Dental Reviews and HIPAA: Get More Google Reviews and Reply Safely

Dental reviews and HIPAA collide every time a patient posts on Google and someone at the practice wants to reply. A one-star review says the hygienist was rough and the bill was wrong. The natural instinct is to set the record straight: "We reviewed your chart and you were told about the cost of the deep cleaning at your March visit." That reply feels fair. It is also a HIPAA disclosure.

This happens more than you'd think, and the federal government has fined dental practices for exactly this. At the same time, reviews are one of the strongest signals for ranking in Google Maps and for getting chosen by new patients. You can't ignore them.

This guide shows you how to do both: collect a steady stream of honest reviews, and reply to every one of them without exposing patient information. It's part of our wider AI marketing system for dentists. Nothing here is legal advice, so check with your compliance advisor or a healthcare attorney for your specific situation.

Why review replies are a HIPAA risk

Under HIPAA, protected health information (PHI) includes much more than X-rays and treatment notes. The simple fact that a person is your patient is PHI. So is anything about their visits, treatment, billing or insurance.

A patient can say whatever they like about themselves in a public review. That doesn't give the practice permission to say anything back. The patient's own disclosure is not an authorization for you to disclose more.

The two dental cases every office should know

In 2019, Elite Dental Associates in Dallas paid $10,000 to settle with the HHS Office for Civil Rights after it disclosed patient information while responding to reviews on Yelp. In December 2022, New Vision Dental in California paid $23,000 to settle similar allegations about Yelp review replies, along with a corrective action plan. Both cases are listed in OCR's public resolution agreements.

The dollar amounts are modest compared with other HIPAA settlements, but the cost isn't only the fine. It's the investigation, the corrective action plan, the staff training, the monitoring, and the local news coverage. And the replies themselves stay online until someone deletes them.

Unsafe vs safe replies

The difference between a risky reply and a safe one is usually one sentence.

The unsafe reply confirms she's a patient, names a treatment, and discloses appointment history. The safe reply says nothing about her at all. It shows future patients that the office is calm and responsive, which is the real audience for any review reply.

Safe reply templates

Use these as starting points and adjust the wording so they don't all sound identical. Have one person (usually the office manager or a dentist) own replies, and never let a frustrated team member reply in the moment.

Positive review, general

"Thank you so much for taking the time to leave a review. We're glad to hear it, and we'll share your kind words with the whole team."

Notice what's missing: no "We loved seeing you for your cleaning", no "Glad your implant healed well." Even positive replies that mention treatment confirm the person is a patient.

Positive review that mentions a specific dentist or team member

"Thank you for the kind words. We'll make sure Dr. Kim and the team see this. We really appreciate you taking the time."

Repeating a team member's name that the reviewer already used is generally lower risk than mentioning treatment, but keep it brief and don't add details.

Negative review about wait times or the front desk

"Thank you for the feedback. We work hard to respect everyone's time, and we're always looking at how we schedule and staff the front desk. We'd welcome the chance to hear more. Please call our office manager at (555) 010-2000."

Negative review about billing or insurance

"We're sorry to hear about this frustration. Insurance and billing questions can be confusing, and our team is happy to walk through any account privately. Please call us at (555) 010-2000 and ask for our billing coordinator."

Negative review about treatment or pain

"Thank you for sharing this. Patient comfort and care are our top priorities, and we'd like the chance to talk directly. Please contact our office manager at (555) 010-2000."

Never debate clinical details in public, even if the review is unfair. The conversation belongs on the phone.

A review you suspect is fake or from someone who was never a patient

"We take all feedback seriously. We'd like to understand more, so please contact our office manager at (555) 010-2000."

Don't write "We have no record of you as a patient." That statement reveals information about who is and isn't a patient, and it can backfire if the person was seen under a different name. Report the review to Google instead (see below) and keep the public reply neutral.

Reply checklist for every review

Getting more Google reviews, within the rules

Now for the other half: making sure most of your reviews come from satisfied patients who would never have bothered without a nudge.

What the FTC and Google ban

The FTC's Rule on Consumer Reviews and Testimonials (16 CFR Part 465) took effect October 21, 2024. Among other things, it bans:

• Fake reviews, including reviews from people who never visited.
• Paying or giving incentives for reviews that are conditioned on them being positive (or negative).
• Reviews by owners, managers or staff (or their relatives) without clear disclosure.
• Review suppression, such as threatening or intimidating someone to remove a negative review.
• Buying or selling fake social media followers or views.

Violations can carry civil penalties for each one. The FTC's questions and answers on the rule explains it in plain language.

Google's own policies go further on two points that matter to dental offices. First, Google prohibits review gating, which means only asking patients you expect to be happy, or sending a survey first and only showing the Google link to people who rate you highly. Second, Google's prohibited and restricted content policy bans offering incentives for reviews at all, including discounts, raffle entries or free whitening, and bans staff reviewing their own employer.

Ask at checkout, in person

The single best moment to ask is at the front desk right after a good visit, when the patient is still in the building and feeling relieved.

Notice the ask goes to every patient, not only the chatty ones, and nothing about the review's content is suggested. You can ask people to "share what your visit was like" but not to leave five stars.

Make it one tap

Get your review link and QR code from your Google Business Profile (our general guide on how to get more Google reviews shows the exact steps). Then:

• Print the QR code on small cards at each checkout station and in treatment rooms.
• Add the link to the footer of receipts or visit summaries if your practice management system allows it.
• Put a small sign near the exit, not a big poster in the waiting room.

Follow up once, through the right system

Many patients mean to leave a review and simply forget, so one follow-up message the day after the visit helps. But remember what that message is: it goes to someone because they were your patient that day. Send it through your HIPAA-compliant patient communication platform (Weave, NexHealth, your PMS's built-in messaging, or a review tool that signs a business associate agreement), not through a general-purpose marketing tool.

If you send review requests by text, the message should come from a properly registered number and respect patient consent and quiet hours. Our SMS marketing, TCPA and 10DLC guide explains the rules, and your platform vendor can tell you how their review requests are classified.

What the team should never do

• Write reviews for the practice, or ask friends and family to.
• Post reviews from the office Wi-Fi on behalf of patients, or hand patients an office tablet and stand over them.
• Offer anything of value for a review.
• Ask only "happy" patients or filter by survey score.
• Tell an unhappy patient to delete their review in exchange for a refund.

That last one is worth a moment. Resolving a complaint and refunding someone is fine. Making the refund conditional on removing a review can count as review suppression.

Handling fake, abusive or competitor reviews

Sometimes a review really is fake: a competitor, a former employee, or someone who has never been inside your building. You can't delete it yourself, but you can report it.

1. Open your Business Profile, find the review, and choose the option to report it. Pick the policy reason that fits (spam, conflict of interest, off-topic, offensive and so on).
2. Keep a private log with the date, the review text and why you believe it's fake, for your records only.
3. If Google declines to remove it, you can usually appeal once with more context.
4. Post a short, neutral public reply in the meantime, using the template above.

Google removes reviews that break its policies, not reviews that are merely unfair or negative. A real patient's honest complaint will stay, which is why the reply matters more than the removal.

For other healthcare and professional services, our guide on how to respond to negative reviews covers templates by scenario.

Where reviews fit in your marketing

Reviews help in three places at once:

• Google Maps ranking. Google lists review count and score as factors in local ranking. See our dental SEO guide for how reviews fit with categories and treatment pages.
• Your website. You can show your Google rating on your site, but quoting individual patient reviews on your own pages or in ads counts as a testimonial and may need patient authorization under HIPAA. Check with your compliance advisor before republishing patient words. Our guide to a dental website that converts new patients covers trust signals.
• Social media. The same authorization logic applies to resharing a patient's review or photo. Our dental social media plan includes the consent rules.

Tracking reviews without exposing PHI

Track four numbers monthly: total reviews, average rating, new reviews this month, and median time to reply. Compare them with your top three competitors, because Maps ranking is relative.

Growvia's competitor tracker records each rival's rating, review count and review velocity alongside their Maps position, and its Google Business Profile tools can help you monitor reviews and draft replies once your profile is connected (Google's approval for profile access can take a little time). It's important to be clear about what Growvia is not: it isn't a HIPAA-covered system and won't sign a BAA, so send patient review requests from your HIPAA-compliant platform and keep any patient details out of Growvia entirely. Drafting a reply that contains no PHI, in a tool that never sees your patient list, is the safest setup.

A one-week rollout for your office

1. Monday: Get your review link and QR code, and order checkout cards.
2. Tuesday: Hold a 15-minute team huddle on the checkout ask and the "never do" list.
3. Wednesday: Turn on next-day review requests in your patient communication platform.
4. Thursday: Save the reply templates above where the office manager can reach them.
5. Friday: Reply safely to every unanswered review from the last 90 days, and edit or delete any old replies that mention treatment.

That last step is easy to overlook. If a previous manager replied with details years ago, those replies are still public. Clean them up now.

Once reviews are flowing, the next easy win is bringing back patients who already know you. Our guide to dental patient recall and reactivation covers that, and the dentist marketing pillar guide shows how reviews fit with SEO, ads and reporting.

Frequently asked questions

Can a dentist respond to a Google review without violating HIPAA?

Yes. Keep replies general: thank the reviewer, describe office policies in broad terms and invite them to call. Never confirm they are a patient or mention any treatment, visit or billing detail.

Is it a HIPAA violation to say "thank you for being our patient"?

It can be, because it confirms the person is your patient, which is protected information. A safer reply is "Thank you for taking the time to leave a review."

Can I offer a discount or prize for Google reviews?

No. Google's policies prohibit offering incentives for reviews, and the FTC rule bans incentives conditioned on a review's sentiment. Simply asking every patient is allowed and works well.

Can I only ask happy patients for reviews?

No. Selectively asking satisfied patients, known as review gating, is against Google's policies. Ask every patient the same way.

What should I do about a fake negative review?

Report it to Google through your Business Profile with the policy reason that fits, and post a short, neutral reply that doesn't confirm or deny the person was a patient. Google removes reviews that break its policies, not ones that are simply negative.

Can I post patient reviews on my website?

You can display your overall Google rating, but republishing a patient's own words as a testimonial may need their written authorization under HIPAA. Check with your compliance advisor first.