What Is Review Response Privacy?

Review response privacy is the practice of replying to a patient's online review without confirming that the reviewer is a patient or sharing any health detail. For a health practice, a friendly public reply can do exactly that, and HHS has settled cases over it. This page is general information, not legal advice, so confirm your specific setup with your compliance advisor.

How review response privacy works

Protected health information is information that identifies a person and relates to their care, and the fact that someone is a patient can fall inside it. A public review lives on a page anyone can read. When the practice answers "Thank you for coming in last week" or "We are glad your hormone treatment is helping," the practice has just stated, in public, that the person received care and what kind. The review itself does not change that.

HIPAA is the federal privacy law that covers it for health care providers that count as covered entities. The rule at 45 CFR 164.508 says a covered entity may not use or disclose protected health information without a valid authorization, unless another permission in the rule applies. A valid authorization is a signed document with specific parts, including what information will be shared, with whom, for what purpose and until when. A review reply posted on a public site is rarely backed by one.

HHS has acted on this in public. Two of its resolution pages are worth reading.

• Manasa Health Center, New Jersey. HHS announced in June 2023 that the practice, which provides adult and child psychiatric services, paid $30,000 and agreed to a corrective action plan. The complaint alleged that the practice posted a response to a patient's negative online review that disclosed the patient's protected health information.
• New Vision Dental, California. HHS's page from December 2022 says the practice paid $23,000 and agreed to a corrective action plan after using social media to respond to patient reviews in a way that disclosed protected health information.

I would read those two pages in full rather than rely on anyone's summary, including mine. HHS has also settled other cases, and the details differ. I only describe the two I opened.

A second rule matters on the other side. The FTC's Consumer Reviews and Testimonials Rule, which took effect October 21, 2024, bars businesses from using false accusations against a reviewer or unfounded legal threats to stop or change a review. So the answer to a bad review is not an argument or a threat. It is a short, calm reply that moves the conversation to a private channel.

This also touches how AI tools describe you. Reviews are part of what a patient or an AI tool can read about a practice, and tone in your replies is part of that picture. If an AI assistant drafts your replies, it needs the same limits you give staff. See Google Business Profile for where many reviews live.

Where HIPAA applies, any tool that sees patient messages falls under the business associate agreement rules.

Testimonials on your own site raise a related question, covered under patient testimonials.

Your status matters too. Some cash-pay practices are not covered entities under HIPAA, and some are. It depends on whether the practice conducts certain transactions electronically. Ask a compliance advisor, and use the careful reply style either way.

Example: review response privacy at a health practice

This example is illustrative, not a transcript, and the reviews below are invented. A med spa receives two reviews on the same day.

The first is positive: "Dr. Lee and the team were wonderful during my appointment." The tempting reply is "Thank you, Sarah! We loved seeing you and we are so happy with your filler results." That reply confirms Sarah is a client and names the treatment.

The second is negative: "Rude front desk and I waited forty minutes." The tempting reply is a defense: "We have no record of you waiting that long, and your appointment started at 2:05."

A safer pair looks like this.

For the positive review, the med spa writes: "Thank you for taking the time to share your feedback. We appreciate kind words, and we pass them on to the team." The reply confirms nothing about the reviewer.

For the negative review, the med spa writes: "Thank you for the feedback. We take wait times and service seriously. We cannot discuss any individual's care in a public place, but we would like to hear more. Please call us at the number on our contact page or email the practice manager."

Neither reply uses the reviewer's name, a date, a service or an outcome. Both are short, and both are written for the next patient who reads them. If staff want a more specific response to either review, they take that to a private message after a compliance advisor weighs in.

How to check yours in 60 seconds

1. Open your Google Business Profile and any other review site where you answer reviews.
2. Read your five most recent replies.
3. For each reply, ask three questions. Does it use the reviewer's name? Does it mention a visit, a date, a service or a condition? Does it correct the reviewer's account of what happened?
4. Mark any reply that answers yes to one of them.
5. Note who wrote each reply and whether they followed a template.

Any marked reply goes on a list to edit or remove.

What to do about it

1. Confirm with a compliance advisor whether HIPAA covers your practice.
2. Write two or three approved reply templates, one for positive reviews, one for negative reviews and one for reviews you suspect are not from patients.
3. Ban four things in every reply: the reviewer's name, any visit or service, any date and any health detail.
4. Add a contact route in every negative reply, such as a phone number or an email for the practice manager.
5. Name one person who posts replies and one person who backs them up.
6. Edit or remove existing replies that confirm a visit or a condition.
7. Report reviews that look fake through the platform's own flow and skip public arguments. Do not threaten the reviewer.
8. If you use AI to draft replies, give it the templates and the bans, and have a person read each draft before it posts.
9. Review the templates and the last quarter's replies every three months.