, break the personal-information rule Google publishes for Maps contributions. For a plastic surgery practice these are among the cleanest filings, and the report can flag the violation without repeating the private detail.
Google Maps Help — Prohibited and restricted content policy for Maps user contributions
16 CFR Part 465
Buying reviews to bury a bad one is a federal violation, not a shortcut
Since October 21, 2024 the FTC rule on consumer reviews bans fake reviews, insider reviews presented as customer reviews, and paying for positive or negative reviews, with civil penalties available per violation. For a plastic surgery practice that leaves two lawful moves: earn real reviews, and report the ones that break platform policy.
U.S. Federal Trade Commission, 2024 — Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465)
Policy grounds only
Google removes reviews that break a policy, not reviews you dislike
Google's own help documentation says any review can be reported but only content that violates its policies is eligible for removal. That is why a case starts by matching the wording to a named policy: fake engagement, off topic, impersonation, harassment, personal information or conflict of interest.
Google Business Profile Help — Report inappropriate reviews on your Business Profile