Why doctors can't respond to Google reviews the way other businesses do

Under HIPAA's Privacy Rule, a practice may not disclose a patient's protected health information without a valid authorization unless the rule permits it. HHS has treated patient details in review replies as impermissible disclosures. A reply that confirms the reviewer was seen, mentions a visit date, a treatment, a diagnosis, a bill or an insurer, or corrects their account of their care, puts patient information in public.

The patient chose to post. That choice does not give the practice permission to add to it. The enforcement cases below were all about replies to reviews that patients had written themselves.

• A New Jersey psychiatric practice, 2023: HHS's Office for Civil Rights found it disclosed the health information of four patients in response to their negative reviews on Google Reviews. The corrective action plan required breach notices to each of them.
• A California dental practice: a complaint alleged it disclosed patient information in replies to reviews on Yelp. It settled and agreed to a corrective action plan.
• A Dallas dental practice: it settled over disclosures of patient information on social media.
• A North Carolina dental practice: it disclosed a patient’s information on a webpage in response to a negative online review, and a civil money penalty was imposed.

When it announced the 2023 case, the Office for Civil Rights said it continues to receive complaints about providers disclosing patient information in response to negative reviews.

A safe reply could have been written about anyone. It thanks the writer, states a general standard, and offers a private channel. For example: “Thank you for your feedback. Our practice cannot discuss any individual’s care in public, and we take every concern seriously. Please call our office manager so we can talk directly.”

• No name, not even a first name
• Nothing that confirms or denies a visit
• No dates, treatments, results, bills or insurers
• No correction of the patient’s story, however wrong it is

A practice can keep one standard reply for every negative review and change nothing but the contact line. When every reply reads the same, none of them hints at a particular patient. The HIPAA safe reply tool on this site drafts one in this form.

Reporting a review to Google is a separate route from replying, and it is open to a practice like any business. A harsh account of a real visit breaks no policy. These do:

• The writer was never a patient and describes no visit.
• The writer is a former employee or a competing practice.
• A checkable health or safety claim that the practice’s records contradict.
• A staff member's full name, a threat, or a private address or phone number.

Build the report from the review’s own words and from records that hold no patient health information, such as staff files, supply logs and policies.

A practice cannot take a review down itself. It can report the review, and Google decides. It should not offer anything in return for a review being changed or taken down. Google treats reviews influenced by “a payment, discount, free goods or services” as incentivized. Talking to a patient privately, by phone, about their concern is the ordinary part of running a practice and does not touch the listing.

The free audit reads every low review on the practice's listing against Google's policies and gives each one a clause and a fee class, or No rule broken. For any review you choose, a case sheet shows the clause, the reasoning and the record before anything is filed. The fee is per removed review, set by a fixed class. Google decides, and a declined case is filed a second time at the same fee.