October 7, 2026 · 10 min read

HIPAA and Google Reviews for Medical and Dental Practices

HIPAA and Google reviews: a practice may ask patients for reviews, but the reply is the risk. Four HHS cases, Google's rules, and a safe reply.

A patient leaves a one-star review that gets the facts wrong. You have the chart, you know what happened, and the obvious move is to set the record straight in a reply.

For a medical or dental practice, that reply is the most expensive thing you can do on Google. The rules are narrower than most practices fear on the asking side, and stricter than most expect on the replying side. This guide uses the federal enforcement record, not marketing-blog advice.

This is general information, not legal advice. Rules vary by state and change over time; check with a healthcare attorney about your own practice.

What HHS has actually punished

The Office for Civil Rights at the Department of Health and Human Services (OCR) enforces HIPAA. Its resolution agreements index lists every settlement and civil money penalty it announces. Four of them involve replies to online reviews.

The details repeat across all four. Elite Dental's replies gave a complaining patient's last name, treatment plan, insurance and cost. New Vision Dental replied with patients' full names where the reviewers had posted under Yelp nicknames. The North Carolina practice named a patient who had reviewed under a pseudonym. Manasa Health Center, a psychiatric practice, disclosed one patient's mental health diagnosis and treatment in a reply to a negative review.

Two points about this table are usually reported wrong.

Most of these were settlements, not fines. Only the North Carolina case was a civil money penalty, and that practice ignored OCR's data request and subpoena. The other three settled and agreed to corrective action plans. Manasa's plan also required it to send breach notices to every patient whose information it had posted.

The amounts are not the whole cost. Each settlement came with a two-year corrective action plan, written policies and staff training.

There is no case after June 2023 on OCR's index, which runs to September 2026. That is not evidence the risk went away: investigations usually start from a complaint, and a patient named in a reply is the likeliest person to file one.

A related case: in September 2025, OCR settled with Cadia Healthcare Facilities in Delaware for 182,000 dollars after it posted 150 patients' names, photos and treatment details as website "success stories" without written authorization.

Why "they posted it first" is not a defense

In every case, the patient had already said they were a patient. Repeating it felt like no new disclosure.

HIPAA does not work that way. Protected health information is defined at 45 CFR 160.103 as individually identifiable information that relates to the provision of health care to a person. HHS's own de-identification guidance makes the point directly: a name alone is not necessarily protected, but a name listed with an indication that the person was treated at a certain clinic is.

So the reply itself is the disclosure. "We're sorry you were unhappy with your crown, Mrs. Diaz" confirms a name, a patient relationship and a procedure. "We have no record of that charge on your account" confirms there is an account. The patient's choice to talk about their care does not give the practice permission to talk about it too.

OCR has never published a guidance page on online reviews. Its position appears only in the enforcement announcements. In the Manasa release, OCR's director described disclosing patient information in replies to negative reviews in four words: "Simply put, this is not allowed."

A reply that stays inside the line

The safe reply says nothing that confirms or denies the person was ever seen. It also does not have to be cold. A version that works for praise and complaints alike:

Thank you for taking the time to write this. Privacy law prevents us from discussing anyone's care or account in a public reply, including whether someone is a patient. If you'd like to talk this through, please call our office manager at [practice number].

Use the same wording for five-star reviews. Thanking happy patients by name and procedure still discloses information about them.

Google's own reply guidance (as published, accessed 7 October 2026) points the same way: protect privacy, keep it short, do not use replies to promote anything. Google also screens replies against its content policy before they go live, according to its review management page, so a reply that includes someone else's medical details can be rejected on Google's side as well. For more on writing replies that do not read as copied, see our guide to review response templates.

When a review contains the patient's own health details

Practices often ask whether a review can come down because the patient disclosed their own diagnosis. Google's prohibited and restricted content policy bans personal information "about yourself or others," and lists medical information among the examples (as published, accessed 7 October 2026). That is a legitimate reason to report the review. Removal is still Google's decision.

A review from someone who was never a patient falls under a different line in the same policy, which says a review should reflect an actual experience with the business. Here, the safe course is to report it through Google's report process and not to reply "we have no record of you," which is itself a statement about who is and is not a patient. Our walkthrough on reporting a fake Google review covers the steps.

HIPAA and Google reviews: the asking side

Here the received wisdom is backwards. Many practices assume asking for reviews is the HIPAA problem and replying is fine. None of the cases above was about a request.

The question practices raise is whether a review request counts as "marketing" under 45 CFR 164.501, which would require written patient authorization. Marketing means a communication that encourages someone to buy or use a product or service. The same section exempts communications about the provider's own services and lists quality assessment and customer service under health care operations.

No primary source answers this question. No HHS guidance page, FAQ or enforcement action says whether asking a patient for an online review is marketing or health care operations. Vendor pages that call their review requests "HIPAA-compliant" are giving you their own reading. Ours is that a neutral request about the patient's experience sits closer to customer service than to marketing, but treat that as a reasonable interpretation, not a ruling.

The question that has a clearer answer is who handles the patient list.

Your vendor probably needs a business associate agreement

A list of patient names and email addresses from your practice is protected health information, by the de-identification guidance above. Under 45 CFR 160.103, anyone outside your workforce who "creates, receives, maintains, or transmits" that information on your behalf is a business associate, and needs a signed business associate agreement (BAA).

There is a narrow exception for pure conduits. HHS's business associate guidance limits it to entities that "only provide transmission services," and an HHS FAQ on cloud services says a vendor that stores protected information is a business associate even if it cannot view it. A review-request platform that keeps your patient list to send requests and follow-ups is storing it.

No OCR source names review-request vendors specifically, so this is an inference from the definitions, though a short one. Before you upload a patient list anywhere, ask the vendor in writing whether it will sign a BAA.

Keep the request itself boring

The request should not mention the procedure, the provider seen or the date. "Thank you for choosing [practice]. If you have a minute, we'd value a Google review" carries no clinical detail if it reaches the wrong inbox. Our guide for dental practices shows a request built this way.

Google's rules that hit practices hardest

Google's prohibited and restricted content policy applies to every business, but three lines catch clinics more than most.

Selective asking is also a federal issue: the FTC's Q&A on its consumer reviews rule says it is not banned by the rule itself but could violate the FTC Act. Our post on review gating and the FTC rule explains that distinction.

The FTC has already acted against one healthcare business over reviews. In July 2025 it settled with telemedicine firm NextMed for 150,000 dollars, alleging it offered gift cards to get negative reviews changed or removed, made refunds conditional on removing them, and posted fake positive ones. The FTC's maximum civil penalty is 53,088 dollars per violation under 90 FR 5580, and the FTC confirmed in September 2026 that the figure stays unchanged for 2026.

The Consumer Review Fairness Act also voids contract clauses that restrict patients from reviewing you, so a non-disparagement clause in new-patient paperwork is unenforceable.

Google's guidelines for representing your business also let doctors and dentists hold their own profiles, separate from the practice's. Decide which profile your requests link to before you send any.

What patients do with the stars

There is no independent 2025 or 2026 survey on how patients choose doctors from reviews. The current figures come from companies that sell reputation services, so weigh them that way.

The most transparent is rater8's 2026 Patient Choice Report, a SurveyMonkey panel of 992 US adults fielded in April 2026. It found 75% would not book a provider rated below 4.0 stars, 66% said a provider's replies affect their trust, and 68% would leave a review if asked.

The best independent data is about what bad reviews contain. A JAMA Network Open study published in August 2025 analysed 1.1 million Yelp reviews of 138,605 US healthcare facilities. Negative reviews centred on billing, phone access and treatment quality; positive ones on staff kindness. Two of those three complaints are front-office problems a process change can fix.

Numbers we chose not to cite

These appear on most healthcare marketing pages. None traces to a 2025 or 2026 primary source:

• "94% of patients use online reviews to evaluate providers." The original Software Advice survey we found is from 2020, had 498 respondents, and reported 90%, not 94%.
• "72% of patients use online reviews as the first step." Also an older Software Advice figure, with no current source.
• "71% of patients won't see a doctor rated under 4 stars." No source found. The rater8 75% figure above is the closest verifiable version.

FAQ

Does HIPAA apply to Google reviews?

HIPAA and Google reviews meet at the reply. HIPAA does not govern what patients post about themselves, but it does govern what the practice posts back. Confirming in a reply that someone is a patient, or adding details about their care, is a disclosure of protected health information, as four HHS enforcement cases show.

Can a dental practice ask patients for Google reviews?

Yes. No HHS action has involved a review request. Ask every patient the same way, keep clinical details out of the message, and check whether any outside vendor holding your patient list will sign a business associate agreement.

Can we ask Google to remove a review that includes the patient's diagnosis?

You can report it. Google's content policy bans medical information about the reviewer or anyone else, which is a valid reason to flag it. Google decides whether it comes down.

What to do next

1. Search your practice's Google and Yelp replies from the last three years for patient names, procedures, dates and account details. Edit or delete any reply that has them.
2. Write one neutral reply, run it past whoever handles your HIPAA compliance, and make it the only approved reply for all staff.
3. Add online reviews to your written HIPAA policy and staff training. Every settlement above required this after the fact.
4. Ask each vendor that receives your patient list, in writing, whether it will sign a business associate agreement, and file the answer.
5. Remove any non-disparagement wording from new-patient paperwork.
6. Ask every patient for a review the same way, by the same channel, with no incentive and no reference to their treatment.