HIPAA-Compliant Review Responses for Dentists and Med Spas
A pizza shop can reply to a review however it likes. A dental office or med spa can't. The natural reply ("Sorry your crown felt uncomfortable, Mrs. Lee, but our records show you missed your follow-up") confirms that someone is a patient and reveals their treatment. Federal regulators have fined practices for exactly that.
This post covers the rule, the enforcement cases and a reply template for every star rating. Each one thanks, apologizes or invites contact without confirming the reviewer is a patient.
Running a business outside healthcare? Our Google review response templates cover every star rating without the privacy rules.
The rule: don't confirm, don't describe
The HIPAA Privacy Rule protects patients' health information held by covered entities. A health care provider is a covered entity if it transmits health information electronically in connection with a standard transaction, such as billing insurance (HHS, covered entities, as of Oct 2026). Most dental practices that bill insurance fall in that group. Whether a cash-pay med spa does depends on its setup; check with your compliance adviser. Even if HIPAA doesn't cover you, state privacy laws and plain patient trust point the same way.
HIPAA doesn't stop you replying to reviews, though. As OCR's guidance has been summarized, the Privacy Rule "does not prohibit HIPAA-regulated entities from responding to online reviews," but protected health information must not be disclosed without the patient's written authorization (HIPAA Journal, June 2023, checked Oct 2026).
So in practice, a safe reply:
- Doesn't confirm the reviewer is or was a patient, even if they said so themselves.
- Doesn't mention treatments, appointments, dates, insurance, prices paid, or anything from the chart.
- Doesn't argue facts about their care in public.
- Moves the conversation to a private channel with a named person.
The enforcement cases
These are real settlements and penalties, all over review replies:
| Year | Practice | Amount | What happened |
|---|---|---|---|
| 2019 | Elite Dental Associates, Dallas | US$10,000 | Replies on Yelp disclosed a patient's last name and details of her treatment plan, insurance and cost |
| 2022 | New Vision Dental | US$23,000 | Disclosed patient information in review replies |
| 2022 | Dr. U. Phillip Igbinadolor, D.M.D. & Associates | US$50,000 civil money penalty | Disclosed patient information in a review reply |
| 2023 | Manasa Health Center, New Jersey | US$30,000 | Google review replies disclosed four patients' information, including a mental-health diagnosis |
Sources: Fierce Healthcare on Elite Dental and HIPAA Journal on Manasa Health Center and the earlier cases, checked Oct 2026.
In the Elite Dental case, the OCR Director at the time said: "Social media is not the place for providers to discuss a patient's care." In the 2023 case, the OCR Director said of disclosing patient information in response to negative reviews: "Simply put, this is not allowed."
The fines weren't the end of it. The corrective action plans required written policies and staff training. In the 2023 case they also required breach notification letters to the affected patients.
Templates: 5 stars to 1 star
Fill in the bracketed parts and keep each reply short. Google's own advice is to keep replies short and specific and not to share private information (Google Business Profile Help).
With positive reviews, the trick is to thank someone warmly and echo their own words about the experience (friendly team, clean office, felt at ease). Add no clinical detail and don't confirm a visit.
5 stars
Thank you so much for taking the time to share this, [first name]. Our team works hard to make every visit feel calm and welcoming, and it means a lot to hear that came through.
[Name], Practice Manager
We're so glad you had a great experience with our team. Thank you for the kind words.
The team at [Practice]
Avoid: "Glad your implant healed well!", "See you at your six-month cleaning!", "Thanks for choosing us for your Botox." Each confirms a patient relationship and a treatment.
4 stars
Thank you for the thoughtful review. We're always looking for ways to make things even better, so if you'd like to share more, please call [Name] at our office. We'd love to hear from you.
3 stars
Thank you for your feedback. We want everyone who contacts our office to have a great experience, and it sounds like we fell short of that. Please call [Name], our office manager, at [number] so we can learn more.
2 stars
We're sorry to read this. Because of privacy rules, we can't discuss any details here, but we take every concern seriously. Please contact [Name] directly at [number] or [email] so we can talk it through.
1 star
We're sorry you're unhappy. Patient privacy laws prevent us from discussing any specifics in a public forum, even to respond to a review. We'd genuinely like to understand and help, so please call [Name] at [number].
Wait times and billing complaints
These are the ones that tempt the front desk to explain ("Our records show your insurance denied..."). Don't.
Thank you for raising this. We know waiting and billing questions are frustrating. We can't discuss details here, but [Name] in our billing office would be glad to go through it with you at [number].
Med spa result complaints
We're sorry to hear you're disappointed. We can't discuss anyone's care publicly, but we take this seriously and would like to talk with you directly. Please call [Name] at [number].
Avoid: "Results vary and this was explained in your consent form", "Filler typically takes two weeks to settle", "You were offered a free touch-up". All confirm a treatment.
Reviews from people who were never patients
We take all feedback seriously, but we're unable to find any record that matches this description. Please contact [Name] at [number] so we can look into it.
Be careful here. Even "we have no record of you" can be read as information about who is or isn't a patient. Many compliance advisers prefer the standard 1-star reply above for every negative review. For suspected fake reviews, report them to Google instead (see how to respond to a fake Google review).
Office policy: five rules to write down
- Only named staff reply, using approved templates.
- No reply mentions treatments, visits, dates, insurance, prices or outcomes.
- Negative reviews go to the practice manager before any reply, within one business day.
- Contact moves offline to phone or email with a named person.
- Train everyone who touches the profile, including any agency or software vendor, and keep a record of the training.
If an agency or software vendor handles your patient data (say, sending review requests from your patient list), you'll usually need a business associate agreement with them. Ask about it before you sign up.
Asking for reviews without exposing patients
You can ask every patient for a review, and Google even gives you a link and QR code (see how to get your Google review link and QR code). Keep requests generic, with no treatment named:
Thank you for visiting [Practice] today. If you have a moment, we'd be grateful for a Google review: [link]. Reply STOP to opt out.
Send it to every patient, not just the ones you expect to be happy. Google's policy prohibits selectively soliciting positive reviews (Google Maps content policy).
How BeeCMO helps
Guard Bee drafts a reply to every Google review. Its built-in rules bar personal data about the reviewer, refunds and admissions of fault, and you add your practice's privacy rules (never confirm a patient relationship, no treatment details, move contact offline) to your brand voice so every draft follows them. Replies to 1 to 3-star reviews always wait for your approval on your phone, and you can require approval for all replies. Review requests go to every patient, never filtered by rating. See BeeCMO for dentists and for med spas, or try the free review reply generator.
More on Guard Bee, how it compares with Podium, Birdeye and GoHighLevel, and pricing.
Frequently asked questions
Can a dentist respond to Google reviews under HIPAA?
Yes. HIPAA does not prohibit responding to reviews. It prohibits disclosing protected health information, which includes confirming someone is a patient or mentioning their treatment, without written authorization.
Is it a HIPAA violation to thank a patient for a 5-star review?
A general thank-you that repeats nothing clinical is the safe approach. Avoid naming treatments, visits or follow-ups, even when the reviewer mentioned them first.
What happens if a practice discloses patient information in a review reply?
OCR has settled or fined practices for this, from US$10,000 (Elite Dental Associates, 2019) to a US$50,000 civil money penalty (2022), with corrective action plans that require policies and training.
Does HIPAA apply to med spas?
It depends. A provider is a HIPAA covered entity if it transmits health information electronically in connection with a standard transaction such as insurance billing. Ask a compliance adviser; the safe review-reply rules are good practice either way.
Should we reply to negative reviews at all?
Yes, briefly and without details. A calm reply that invites the person to call a named manager shows future patients you take concerns seriously.
Sources
All checked 21 October 2026.
- HHS, covered entities and business associates: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html
- Fierce Healthcare, dental practice pays US$10K to settle complaint it disclosed patient information on Yelp (Oct 2019): https://www.fiercehealthcare.com/practices/dental-practice-pays-10k-to-settle-complaint-it-disclosed-patient-information-social
- HIPAA Journal, US$30,000 penalty for disclosing PHI in response to negative reviews (June 2023), including earlier cases: https://www.hipaajournal.com/30000-penatly-disclosing-phi-online-negative-reviews/
- Google Business Profile Help, tips to get more reviews and reply to reviews: https://support.google.com/business/answer/3474122
- Google Maps user contributed content policy: https://support.google.com/contributionpolicy/answer/7400114