Medical review responses

The HIPAA Privacy Rule restricts a covered entity's use and disclosure of protected health information, or PHI. Health information includes care, health conditions and payment for care when it identifies an individual. A public review response is not automatically an authorized disclosure.

A patient's decision to write about their care does not authorize your practice to confirm the story or publish the rest of it. Your reply is a separate disclosure. The AMA's review-response guidance explains why physicians should avoid patient-specific replies and acknowledgement of the patient relationship.

Does HIPAA apply to every medical practice or med spa?

No. HHS explains healthcare providers are covered entities when they conduct specified electronic transactions. Do not assume every cash-pay clinic is exempt or every wellness business is covered. Check your actual operations with counsel. State confidentiality law and professional duties still matter where HIPAA does not apply. Read HHS's covered-entity guidance.

The privacy risk is often in a reply which sounds like ordinary customer service. Keep these details out of public responses, whether the review is positive, negative or disputed:

• Confirmation the reviewer is or was a patient, or their family member received care.
• Appointment dates, visit frequency, missed visits or discharge from the practice.
• Diagnoses, medications, symptoms, test results, procedures or treatment outcomes.
• Insurance status, unpaid balances, payment arrangements or refund discussions about an individual.
• Chart notes, clinical photos, consent forms or messages copied from private communications.
• Statements about a child's care or a family member's involvement.

Do not use patient records to win an online argument. A generic thank-you on a positive review should stay generic too. The relevant federal definitions and disclosure rules are in 45 CFR 160.103 and 45 CFR 164.502.

These are published enforcement outcomes, not hypothetical fines or a prediction of your liability. Settlements resolve potential violations. The dollar amounts below are case-specific, not today's annual HIPAA penalty limits.

A review-response policy matters beyond the wording of one reply. Corrective action plans in these records include policies, training and oversight. If your practice has already disclosed information, involve your privacy officer or attorney in assessing breach-notification and other obligations. Deleting the reply does not settle those questions.

People searching for HIPAA-compliant review responses usually need language their staff can use. These cautious examples avoid clinical details and patient confirmation. They are starting points for counsel-approved wording, not a compliance certification. Use your own practice contact information, never the patient's details.

Once a person contacts the office, verify identity and use an appropriate private channel. A public invitation to talk is not permission to send clinical details over an insecure message or to an unverified account.

Doctors, surgeons, dentists and orthodontists

Do not defend a procedure by describing a diagnosis, treatment recommendation or consent discussion. Dental X-rays, an implant plan, cosmetic-surgery history and a child's orthodontic visits are not public rebuttal material.

Mental health, addiction treatment and fertility clinics

Even confirming contact with a specialty clinic reveals sensitive context. Some substance-use-disorder records are subject to additional federal confidentiality rules. Have counsel assess the rules applicable to your services before adopting a generic review policy.

Med spas, medical aesthetics, therapy and senior care

Cash-pay services are not a reason to ignore confidentiality. Determine HIPAA coverage and applicable state rules. For senior communities, distinguish nonclinical services from healthcare operations rather than assuming the entire organization has one status.

Examples of state protections appear in New York's professional misconduct law, California's medical confidentiality law and Texas's medical records privacy law. This is not a complete state-by-state analysis.

You do not have to reply. Escalate reviews involving legal threats, allegations of injury or possible privacy incidents before posting. A short neutral response is an option, not a requirement.

A reply will not remove a review. Google says reviews are eligible for removal when they violate its policies, not simply because the practice disagrees. Report suspected fake engagement, harassment, conflicts of interest or other applicable policy violations with relevant nonclinical evidence. Do not attach patient records to a platform report without an appropriate legal basis and privacy review.

Do not threaten a reviewer, buy fake praise or offer incentives conditioned on positive sentiment. The FTC's review rule prohibits specified deceptive practices and review suppression. Its Consumer Review Fairness Act guidance also addresses contract terms restricting honest reviews. A genuine policy-based removal request is different from trying to silence a legitimate complaint.

1. Assign an owner. Limit who posts replies and who approves exceptions. Include agency and marketing staff.
2. Approve neutral templates. Have the privacy officer or healthcare attorney review wording, channels and escalation rules.
3. Separate public feedback from clinical records. Do not copy chart information into replies, agency tools or platform reports.
4. Escalate sensitive complaints. Route legal threats, possible privacy incidents and clinical allegations to the right internal team before posting.
5. Audit existing responses. Check Google, Yelp, Healthgrades, RealSelf, Vitals, Zocdoc and any other active practice profiles. Include positive-review replies.
6. Document corrective action. Preserve an appropriate internal record and consult your privacy officer about deleting or editing disclosures and any further obligations.
7. Train everyone with access. Include response-policy training at onboarding and revisit it when rules, vendors or staff change.

The final check: does the reply confirm this person's care, health or payments, or add information from your records? If so, stop and seek privacy review before posting.

See the full medical review FAQ for doctors, dentists and clinics

This page draws on the supplied Reputation Medics guide and the official records below. The PDF's historical case figures are not a current penalty calculator. Always check the governing rules with qualified counsel.

• HIPAA Privacy Rule: uses and disclosures, 45 CFR 164.502
• HIPAA definitions: protected health information, 45 CFR 160.103
• HHS: covered entities and business associates
• AMA: are physicians prohibited from responding to online patient reviews?
• FTC: Consumer Reviews and Testimonials Rule questions and answers
• FTC: Consumer Review Fairness Act guidance
• Google: report inappropriate reviews
• Google Maps: prohibited and restricted content
• New York: professional misconduct, Education Law §6530
• California: confidentiality of medical information, Civil Code §56.10
• Texas: Medical Records Privacy, Health and Safety Code Chapter 181
• HHS: confidentiality of substance use disorder patient records