How to Respond to Patient Reviews Without Violating HIPAA

Quick Answer: Can dentists respond to online reviews without violating HIPAA? Yes. HIPAA doesn’t ban replying to reviews. It bans disclosing protected health information (PHI) in the reply. A HIPAA-compliant review response never confirms the reviewer is a patient, never mentions treatment, appointment dates, insurance or billing (even if the reviewer brought them up first), never uses a name the reviewer didn’t post, and moves the conversation offline. For example: “Thank you for sharing your feedback. We take every concern seriously. Please call our office manager at [number] so we can talk privately.” The federal Office for Civil Rights (OCR) has fined dental practices $10,000 to $50,000 for getting this wrong.

The HIPAA review-reply rules at a glance. Every HIPAA-compliant review response follows these five rules:

• Never confirm they’re a patient: no “thanks for visiting us,” no “we’re glad your crown feels better.”
• Never mention care, dates, insurance or billing: even if the reviewer did.
• Use only the name they posted: reply to “ChelseaReviews,” not “Chelsea.”
• Take it offline: invite them to call, then resolve it privately.
• Decide who replies: one or two trained people, using pre-approved templates.

Below you’ll find the fines that made these rules famous, the one rule most practices miss, six copy-paste templates, and how to set up your team so nobody improvises.

Three dental practices have paid OCR between $10,000 and $50,000 because of review replies. In every case, the practice was trying to defend itself, and the reply became the violation.

• Elite Dental Associates (Dallas, 2019): $10,000. The practice answered a patient’s Yelp review with her last name and details about her treatment plan, insurance and costs. OCR also found the practice had no policy for handling PHI on social media.
• Dr. U. Phillip Igbinadolor, D.M.D. & Associates (North Carolina, announced March 2022): $50,000 civil money penalty. A patient posted a negative Google review under a pseudonym in 2015. The practice replied the same day with his real name, the dates he visited and the reasons for his treatment. It then ignored OCR’s data requests and a subpoena, so OCR imposed a penalty instead of negotiating a settlement.
• New Vision Dental (California, settlement announced December 2022): $23,000. The practice replied to Yelp reviews using patients’ real names when they had posted only Yelp usernames, and added details about their visits and insurance. The New Vision Dental settlement included a corrective action plan that required deleting old posts and notifying affected patients.

Notice the pattern. Each fine started with a reply someone typed in frustration, and the North Carolina reply cost the practice seven years after it was posted.

In a public review reply, PHI is anything that confirms the person is a patient or reveals something about their care. That net is much wider than most offices expect.

PHI covers any health information that can be tied to a specific person. In a review reply, that includes:

• Confirming they’re a patient (“We’re sorry your visit…” or “Great to see you again!”)
• Procedures, diagnoses or treatment plans
• Appointment dates or times
• Insurance, billing or payment details
• A provider’s name tied to their care (“Dr. Patel did your cleaning”)
• Photos of the patient or their smile
• Their real name, if they posted under a username

Here’s what that looks like in practice:

❌ Not compliant: “Thanks for coming in for teeth whitening on Saturday, Sarah! We hope your crown is holding up too.”

That one sentence confirms Sarah is a patient, names two procedures, gives an appointment day and uses her name.

✅ Compliant: “Thank you for the kind words! Reviews like yours make our whole team’s day.”

HIPAA isn’t the only way a review strategy goes sideways. Fake reviews, incentives and review gating carry their own risks, which we cover in other common dental review mistakes.

A patient posting their own treatment details does not give your practice permission to discuss them. HIPAA still applies to you even when the patient has made it public.

The reason is simple. The patient isn’t bound by HIPAA, so they can say anything they like about their own care. Your practice is a covered entity (a healthcare provider that must follow HIPAA), so you can’t confirm, expand on or correct what they wrote in public. Repeating it is a new disclosure, and that disclosure is yours.

Say a reviewer writes, “My root canal last Tuesday was a nightmare.”

❌ Not compliant: “We’re sorry your root canal was uncomfortable. Dr. Smith followed standard protocol.”

✅ Compliant: “We’re sorry to read this. We take every concern seriously and would like to talk with you directly. Please call our office manager at [phone number].”

The same goes for “correcting the record” on a false review. You can’t use patient records to prove a reviewer wrong in public, even when your notes clearly show they’re mistaken.

It should thank or acknowledge the reviewer in general terms and invite private contact, without confirming anything about their care. The safest approach is a small library of pre-approved replies your team adapts, so nobody writes from scratch in the moment.

The templates below handle the HIPAA side. For tone, timing and why replying matters at all, see our guide on responding to dental Google reviews.

How should you reply to a 5-star review?

When to use it: Any glowing review, with or without details.

Thank you so much for taking the time to share this! Kind words like yours mean a lot to everyone at [Practice Name].

Skip “great to see you again” and “see you at your next cleaning.” Both confirm a visit. For more ideas, read our quick tips for responding to positive reviews.

How should you reply to a positive review that mentions treatment?

When to use it: the reviewer names a procedure or a provider (“Dr. Lee made my implant painless!”).

Thank you for the wonderful review! Our team works hard to make [Practice Name] a comfortable, welcoming place, and we’re so glad that comes through.

Don’t repeat the procedure and don’t name the provider back. Thanking Dr. Lee publicly confirms who treated them.

How should you reply to a negative review about wait times or service?

When to use it: complaints about scheduling, waiting, phone calls or front-desk service.

Thank you for your feedback. Respecting everyone’s time is important to us, and we’re sorry to hear about your frustration. Please call [Office Manager] at [phone number] so we can talk this through privately.

Acknowledge the concern in general terms. Don’t write “sorry about your wait on Monday,” which confirms an appointment.

How should you reply to a negative review that mentions treatment or a provider?

When to use it: the reviewer criticizes a procedure, a result or a specific doctor.

We’re sorry to read this. We take all feedback seriously and would like the chance to understand your concerns. Please contact [Office Manager] directly at [phone number] so we can talk privately.

No confirmation and no defense. Don’t explain clinical decisions, and don’t vouch for the provider’s training in that reply.

How should you reply to a review that may be false or from someone who isn’t a patient?

When to use it: you don’t recognize the reviewer, or the details don’t add up.

Thank you for sharing your concerns. We hold ourselves to high standards and take all feedback seriously. If you’d like to discuss this, please call [Office Manager] at [phone number].

Stay neutral. Never write “We have no record of you as a patient.” Denying someone is a patient reveals as much as confirming it. Google and Yelp let you report reviews that break their content policies, so flag it there instead of arguing in public.

How should you reply to a billing or insurance complaint?

When to use it: complaints about costs, balances, statements or coverage.

Thank you for reaching out. We know questions about costs can be frustrating, and we want to help. Please call our billing team at [phone number] so we can look into this with you privately.

No dollar amounts, no insurer names, and no “your balance.”

Why shouldn’t you reply with “Due to HIPAA, we can’t comment on your visit”?

Because on its own, it implies the reviewer is a patient. If there were no patient relationship, there would be nothing for HIPAA to protect. A safer version states a general policy: “We never discuss whether someone is or isn’t a patient online. Please call our office at [phone number] so we can talk privately.”

Before your team uses these: templates lower your risk, but they aren’t legal advice. Have your privacy officer or attorney approve your final response library.

One or two trained people, and nobody else. Fewer hands means fewer chances for someone to type a patient’s name in a frustrated moment.

Set it up like this:

• Limit and track access. Keep a list of who has logins to Google, Yelp, Facebook and Healthgrades, and remove access the day someone leaves.
• Get a BAA from outside help. If an agency or software tool posts replies for you, get a signed business associate agreement (BAA) first. A BAA is a contract that requires a vendor to protect patient information the way you do.
• Never reply angry. If a review stings, write your reply, then wait until the next day to post it. A calm, professional reply protects your patients and your reputation.
• Review anything AI drafts. If a tool drafts replies, a trained person still reads every one before it posts. Never feed the tool patient records or chart notes.

Audit them, and fix what you find. OCR’s corrective action plan for New Vision Dental required deleting old posts, so don’t assume a reply from years ago is safe because nobody has complained yet.

1. Pull every reply your practice has posted on Google, Yelp, Facebook and Healthgrades.
2. Flag any reply that uses a real name, confirms a visit, or mentions treatment, dates, insurance or billing.
3. Edit or delete every flagged reply.
4. If a reply disclosed PHI, talk to your privacy officer about whether it needs to be handled as a potential breach.
5. Write down what you changed and when.

Adrian Lefler is the CEO and Co-Founder of My Social Practice and a recognized dental marketing expert with nearly two decades of experience. He is a trusted voice in dental marketing, AI in dentistry, and emerging technology, and he hosts BYTE SIZED, a podcast focused on dental AI, innovation, and technology.