HIPAA and responding to patient reviews
The single most expensive mistake a practice can make online, and the four sentences that avoid it.
Never confirm that a reviewer was a patient and never discuss any aspect of their care in a public reply, even to correct something false. A patient may disclose their own information; that does not permit you to. Compliant replies acknowledge feedback generally and move the conversation to a private channel without confirming a relationship.
Why the asymmetry exists
Privacy obligations run one way. The patient holds the information and may share it. The practice holds a legal duty and may not, regardless of what has been published or how unfair it is.
This feels wrong to clinicians, particularly when a review is inaccurate, and that sense of unfairness is exactly what produces the violation. Enforcement actions in this area have arisen from replies that were, in the practice's view, simply setting the record straight.
The patient can post their chart. You cannot post a correction to it.
A compliant reply, in full
"Thank you for the feedback. We take all concerns about our care seriously and would welcome the chance to discuss this directly. Please contact our practice manager on [number] so we can look into it properly."
That is the whole thing. It does not confirm a relationship, does not reference any visit, discloses nothing, and reads to a prospective patient as a practice that responds properly.
What must never appear
- Any confirmation the person was seen, including "we treated you on..."
- Any clinical detail, diagnosis, procedure or medication.
- Any reference to appointments, attendance or payment history.
- Any suggestion the reviewer is lying about their treatment.
- Any staff member's name in connection with the care.
Get it out of the reply box
Nominate one person to write every review response, use an approved template, and require a second read before posting. Most violations come from a clinician replying personally, at night, while angry.
For the removal side, which is separate and safer, see how to remove a patient review.
Common questions
The patient named themselves. Can I confirm it?
No. Their disclosure does not waive your obligation, and confirmation is itself a disclosure.
Can I reply if the person was never a patient?
You can say you have no record of the individual, which discloses nothing, but be certain before you do.
Does this apply to a non-US practice?
Equivalent confidentiality duties exist in most jurisdictions. The specific statute differs; the principle does not.
Find out if it can come down.
The scan is free and confidential. You get a viability answer on each item, a fixed price, and a timeline. Anything accepted and still published at 14 days is refunded in full.
Run a free scanMore on physicians and practices
Working through this for a business? See Reputation management for physicians.