Why is replying to a review a HIPAA risk at all?
Because the HIPAA Privacy Rule protects information that relates to "the provision of health care to the individual" and identifies that individual, in any form, including a sentence typed into Google or Yelp.1 A review is written by a named or recognisable person. The moment a reply adds anything the practice knows from its own records, the practice has disclosed protected health information to the public.
The reviewer choosing to describe their visit does not change this. The Privacy Rule requires written authorization for any disclosure that is not for treatment, payment, health care operations or another purpose the rule allows.1 Defending your reputation in public is not on that list.
What have regulators actually done about it?
The Office for Civil Rights at the U.S. Department of Health and Human Services (OCR) enforces HIPAA. Its public enforcement pages include these cases, each about replies to online reviews:
| Practice | Year | Outcome |
|---|---|---|
| Elite Dental Associates, Dallas, TX | 2019 | $10,000 settlement and corrective action plan |
| Dr. U. Phillip Igbinadolor, D.M.D. & Associates, NC | 2022 | $50,000 civil money penalty |
| New Vision Dental, CA | 2022 | $23,000 settlement and corrective action plan |
| Manasa Health Center, NJ (psychiatry) | 2023 | $30,000 settlement and corrective action plan |
The details matter more than the amounts. Elite Dental replied to a review by disclosing the patient’s last name and details of their health condition, and OCR then found the same pattern across multiple replies on its Yelp page.3 The North Carolina dental practice posted a patient’s information on a webpage in response to a negative review, then did not answer OCR’s data request or its subpoena, which is how a settlement became an imposed penalty.4 New Vision Dental’s case is described by OCR as "inappropriate use of social media to respond to patient reviews, disclosing protected health information", and OCR adds that "this practice is illegal under HIPAA".5 Manasa Health Center, a psychiatric practice, began with a single complaint about one response to one negative review.6
Social media is not the place for providers to discuss a patient’s care. Doctors and dentists must think carefully about patient privacy before responding to online reviews.
The reply that gets a practice into trouble is almost always the one written to correct the record.
What must a reply never say?
- That the reviewer is or was a patient. "We have no record of that" or "we are sorry your visit went badly" both answer that question.
- Dates, appointment times, which practitioner they saw, or how often they came.
- Anything about their condition, diagnosis, treatment plan, results or medications.
- Billing details, insurance, balances owed, or collections.
- Their own behaviour in the clinic, however badly they behaved.
- Their name, if they posted under a nickname and you know who they are.
The fourth and fifth items are where most owners slip. "You missed three appointments and left an unpaid balance" feels like a fair defence. It is also a disclosure of appointment history and payment information about an identifiable person.1
What does a safe reply look like?
A safe reply is written for the next patient reading it. It describes how the practice works, offers a private channel, and says nothing that depends on knowing who wrote the review. Three patterns cover almost every case:
- The general policy reply. "Thank you for taking the time to write this. Our privacy obligations mean we cannot discuss anyone’s care here. We take feedback about wait times seriously, and we would welcome a call to our practice manager at the main number."
- The process reply, for complaints about billing or scheduling. Describe the policy as it applies to everyone ("our cancellation policy is shared with every new patient in writing") without saying it was applied to this person.
- The positive review reply. Thank them without confirming care: "Thank you for the kind words." Not "It was lovely treating your back pain, Susan."
These are patterns, not scripts that guarantee a safe outcome. Read every reply once more before posting and ask one question: does any word here come from something only the practice knows?
The reply is also governed by the FTC Consumer Review Rule, which forbids threats or knowingly false accusations used to get a review removed. That side is covered in asking patients for reviews under the FTC rule.
Does HIPAA apply to a health coach or a cash-only practice?
Not always, and it is worth knowing which side of the line you are on. HHS lists doctors, clinics, psychologists, dentists and chiropractors as covered health care providers "but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard", such as electronic insurance claims.2 A health coach who never bills insurance electronically may not be a covered entity. HHS offers a decision tool for checking.2
My advice is to reply as if HIPAA applies either way. HIPAA also leaves stricter state privacy laws in place rather than overriding them,1 and licensing boards and professional codes carry their own confidentiality duties.
What should a practice put in place this week?
- Decide who is allowed to reply to reviews. One or two people, not whoever sees it first.
- Write the three reply patterns above into a shared document, adapted to your voice.
- Add a rule: no reply to a negative review on the day it is read.
- Train front-desk staff on what counts as patient information in a public reply.
Written policies matter in these cases. In Manasa’s settlement, OCR listed a failure to implement policies and procedures on patient information alongside the disclosures themselves.6 How reviews and replies feed into what AI assistants say about a practice is covered in the practice AI recommends, and a review of your public replies is part of the free check.
This article explains published HHS guidance and enforcement. It is not legal advice. If a review involves a threat, a legal claim or a board complaint, speak to a healthcare lawyer before replying.