Reviews for dental practices and the HIPAA line

That single constraint changes the playbook. Every review response guide written for restaurants and contractors tells you to reference the experience, thank the customer by name, and show you remember them. In dental, that advice is a liability.

I am not a lawyer and this is not legal advice. Have your attorney approve your template before anybody uses it, and confirm your own state board's advertising rules, which differ by state.

What does the HIPAA line actually restrict?

Public disclosure. Not asking, not collecting, not responding privately.

The protected thing is the information: that a specific person is or was your patient, and anything about the care they received. A review is written by the patient, and a patient may disclose whatever they want about themselves. The patient can say it. You cannot confirm it.

The enforcement record is short, specific, and dental. The HHS Office for Civil Rights settled with Elite Dental Associates of Dallas for $10,000 over impermissible disclosures in Yelp review responses, announced October 2019. Three years later OCR settled with New Vision Dental in California for $23,000 plus a two year corrective action plan, having found it disclosed patients' full names when they had posted under a moniker, along with visit, treatment and insurance details they never made public.

OCR Director Melanie Fontes Rainer said it plainly: providers cannot disclose the protected health information of their patients when responding to negative online reviews, and this is a clear no.

Read the third New Vision finding, because nobody plans for it. Alongside the posts and a deficient Notice of Privacy Practices, OCR cited the practice for having no implemented policies concerning release of protected health information on social media. The absence of a written rule was itself part of what got penalized.

The temptation is strongest on a negative review. Somebody writes something unfair and the instinct is to correct the record: they missed two appointments, they were told about the fee, they were never even seen here. Every one of those is a disclosure, and being right does not help you.

What does a safe review response look like?

Short, generic, warm, and free of any confirmation.

For a positive review, thank them without confirming anything: "Thank you for taking the time to share this. We appreciate it." No name, no procedure, no reference to a visit.

For a negative review, acknowledge, decline to discuss, and give a private channel: "We take all feedback seriously. Our policy is not to discuss anyone's experience publicly. Please call our office manager at 555 0100 so we can talk directly."

One rule saves practices from themselves: never state, imply, or deny that the reviewer was a patient. Not "we have no record of you," not "you were never seen here," not even "we cannot find your file."

Two operational rules sit on top of the wording. Never let an automated responder post to a healthcare profile without a human approving the text. And do not send the identical thank you to everybody, which is what auto responders do. Google's own guidance says the opposite: focus on reviews where you can share a helpful update or answer a question.

Who else touches your patient list, and what do they need signed?

This is the part practices skip, and it is where a marketing vendor turns into a compliance problem.

Under the HIPAA definitions at 45 CFR section 160.103, a vendor that creates, receives, maintains or transmits protected health information on your behalf is a business associate and needs an executed business associate agreement. HHS's own published list of examples now includes a third party AI chatbot on a patient portal providing services involving the patient's information, naming appointment scheduling specifically.

A review platform holding patient names, mobile numbers and appointment dates so it can send a request after a visit is holding individually identifiable health information. So is a call tracking tool that records the call, and so is the agency logging into either of them.

The obligation does not stop at the first vendor. The chain has to be unbroken down to every subcontractor that touches the data: the messaging carrier, the transcription service, the model provider behind any generated text, whoever stores the recordings. The conduit exception does not rescue a platform that transcribes, stores, indexes and summarizes, because storage alone defeats it. And a covered entity can be exposed where it knew, or should have known, of a pattern amounting to a material breach by its business associate.

Of seven major reputation vendors reviewed, Birdeye, Reputation and Swell publish business associate agreements or a verified posture, Podium claims compliance without publishing one, and NiceJob, Grade.us and Broadly make no HIPAA claim at all while marketing to dental practices. Ask every vendor in writing: will you sign a business associate agreement, and who are your subcontractors. Send the answers to your attorney.

Can I ask patients for reviews at all?

Yes, and you should ask everyone, because a review flow that goes quiet costs you local ranking regardless of how good your existing reviews are.

Two rules matter more in dental than most owners realize, and the second one is stated wrongly almost everywhere.

No gating. Routing happy patients to Google while sending unhappy ones to a private form is banned by Google in one clause of the Maps user generated content policy, which prohibits merchants from discouraging or prohibiting negative reviews or selectively soliciting positive ones. No version of gating survives that sentence.

Now say the federal part precisely, because agencies do not. The FTC's Rule on Consumer Reviews and Testimonials, 16 CFR Part 465, effective 21 October 2024, does not name gating. It reaches adjacent conduct. Section 465.4 bans incentives conditioned expressly or by implication on a review expressing a particular sentiment. Section 465.7(b) bans misrepresenting that displayed reviews represent most or all reviews submitted when reviews are suppressed by rating or sentiment, which is where an onsite widget showing only four and five star reviews under the heading "our reviews" lands. Google bans gating outright. The FTC bans the conduct next to it. Anyone telling you "the FTC bans gating" has not read the rule.

The second rule is about wording. Google's policy prohibits requesting that specific content be included, including content identifying a staff member, and separately prohibits asking staff to collect a set number of reviews. The "please mention Dr. Kim in your review" card is on the wrong side of both. It also does not work: Sterling Sky ran a controlled test where six people left keyword containing reviews over several months, and rankings did not improve.

Ask at the right moment instead. A short text after the visit, using the review link Google generates from your own profile, sent the same day.

What if the review is unfair and I want it gone?

There is a legitimate process, and there is an industry selling something else.

Google's position is that you can report any review but only ones violating its policies are eligible, and that it does not get involved in conflict between businesses and customers. The two grounds that work are off topic content, covering political or social commentary and personal rants, and conflict of interest, covering current or former employees, competitors and family. A review from a fired hygienist is removable on a named ground. One you disagree with is not. The path is flag, then the Reviews Management Tool, then a one time appeal.

Here is the part of this market nobody discloses. Joy Hawkins at Sterling Sky documented reputation firms charging thousands to remove negative reviews by abusing the DMCA takedown process, filing false copyright claims Google frequently approves automatically. In the case she documented firsthand, a forum thread criticizing one of those firms was removed on a notice claiming it had stolen content from a news article about an earthquake in Haiti. Google approved it and traffic to that page fell to zero. Her verdict: it is lying, and it is no different from buying fake reviews.

If a vendor removed reviews for you and cannot show the policy ground each was filed under, you are carrying undisclosed risk on a healthcare profile.

How much cleanup is actually sitting on your profile?

How does this fit with everything else that drives local ranking?

Reviews are one input, and the response policy is a risk control rather than a ranking lever.

Whitespark's 2026 Local Search Ranking Factors report, published 6 November 2025, asked 47 experts to score 187 factors. Four review entries land in the top twenty for local pack and Maps: high ratings at 6, review quantity with text at 9, recency at 11, sustained influx rather than bursts at 14. Grade it honestly. Expert opinion, not a controlled test, and Darren Shaw who runs it says so himself.

There is no controlled test showing that responding to reviews improves rankings. Treat responding as a conversion and rating repair play with an unproven ranking benefit.

If you run several providers, decide early where reviews land, because a multi-provider practice profile can split them across listings in a way that weakens all of them.

Patient photos are a higher bar. A review is the patient publishing their own information. A case photo you publish is you marketing with it, which needs a written authorization naming that use, signed before you shoot, and before and after photos carry consent rules and real risks with state board advertising rules sitting on top.

Software answering your phone must never confirm an appointment or acknowledge someone as a patient, one of several limits on what AI can safely answer for a dental practice.

Expect slow compounding. How long local SEO takes before anything moves is a better planning input than any ninety day promise, and the exception is urgent demand, where availability beats reputation and emergency dental searches get captured on who can be seen today.

What to do this week

Write two response templates, one positive and one negative, and get them approved by your attorney.

Run the five step audit. Mark every published response that confirms a visit, names a procedure, or uses a first name, and edit them today.

Write the one page policy OCR found missing at New Vision Dental: who may publish a response, on which profiles, on whose approval.

Email every vendor touching patient names or appointment data and ask whether they will sign a business associate agreement and who their subcontractors are. Send the replies to your attorney.

Name one person who responds, with a backup, and take the login off everyone else's phone.

Have a review you are not sure how to answer?

Email me at eric@seod.com with the review text, names removed, and I will send back a reply you can post that says nothing about the patient and still reads like a human wrote it. I will also tell you whether it is a candidate for removal on a named policy ground.

I am not your lawyer and will not pretend to be. What I can do is keep the wording clean and get it off your desk.

There is more on dental and med spa marketing in the library.