Patient reviews: requests and replies that respect privacy
Guide · Updated October 31, 2026
Healthcare practices have two privacy questions with patient reviews: how to ask for them, and how to answer them. The second gets most of the attention, but the first matters too.
This guide covers both, in practical terms, for practices that want more genuine patient reviews without taking shortcuts.
Privacy considerations when asking for reviews
- Send review requests only through channels the patient has agreed to receive messages on, and follow your practice's communication policies.
- Keep the request generic. Do not reference the reason for the visit, the provider's specialty if that reveals a condition, or the treatment received.
- Be thoughtful about specialties where simply being a patient is sensitive. Some practices choose not to send automated review requests at all for certain services.
- If you use a vendor to send requests, check with your privacy officer whether a business associate agreement is needed.
- Make it easy to opt out of future requests.
Ask every eligible patient on the same schedule. Do not screen for satisfaction first and send only happy patients to a public review site.
Replying without creating a privacy problem
Healthcare providers that are covered by HIPAA have to treat review replies like any other disclosure. Confirming that someone is a patient, or mentioning their visit, condition or treatment, can itself be a disclosure of protected health information, even if the patient already posted those details.
The U.S. Department of Health and Human Services' Office for Civil Rights has taken enforcement action in cases involving providers' replies to online reviews. A safe reply speaks about practice policy in general and invites the person to contact the office directly.
- Do not confirm or deny that the reviewer is or was a patient.
- Do not mention dates, procedures, diagnoses, billing or insurance details.
- Use the same short, general reply pattern for every negative review so staff are not improvising.
- Have one trained person approve every reply before it is posted.
Your privacy officer or a healthcare attorney is the right person to confirm your practice's policy.
Asking for genuine reviews the right way
The steadiest way to improve how a profile looks is a regular flow of honest reviews from real patients. How you ask matters.
- Ask everyone, not just happy patients. Screening people first and only sending satisfied ones to a review site is known as review gating. Google's policies prohibit discouraging negative reviews or selectively asking for positive ones.
- Do not pay or reward people for reviews. Google prohibits incentivized reviews, and the FTC's 2024 rule on consumer reviews and testimonials prohibits buying reviews and conditioning rewards on positive or negative sentiment.
- Never write reviews yourself or have staff, relatives or vendors post them without clear disclosure.
- Make it easy: send the direct review link soon after the visit or job, in one short message.
- Check each platform's rules. Yelp, for example, asks businesses not to ask for reviews at all.
Replies that usually make things worse
- Calling the reviewer a liar or saying they were never a patient, in public.
- Sharing details about the patient's visit, account, bill or history.
- Offering a refund, discount or gift in exchange for editing or removing the review. Major platforms prohibit this, and the FTC's rule on consumer reviews targets conditioning rewards on what a review says.
- Threatening legal action in the reply. If you believe the post is defamatory, talk to a licensed attorney privately instead.
- Long replies that relitigate every point. Two to four sentences is usually enough.
If you have already posted a reply you regret, most platforms let the business edit or delete its own response. Replace it with a short, calm version.
The federal rules on reviews in plain terms
In 2024 the Federal Trade Commission finalized a rule on consumer reviews and testimonials, which took effect in October 2024. In general terms it targets:
- Fake reviews, including reviews from people who do not exist or who did not have the experience described.
- Buying positive or negative reviews, or offering rewards that are conditioned on what the review says.
- Reviews by company insiders or their relatives that do not clearly disclose the connection, in certain circumstances.
- Using unfounded legal threats, intimidation or false accusations to suppress reviews.
- Misrepresenting that a website that displays reviews is independent when the business controls it.
Separately, the Consumer Review Fairness Act of 2016 generally makes it unlawful to use form contracts that bar customers from posting honest reviews. If your intake paperwork contains a non-disparagement clause, have a lawyer look at it.
This is a summary, not legal advice. For questions about how these rules apply to your business, consult a licensed attorney.
Legal note: this guide is general information, not legal advice. Laws and platform policies change and vary by state. For advice about your situation, consult a licensed attorney in your state.
Getting help
Many of these steps you can take yourself. If you would like someone to look at your situation with you and suggest a plan, you can book a paid consultation. This is a paid consultation: price confirmed when scheduling. No payment is taken on this site. We do not guarantee that any review, article, listing or search result will be removed.