Providers can respond to patient reviews, but may never disclose protected health information in doing so; even confirming that someone is a patient is a PHI disclosure under HIPAA. Safe replies stay generic and move the conversation offline. OCR has fined providers $10,000 to $30,000 for review replies.[1]
Few review situations are as asymmetric as the one healthcare providers face. A patient can post anything about their visit; the practice replying to it is a regulated entity whose single misjudged sentence can trigger a federal enforcement action. This guide covers why confirming patient status is itself a violation, the real OCR fines that came from review replies, side-by-side examples of PHI-safe and PHI-leaking responses, a template your whole team can use, and where review removal actually runs (through Google's policies, not through HIPAA).
Key takeaways
- HIPAA does not stop you from replying to reviews; it stops you from disclosing PHI in the reply. The trap is that merely acknowledging someone is or was your patient already counts as a PHI disclosure.
- A patient posting their own health details publicly does not waive your obligations. You still cannot confirm, correct, or add to anything about their care.
- OCR enforces this: Manasa Health Center paid $30,000 with a two-year corrective action plan (2023) and Elite Dental Associates paid $10,000 (2019), both over PHI disclosed in review responses.
- The safe reply formula is always the same: thank the reviewer, state your general commitment to care, invite them to contact the office directly, and say nothing that ties them to your practice as a patient.
- HIPAA and Google's review policies are separate systems: HIPAA governs what you may say, Google's policies govern what content stays on the platform. Removal requests run through Google, not through HIPAA.
Why is confirming patient status a HIPAA violation?
Because the fact that an identifiable person receives or received care from you is itself protected health information, and the HIPAA Privacy Rule bars a covered entity from disclosing PHI without authorization, a marketing-friendly review reply is not one of the permitted purposes.[1] PHI is not limited to diagnoses and charts; it covers any individually identifiable health information a covered entity holds, and patient status is the first item on that list.
This produces the asymmetry that frustrates many providers: the reviewer can say anything about their visit, but you cannot even say "you were seen on a Tuesday." The review platform is a public space, the reviewer is speaking about themselves, and you are a regulated entity speaking about a patient. The rules only bind one side of that exchange, and it is yours.
Has anyone actually been fined for a review reply?
Yes, at least twice, and the second penalty was triple the first. In 2023, the HHS Office for Civil Rights settled with Manasa Health Center, a New Jersey psychiatric practice, for $30,000 plus a two-year corrective action plan after the practice disclosed the PHI of four patients, including mental health diagnoses and treatment details, in responses to negative Google reviews.[2] In 2019, Elite Dental Associates in Dallas paid $10,000 after disclosing a patient's PHI in a response to a social media review.[3]
Both cases started the same way: a frustrated provider tried to defend the practice publicly and included details only the treating office could know.[4] The dollar amounts understate the real cost; corrective action plans mean years of OCR oversight, policy rewrites, and workforce retraining.
PHI-safe vs PHI-leaking replies: a comparison
The line is simple to state: a safe reply would read identically whether or not the reviewer had ever set foot in your office. Anything that only makes sense if they are your patient leaks PHI.
| PHI-leaking reply (violation risk) | PHI-safe alternative |
|---|---|
| "We're sorry your appointment last week didn't meet expectations." (confirms patient status and visit timing) | "We take all feedback seriously and would welcome the chance to discuss any concern directly." |
| "Your insurance denied the claim, which is why you were billed." (discloses billing and insurance details) | "Billing questions are best resolved one on one; please call our office so we can help." |
| "You missed two appointments before this visit." (discloses treatment history to rebut the review) | "We are committed to timely care for everyone we serve and would appreciate the opportunity to talk." |
| "We cannot discuss your treatment here, but you were offered a follow-up." (the denial itself confirms patient status and care details) | "Privacy laws prevent us from discussing any individual's care or confirming whether someone is a patient." |
What does a HIPAA-safe review response look like?
A safe response is generic, warm, and routes the conversation offline without acknowledging that the reviewer is a patient. A template you can adapt:
"Thank you for your feedback. We take every comment seriously and are committed to providing excellent care and service. Privacy laws prevent us from discussing any individual's care, or even confirming whether someone is our patient, in a public forum. If you would like to discuss a concern, please contact our office directly at [phone or email] and ask for [practice manager]."
Use the same shape for positive reviews too: "Thank you for the kind words, our team works hard to provide great care" discloses nothing, while "We loved having you in for your cleaning" confirms patient status. Train everyone with access to the business profile on this template, because the enforcement cases above were not caused by policy documents but by whoever typed the reply that day.
When can a review containing health information be removed?
Removal runs through Google's content policies, not through HIPAA: a patient describing their own experience and their own health details is generally allowed to do so, and HIPAA gives you no removal claim against them. What Google's policies do prohibit is content such as fake reviews, reviews from people with no real customer experience, harassment, hate speech, off-topic rants, and posts exposing another person's private information.[5] So a review that reveals a third party's health details, comes from someone who was never a patient, or was planted by a competitor is a removal candidate; a harsh but genuine account of the reviewer's own care usually is not.
The reporting and escalation process is the standard one for any Google review; our pillar guide covers it end to end: how to remove a Google review.
How do HIPAA and Google's policies interact?
They never overlap: HIPAA regulates your conduct as a covered entity, while Google's policies regulate the content on its platform, and each is enforced by a different body (OCR versus Google's moderation).[1] This separation matters in both directions. Reporting a review to Google does not involve disclosing PHI and is always available to you; and conversely, a review being false or unfair gives you no license to reveal patient information while rebutting it. The compliant playbook for a healthcare practice is therefore: respond with the safe template, report reviews that break Google's rules, and keep every detail-level conversation offline. For how this fits into a healthcare reputation program more broadly, see ReviewTactic for healthcare.
Where ReviewTactic fits
ReviewTactic works the removal lane that HIPAA leaves open. For reviews that do break Google's rules, we analyze them against Google's published content policies and flag the ones that qualify through Google's official reporting process, and the process never requires disclosing patient information. Removal is handled on a success-fee basis for healthcare practices, so you only pay if a review actually comes down, and removal is never guaranteed, because no one can honestly guarantee it. See how healthcare review removal works.
Sources and references
- U.S. Department of Health and Human Services, "Summary of the HIPAA Privacy Rule." hhs.gov back
- HHS Office for Civil Rights, Manasa Health Center resolution agreement and settlement announcement, 2023. hipaajournal.com back
- HHS Office for Civil Rights, Elite Dental Associates resolution agreement and settlement announcement, 2019. hhs.gov back
- HIPAA Journal, coverage of OCR enforcement actions over PHI disclosed in review responses. hipaajournal.com back
- Google, "Prohibited and restricted content" (Maps user-contributed content policy). support.google.com back