HIPAA and responding to patient reviews without disclosing anything

The trap is that the patient waived nothing by writing a review. They can say whatever they like about their own care. You cannot respond in kind, and the asymmetry feels deeply unfair to every practice owner who encounters it for the first time.

That asymmetry is the rule. Working inside it is a writing problem, and it is solvable.

Has anyone actually been penalized for this?

Twice that are worth knowing by name, and both were dental practices replying to Yelp reviews.

New Vision Dental, in South Pasadena and Glendora, California, settled with the HHS Office for Civil Rights for $23,000 and a two year corrective action plan. OCR received the complaint on 29 November 2017 and announced the settlement in December 2022. The conduct is described plainly in the enforcement record: in some of the posts, patients were identified and their full names were disclosed, when they had chosen to only use a moniker on the platform. Other disclosed details covered visits, treatment and insurance that the patients had not posted publicly.

OCR found three failures, and the third is the one practices never see coming. Impermissible disclosure on Yelp on multiple occasions. A Notice of Privacy Practices lacking required content. And no implemented policies concerning the release of protected health information on social media at all. The remedies included removing every social media post back to 1 January 2014 and issuing breach notices.

OCR Director Melanie Fontes Rainer summarised it in a sentence worth pinning above the front desk computer:

"Providers cannot disclose [the] protected health information of their patients when responding to negative online reviews. This is a clear NO."

Elite Dental Associates, in Dallas, settled for $10,000 on the same fact pattern. OCR received that complaint on 5 June 2016 and announced the settlement in October 2019.

Note what both were doing. Not selling data. Not losing a laptop. Answering a bad review with the facts, which is the most natural instinct an owner has.

What can I actually say in a public reply?

Three things, and nothing else.

A general thank you or acknowledgment. "Thank you for taking the time to share feedback" is safe because it says nothing about whether this person was ever in your building.

A policy or standard, phrased generally. "Our practice takes concerns about wait times seriously and reviews them weekly." You are describing how you operate, not this person's visit.

An invitation to continue offline. A phone number and a name. This does the real work.

What you may not do is longer. Do not confirm they were a patient. Do not correct their version of events. Do not mention a procedure, a date, a bill, or a diagnosis. Do not say "we tried to call you."

Every correction you want to make requires confirming they were a patient, which is the disclosure itself. That is why the urge to set the record straight is the exact thing the rule exists to prevent.

A response that says nothing feels weak to you. It does not read that way to a stranger. A calm, brief reply signals competence, and the reader has no idea what you were forbidden to say.

Does the patient posting first change anything?

No. This is the single most common misunderstanding in the category.

A patient disclosing their own information does not authorize you to disclose it. They hold the right, not you, and their public post is not a signed authorization. Practices that respond in detail because "the patient brought it up" are the ones who end up explaining themselves to a regulator, and New Vision Dental is what that looks like.

The same applies to a reviewer who is lying, who is a competitor, or who was never a patient at all. You cannot say "this person has never been treated here," because that also discloses patient status, in the negative.

If you believe a review violates the platform's policies, dispute it through the platform. That process is private and it is the correct path.

And do not respond from a personal account or ask staff to reply from theirs. That carries the same exposure with less control.

Can I let software answer them?

Not without a human in front of it, and the vendor market is worse on this than practices assume.

Of the major reputation platforms reviewed for this library, only Swell states that AI generated review responses require human review before publishing. NiceJob auto posts on a batch schedule. Podium and Broadly publish no approval workflow at all. An auto responder that writes "so glad your implant went well" on a public profile has produced a disclosure with nobody in the room.

The vendor question underneath it is the contract. A platform touching patient names, contact details and appointment data is a business associate and requires an executed business associate agreement. Birdeye, Reputation and Swell publish agreements or a verified posture. Podium claims compliance without publishing an agreement. NiceJob, Grade.us and Broadly make no HIPAA claim at all while actively marketing to dental practices. Ask for the agreement before the demo, not after the rollout.

Google's own guidance points the same way. It tells businesses that instead of sending the same thank you to everyone, they should focus on reviews where they can share a helpful update. The auto responder does the opposite, in a category where a wrong sentence costs a federal settlement.

What about the paperwork at the front desk?

Check it this week, because inherited intake forms carry a clause that is void in California and illegal to include.

California Civil Code section 1670.8, in force since 1 January 2015, says a contract for consumer goods or services may not include a provision waiving the consumer's right to make any statement about the seller or its employees. It is separately unlawful to threaten or enforce such a provision, or to otherwise penalize a consumer for making a statement. Counsel reporting describes penalties starting at $2,500 for a first violation, enforceable by the Attorney General, a district attorney or a city attorney.

Med spa and dental intake packets frequently carry inherited non disparagement boilerplate. Including the clause is itself the violation, whether or not anyone ever enforces it. Threatening to enforce it stacks a federal problem on top, because 16 CFR section 465.7(a) prohibits using a groundless legal threat to remove a review. The statute has no geographic limit, so it reaches out of state practices with California patients. Pull the packet and delete the paragraph.

How do I build review volume in a regulated practice?

Ask everyone, at the right moment, and never sort by expected sentiment.

The compliance instinct in healthcare pushes practices toward asking only patients they believe are happy. That is review gating, and it is worth being precise about who bans what, because the imprecise version gets repeated in every vendor deck.

Google bans gating explicitly. Its Maps policy says merchants may not discourage or prohibit negative reviews, or selectively solicit positive reviews from customers. One clause, no exceptions.

The FTC bans the adjacent conduct rather than gating by name. 16 CFR Part 465, effective 21 October 2024, reaches incentives conditioned on a particular sentiment expressly or by implication at section 465.4, and reaches the display side at section 465.7(b), which prohibits representing that the reviews shown are all or most of those submitted when reviews have been suppressed by rating or sentiment. A testimonials page on your practice site showing only the five star ones is section 465.7(b) territory.

The clean sentence for a client is: Google bans gating, the FTC bans what surrounds it, and a compliant program satisfies the stricter of the two at every point. Section 465.2(d) then gives you the safe path in one phrase, exempting reviews that resulted from generalized solicitations to purchasers. Ask everyone.

Volume and freshness are what matter, and Whitespark's Darren Shaw puts recency in his personal top five local ranking factors, with the blunt summary that the moment you stop getting new reviews your local rankings start to slip. Review velocity is the ranking factor most businesses ignore, and healthcare practices ignore it more than most because the compliance conversation stops the asking conversation entirely.

The ask itself carries no protected information if you build it right. A generic request sent to everyone, without naming a procedure, is not a disclosure. What creates exposure is a request that references care, or a public list of who was asked.

Timing is the other half. When in the customer journey you ask matters more in healthcare than anywhere, because the moment of relief after an appointment is short and the billing statement arriving three weeks later is not it.

And measure the right number. Your review count matters less than your recent review count, which is why a practice with hundreds of old reviews can still slide.

What is a new patient actually worth, and why does it matter here?

Because the business case for all of this usually rests on a number that does not exist.

The figure in circulation is that the average new dental patient is worth $850. It appears in vendor decks, agency proposals and conference slides. The American Dental Association's Health Policy Institute, which is the correct primary source for dental economics, publishes no such figure, and every circulating version traces back to another blog rather than to data.

Build yours instead. It takes twenty minutes in your practice management software.

Count new patients over the trailing twelve months. Say 540.

Pull collections attributable to those patients over the same period. Say $432,000.

Divide. $432,000 over 540 is $800 per new patient in year one.

Now notice how much that number moves with your case mix. A practice with a heavy implant and ortho share will land at two or three times that. A hygiene led practice with a high insurance mix will land well under it. The spread is exactly why no national average can be right for you, and why a vendor quoting one is telling you about their marketing rather than about your practice.

With your own figure, the review program has an honest business case, measured in the same software, and you never have to defend somebody else's statistic in a partner meeting.

What to do this week

Read your last ten review responses. If any of them reference a visit, a treatment, a date, or a bill, edit them today. Platforms allow editing.

Write the two templates, negative and positive, and get them reviewed by whoever handles your compliance.

Turn off any auto responder posting to a healthcare profile without approval, and ask your vendor for the business associate agreement in writing.

Pull the intake packet and delete any non disparagement clause you find.

Name one person who responds and take login access away from everyone else. Improvisation is the risk.

Then put the review count and response rate on your monthly numbers, alongside everything else you look at. A monthly local report should tell you what changed and why, and review flow belongs on it.

Your website carries the same weight here. Whatever the category, the failures are the same, and the website mistakes that quietly cost a restaurant covers are the ones that cost a practice new patient calls.

Want your response templates checked?

Email me at eric@seod.com with a patient review you want to answer and the reply you were planning to post. I will mark every phrase that acknowledges treatment or confirms the person was a patient, and send back a version that says everything you are allowed to say.

I am not an attorney and I will tell you when something needs one. What I can do quickly is spot the sentence that gives it away, which is usually the second one and usually the part you thought was harmless.

Otherwise keep reading the reviews and reputation library.