How a doctor gets a bad Google review removed

A practice that bills a health plan electronically, directly or through a billing service, is a covered entity under the HIPAA Privacy Rule. HHS gives a plain example of what that protects: a name on its own is not health information, but a name shown with the fact that the person was treated at a certain clinic is. A reply that says when you saw the writer, what you found, or what they were billed puts that fact in public.

HHS’s Office for Civil Rights has settled with practices that did exactly this, including a psychiatric practice in New Jersey that disclosed patient information while answering Google reviews. The safe reply is short and general: you take every concern seriously, you cannot discuss anyone’s care in public, and the writer is welcome to call the office manager. It confirms nothing. The HIPAA safe reply tool on this site drafts one in that form.

• Wait times, billing surprises and a curt front desk. These are real visits and usually stay up.
• A relative who was in the waiting room, or who only heard the story, writing as if they were seen.
• A former medical assistant or biller writing after leaving on bad terms.
• A clinic down the road, or someone who sells a competing service, posting under a personal account.
• A health claim stated as fact: unsafe needles, expired vaccines, a doctor who lost a license.
• A review meant for the hospital, the lab or the imaging center your patients are sent to.
• A front desk employee named in full with comments about her private life.

Google’s policy lets anyone with a real experience describe it harshly. The first two items on that list are mostly opinions about real visits and are marked No rule broken. The rest are different. A writer who was never seen meets fake engagement. A former employee or a competing clinic meets conflict of interest, which Google defines to include current or former employment and industry competitors. A false claim about safety or treatment meets misinformation, which covers deceptive or misleading health or medical information. A review about another facility meets off topic.

Names need care. Google allows a doctor’s name in a review when the doctor practices under that name, so a review that names you is not a privacy breach by itself. A staff member’s full name joined to private details is another matter, and can meet the personal information clause.

• A screenshot of the review with the date and the reviewer’s profile name showing.
• For a writer who was never seen: a search of your scheduling system that finds no one by that name. You state the result, you do not send the schedule.
• For a former employee: the dates of employment and the role, from payroll or HR.
• For a health claim: the record about the practice, such as sharps disposal logs, vaccine storage logs or the state license lookup.
• For a competitor: the reviewer’s public profile or other reviews that show where they work.

Note. Every record in a case should be about the practice, never about a patient. If proving the point would mean sharing a chart, the case is built another way or not at all.

1. 01

   Capture it

   Screenshot the review, the reviewer’s profile and the date before anything changes.

2. 02

   Reply or stay quiet

   If you reply, use the general form above. Silence is also a safe choice.

3. 03

   Report it in Google

   In your Business Profile, open Read reviews, select the Report icon next to the review, pick the reason that fits and select Send report.

4. 04

   Run the free audit

   The free audit reads every low review on the listing and marks each one with a clause and a fee class, or No rule broken.

5. 05

   Accept the case sheet

   Each case sheet shows the clause, the words that meet it, the record, the class and the fee. Nothing is filed until you accept it.